Privacy Policy

1. Information We Collect

The information we collect depends on how an organization uses the Services and the features it chooses to use.

Account and Contact Information

We may collect information associated with user accounts, including:

• Name
• Business or organization name
• Email address
• Telephone number, if provided
• Username or account identifier
• Role, permissions, facility access, or organization affiliation
• Business contact information, including mailing addresses when provided for parties, warehouses, or related records

Agricultural and Operational Data

Customers may enter, upload, import, generate, or otherwise provide operational information through the Services. Depending on the features used, this may include:

• Farm and grower information
• Customer and grower information
• Field information
• Crop and crop-year information
• Agricultural product or commodity information
• Variety information
• Lot and inventory information
• Storage and warehouse information
• Bin or facility information
• Inbound and outbound transaction information
• Shipment and logistics information
• Truck, trailer, carrier, or transportation information
• Weight certificate and scale information
• Gross, tare, net, wet, and dry weights
• Moisture information
• Grade and quality information
• Field tickets
• Storage receipts
• Ownership and inventory transfer information
• Pricing, charges, fees, invoices, or related commercial information
• Reports, spreadsheets, documents, and other records uploaded to or generated by the Services

Some of this information may constitute personal information when it identifies or can reasonably be associated with an individual.

Usage and Technical Information

When users access the Services, we may automatically receive certain technical information necessary to operate, secure, diagnose, or improve the Services. Based on how this application is built, this may include:

• IP address (including for certain scale-device registration and audit events)
• Browser or device user-agent information
• Authentication and session-related events
• Application feature use necessary to provide portal functionality
• Error and diagnostic information produced by the application runtime and hosting environment

The Services do not use the browser geolocation API to collect precise geolocation.

2. How We Use Information

We may use information collected through the Services to:

• Provide, operate, maintain, and support the Services
• Authenticate users and manage accounts
• Manage user roles and permissions
• Process agricultural inventory and warehouse transactions
• Track inventory ownership and movement
• Generate weight certificates, receipts, reports, and operational records
• Maintain agricultural, storage, logistics, and transaction histories
• Provide in-application reporting and decision-support functionality
• Respond to customer support requests
• Communicate with customers regarding their accounts or Services (including transactional email)
• Diagnose technical problems
• Maintain application security
• Detect unauthorized activity, fraud, misuse, or security incidents
• Improve application reliability and functionality
• Maintain records required for legitimate business, contractual, accounting, audit, or legal purposes
• Comply with applicable laws, regulations, court orders, or lawful governmental requests
• Enforce agreements and protect our legal rights

We do not use customer agricultural or operational data for purposes unrelated to providing or supporting the Services except where authorized by the customer or permitted or required by law.

Based on the current application configuration reviewed for this policy, we do not send Customer Data to third-party generative AI services, and we do not use Customer Data to train third-party artificial intelligence models. Local optical character recognition may be used within the Services to process certain uploaded documents for operational features.

3. Customer Data and Data Ownership

Organizations using the Services may submit information regarding their operations, customers, growers, farms, fields, inventory, transactions, shipments, storage activities, and other business operations ("Customer Data").

As between the Company and the customer, Customer Data remains the customer's data, subject to the applicable agreement between the customer and the Company.

We process Customer Data to provide and support the Services and for other purposes permitted by our agreements with customers and applicable law.

Users should only submit information to the Services that they are authorized to provide.

4. How Information May Be Shared

We do not disclose Customer Data to third parties except as necessary to operate and support the Services, as authorized by the customer, or as otherwise permitted or required by law.

Service Providers

We use third-party providers to support the Services. Categories currently used by this application include:

• Cloud application hosting (Vercel)
• Database hosting and authentication infrastructure (Supabase / PostgreSQL)
• Transactional email delivery (Resend)
• File and document storage supporting uploads and generated records, depending on configuration

These providers may process information only as necessary to perform services on our behalf and subject to applicable contractual or legal requirements.

Customer-Authorized Users

Information associated with an organization may be accessible to users that the organization has authorized, depending on their assigned permissions and roles. For example, administrators, warehouse personnel, growers, customers, or other authorized parties may have different levels of access to information.

Legal and Safety Requirements

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with applicable law
• Respond to a subpoena, court order, or lawful government request
• Protect the rights, property, or safety of the Company, our customers, users, or others
• Investigate fraud, security incidents, or misuse of the Services
• Enforce agreements

Business Transactions

If the Company is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

5. Sale or Sharing of Personal Information

We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising.

The Services do not currently integrate third-party advertising networks or marketing analytics pixels.

6. Cookies and Similar Technologies

The Services use cookies and similar browser technologies that are necessary to operate core functionality, including authentication session cookies managed through our authentication provider (Supabase).

These technologies may be used to:

• Keep users authenticated
• Maintain application sessions
• Maintain security
• Prevent unauthorized access
• Provide core application functionality

The Services may also use browser local storage and session storage to remember certain in-application preferences or temporary UI state (for example, display preferences or short- lived search filters). We do not use advertising cookies in the current application configuration reviewed for this policy.

7. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information maintained through the Services. These safeguards may include, where applicable:

• Authentication and authorization controls
• Role-based access controls
• Encryption of information in transit
• Secure infrastructure and database controls
• Logging and monitoring
• Access restrictions

No electronic storage or transmission system can be guaranteed to be completely secure. Users are responsible for protecting their account credentials and should notify us promptly if they believe an account has been compromised.

8. Data Retention

We retain information for as long as reasonably necessary to:

• Provide the Services
• Maintain agricultural and business records
• Fulfill contractual obligations
• Maintain transaction and inventory history
• Resolve disputes
• Enforce agreements
• Meet accounting, audit, regulatory, or legal obligations
• Maintain security and prevent fraud

Retention periods may vary depending on the type of information and the customer's configuration or contractual requirements.

When information is no longer reasonably necessary, we may delete, anonymize, aggregate, or securely dispose of it, subject to applicable legal and contractual requirements.

9. Customer-Directed Data

In many cases, the Company processes personal information on behalf of business customers.

If your information was submitted to the Services by a farm, warehouse, processor, cooperative, grower, employer, or another organization, that organization may control the information and determine how it is used.

Requests concerning that information may need to be submitted directly to the organization responsible for the account. Where appropriate, we will assist customers in responding to valid privacy requests.

10. Privacy Rights

Depending on where an individual resides and subject to applicable law, the individual may have rights regarding personal information, including the right to:

• Request information about personal information collected
• Request access to personal information
• Request correction of inaccurate personal information
• Request deletion of certain personal information
• Request information regarding disclosures of personal information
• Opt out of certain sales or sharing of personal information, where applicable
• Limit certain uses of sensitive personal information, where applicable
• Obtain a portable copy of certain information, where applicable
• Appeal certain privacy decisions, where applicable
• Exercise applicable privacy rights without unlawful discrimination

These rights are not absolute and may be subject to exceptions under applicable law. Where we process information solely on behalf of one of our business customers, requests may be referred to that customer.

Account access within the Services is managed through authenticated user accounts and administrative controls (including account disablement). Self-service account deletion and automated privacy-data export tools are not currently provided as standalone end-user features; privacy requests may be handled through the contact channels below and/or the customer organization that administers the account.

11. California Privacy Rights

California residents may have additional rights under applicable California privacy laws.

Subject to applicable law and exemptions, these may include the rights to know the categories and specific pieces of personal information collected; know the categories of sources from which personal information is collected; know the business or commercial purposes for collecting personal information; know the categories of third parties to whom information is disclosed; request deletion; request correction; opt out of the sale or sharing of personal information; limit certain uses or disclosures of sensitive personal information; and receive equal service and pricing when exercising applicable privacy rights.

As described above, we do not sell personal information for monetary consideration and do not share personal information for cross-context behavioral advertising. Accordingly, we do not currently provide a separate "Do Not Sell or Share My Personal Information" link.

12. Children

The Services are designed for businesses and professional agricultural operations and are not directed to children.

We do not knowingly collect personal information directly from children under 13 through the Services. If we learn that personal information from a child was collected inappropriately, we will take reasonable steps to delete it as required by applicable law.

13. Third-Party Services and Links

The Services may contain links to or integrations with third-party websites, software, or services. This Privacy Policy does not govern the independent privacy practices of third parties. Users should review the privacy policies of third-party services they choose to access.

14. International Users

The Services are primarily intended for customers and users in the United States. If information is accessed or processed outside the jurisdiction in which it was originally collected, applicable safeguards will be used as required by law.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our Services, practices, technologies, or legal requirements. When changes are made, we will update the "Last Updated" date displayed at the top of this page. Material changes may be communicated through the Services or by other appropriate means when required.

16. Contact Us

If you have questions about this Privacy Policy or wish to submit a privacy-related request, contact:

Guinnalytics LLC

Email: darby@guinnalytics.com

Website: guinnalytics.com