Privacy Policy

1. Scope and Our Role

1.1 This Policy covers personal information we handle as a business — for example, information about account holders, website visitors, and individuals who contact us. For that information, we are the party responsible.

1.2 Companies that subscribe to the Service (our customers) keep their own records in it, including personal information about their employees, contractors, buyers, contacts, and suppliers (“Customer Data,” described in Section 2.2). For Customer Data, the customer is the party responsible for it, and we process it on the customer’s behalf and under its instructions, only to provide, support, and secure the Service. The customer is responsible for having a lawful basis and any required notices or consents for that information.

2. Information We Collect

2.1 Information you provide:

• Account and profile information: name, email address, organization, role, preferred language, and your password (stored only in hashed form by our authentication provider; we never see it).
• Communications: messages, demo requests, support requests, and information you send to info@theagenticgrove.com.
• Billing information about our customers: the organization’s legal name, address, billing contacts, invoices, and payments (paid by bank transfer).

2.2 Customer Data a company keeps in the Service, which we process on its behalf:

• Farm and business records: farms, lots and blocks, crop lifecycle, applications, harvest, packhouse, workshop, pricing, costs, sales, purchases, accounting, and buyer and supplier records (CRM), with uploaded photos and documents.
• Employee and payroll records, when a company uses Human Resources: identity and contact details (name, national ID number, phone, email, address, nationality, sex, marital status, education, emergency contact), employment details (position, department, schedule, hire and termination dates), pay rates and salaries, time worked, payroll results and deductions, vacation and leave, social-security (CCSS) and work-risk insurance numbers, and bank details (bank and account or IBAN). Inside a company, salaries, ID numbers, phones, and bank accounts are shown only to its Owner and Admins and to the people it grants that access.
• Health-and-safety records, when a company uses its Integrated Management System: accidents and incidents, the injuries and body parts affected, incapacities and medical leave, and the follow-up of each case.
• Records of who did what: an activity log of field actions, a change history of employee records, and logs of accounting changes.

2.3 Information collected automatically:

• Usage and device data: log data, IP address, browser type, device identifiers, and pages viewed, collected to operate and secure the Service.
• Error reports: when a screen of the app fails, a short technical report (which screen, the time, the error text, and the browser type) reaches us automatically, without personal data, so that we can fix the fault.
• Bot-protection signals (Google reCAPTCHA / App Check) and, on the public website pages only, Google Analytics data (see Section 7).

2.4 Information from third parties:

• If you sign in with a Google account, we receive basic profile information (your name, email address, and profile photo) from Google, subject to your settings with them. Sign-in is otherwise by email address and password; no other sign-in provider is used.

3. How We Use Information

We use personal information to:

• create and manage Accounts and authenticate users;
• provide, operate, maintain, support, and secure the Service, including backups for disaster recovery;
• send service-related emails (such as invitations, verification, password-reset, and notification emails) and, at a company’s request, emails it sends through the Service (such as pay slips or invoices);
• respond to inquiries and provide support;
• find and fix faults, and prevent fraud, abuse, and attacks;
• invoice our customers and keep our business records;
• comply with legal obligations and enforce our Terms;
• understand how visitors use our public website (Google Analytics, public pages only);
• with your consent where required, send product updates or marketing (you may opt out at any time).

We do not sell personal information, and we do not use Customer Data for advertising.

4. Legal Bases and Consent

Where applicable law requires a legal basis, we rely on: your consent; the necessity of processing to perform our contract with you or your organization; our legitimate interests in operating and securing the Service; and compliance with legal obligations. For users in Costa Rica, we process personal data in accordance with Ley N.º 8968 and its regulations; for Canadian users, in accordance with PIPEDA. You may withdraw consent where processing is based on consent, subject to legal or contractual limits. For Customer Data, the customer that keeps it is responsible for the legal basis and for informing the people concerned.

5. How We Share Information

We do not sell personal information. We share it only as follows:

• Sub-processors: the service providers listed in Section 6, who help us run the Service under contractual confidentiality and data-protection obligations.
• Within your organization: a company’s records are visible to its own members according to the roles and permissions its administrators set. Another company never sees them.
• Our support: our platform administrator can open a company’s data to support it.
• Services a company chooses to use: for example an invoice it emails to its own customer, or a document it sends to a tax authority.
• Legal and safety: when required by law, regulation, legal process, or to protect the rights, property, or safety of The Agentic Grove, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent.

6. Our Sub-processors

These providers process personal information for us, each only for the purpose shown:

• Google Cloud / Firebase (Google LLC): the database, sign-in (Firebase Authentication), file storage, server functions, and backups. Customer Data is stored in the United States (Google Cloud multi-region nam5).
• Google Vertex AI (Google LLC): only when a company asks us to switch on written explanations in AI Insights. When someone in that company asks for an explanation or types a question, the figures shown on the card (already-calculated totals and trends, not the underlying records) and the question are sent to Google’s Gemini model, which returns the text. Farm, lot, and person names are replaced by codes before sending unless the company chooses to send names; email addresses and long numbers are removed. An answer is kept for 24 hours so that the same question is not sent twice. When written explanations are off, which is the default, nothing is sent.
• Netlify, Inc.: hosting of our website and of the files the app loads in your browser; it processes visitors’ IP addresses and request logs.
• Resend: delivery of the emails the Service sends (invitations, password resets, notifications, and the pay slips, invoices, and other documents a company sends through the Service); it processes the recipients’ addresses and the content of those emails.
• Google reCAPTCHA / Firebase App Check (Google LLC): protection against bots and abuse; it reads technical signals from your browser and device.
• Google Analytics (Google LLC): statistics about visits to our public website pages only (pages viewed, device and browser type, approximate location). It sends nothing from the signed-in app.

Services a company chooses to use or connect, such as government tax and electronic-invoicing systems or exchange-rate feeds, are not our sub-processors. We keep this list up to date.

7. Cookies and Similar Technologies

The app uses your browser’s storage to keep you signed in and to remember preferences (such as your language). On the public website pages only, Google Analytics uses cookies to count and understand visits; it is switched off on the sign-in pages and in the signed-in app, and sends nothing from them (a visitor who opens the app directly never loads it). Google reCAPTCHA / App Check may use cookies or read device signals to protect the Service from bots. You can control cookies through your browser settings; disabling some may affect functionality. Where required, we will request consent for non-essential cookies.

8. International Data Transfers

We are based in Canada. Customer Data is stored in Google Cloud in the United States (multi-region nam5), and some of the sub-processors in Section 6 may process information in other countries. This means personal information may be transferred to and processed in jurisdictions with different data-protection laws than your own. Where required, we use appropriate safeguards for cross-border transfers. We will give our customers notice before moving the primary storage of Customer Data outside the United States or Canada.

9. Data Retention, Deletion, and Backups

9.1 We retain personal information for as long as needed to provide the Service, maintain Accounts, comply with legal obligations, resolve disputes, and enforce our agreements.

9.2 Customer Data is retained while the customer’s subscription is active. For 30 days after it ends, the customer can ask us for a complete export of its records. On the customer’s written request, we delete its data from the live system within 30 days. Records the law requires us to keep, such as our own invoices, are kept as long as the law requires.

9.3 Backups. The database is copied every night, and each copy is kept 30 days; it can also be restored to any moment of the last 7 days. Uploaded files and sign-in accounts are copied every night, and those copies are kept up to 5 years. Backup copies are not edited one by one: deleted data leaves them only as they expire on this schedule. Until then they are used only to recover from a disaster.

10. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, a separate data space for each company enforced by the server on every read and write, role-based access controls, protection of the most sensitive employee data, nightly backups, and reputable cloud infrastructure. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If we confirm a security incident that results in unauthorized access to a customer’s data, we notify that customer without undue delay. You are responsible for safeguarding your credentials and for the security practices of your Authorized Users.

11. Your Privacy Rights

Subject to applicable law (including PIPEDA in Canada and Ley N.º 8968 in Costa Rica), you may have the right to:

• access the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your information, subject to legal limits;
• withdraw consent where processing is based on consent;
• object to or restrict certain processing; and
• request a copy of your information in a portable format.

To exercise these rights, contact us at info@theagenticgrove.com. We will respond within the timeframe required by applicable law and may need to verify your identity. If you are an individual whose data was entered into the Service by one of our customers (for example, as an employee of a farm), please direct your request to that customer; we will assist them as required.

12. Children’s Privacy

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us information, contact us and we will take appropriate steps to delete it.

13. Third-Party Links and Services

The Service and our communications may link to third-party websites or rely on third-party services. We are not responsible for the privacy practices of third parties other than our sub-processors; we encourage you to review their policies.

14. Automated Insights

The Service may generate analytics, forecasts, cost models, and recommendations, and, when a company switches them on, written explanations produced by an artificial-intelligence model (Section 6). These are informational tools to support your decisions and do not constitute professional, financial, or agronomic advice. They make no decision about any person. You remain responsible for your business decisions; check every figure before acting on it.

15. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by email or in-app) and update the “Last updated” date. Your continued use of the Service after changes take effect constitutes acceptance.

16. Language

This Policy may be provided in English and Spanish for convenience. In the event of any conflict or inconsistency between versions, the English version governs, except where local law requires otherwise.

17. Contact Us

For privacy questions or to exercise your rights, contact:

The Agentic Grove

Calgary, Alberta, Canada

Email: info@theagenticgrove.com

We are the party responsible for personal information handled under this Policy as a business (Section 1.1). If you are not satisfied with our response, you may have the right to contact your local data-protection authority (in Canada, the Office of the Privacy Commissioner of Canada; in Costa Rica, the Agencia de Protección de Datos de los Habitantes (PRODHAB)).