Privacy Policy

1. Information We Collect

When you create an account, we collect your email address and authentication credentials managed by Clerk. When you use GrowPilot, we collect the plant images you upload and environmental data you provide (soil type, temperature, etc.). If you enable location services, we may collect your approximate GPS coordinates to improve diagnosis accuracy.

2. How We Use Your Information

We use your data to provide the GrowPilot service: plant identification, health diagnosis, and personalized recommendations. We store your scan history so you can revisit past diagnoses. We use your email for account-related communications including subscription confirmations and payment notifications.

3. Third-Party Services

GrowPilot relies on a small set of third-party service providers to operate the platform. We share personal data, on a need-to-know basis, with the following categories of recipients (each acting as a processor on our behalf, or in some cases as an independent controller for their own service):

• Authentication and identity verification providers (US-based)
• Cloud database hosting providers (US-based)
• AI plant identification providers (EU-based)
• AI language model providers for diagnostic refinement (US-based) paid tiers only
• Payment processing providers (US-based, PCI-DSS Level 1)
• Application hosting and image-storage providers (US-based)
• Rate-limiting and abuse-prevention infrastructure providers (US-based)
• Transactional email delivery providers (US-based)

Each provider processes personal data according to its own privacy policy under a data processing agreement we have in place. A current list of the specific subprocessors behind each category is available on request from privacy@aigrowpilot.com; we respond within 30 days, in line with your access right under GDPR Article 15 and the equivalent right under the CCPA / CPRA.

4. Data Retention

Your account data and scan history are retained as long as your account is active. You may delete your account and all associated data at any time from the Settings page.

Abuse-prevention retention. To prevent abuse of our free tier (creating multiple accounts to claim repeated free scans), we retain a one-way hashed version of your email address and signup device fingerprint indefinitely, even after account deletion. These hashes cannot be reversed to identify you or recover your email , they only allow us to detect repeat signups from the same identity. If you require complete erasure including this anti-abuse data for GDPR purposes, contact us at support@aigrowpilot.com and we will process a hard-deletion request within 30 days.

5. Your Rights

You have the right to access, correct, or delete your personal data. You can delete your entire account and all associated data (excluding the abuse-prevention hashes described above) from the Settings page, which also offers a JSON or CSV export of everything we hold about you. For data access or hard-erasure requests, contact us at support@aigrowpilot.com.

5a. Cookies and analytics

We use strictly-necessary cookies to keep you signed in (managed by Clerk) and to remember your cookie consent choice. We do not load analytics or performance-monitoring cookies until you grant consent via the banner shown on your first visit. You can change your preference at any time by clearing your browser's site data for aigrowpilot.com, the banner will reappear and you can choose again.

6. Security

All data is transmitted over HTTPS. API keys and credentials are stored as environment variables and never exposed to clients. Database connections use SSL. Payment information is handled entirely by Stripe and never touches our servers.

7. Contact

For privacy questions, contact us at support@aigrowpilot.com, or write to us at: