Privacy Policy

1. Information We Collect

When you create an account, we collect your email address and authentication credentials managed by Clerk. When you use GrowPilot, we collect the plant images you upload and environmental data you provide (soil type, temperature, etc.). If you enable location services, we may collect your approximate GPS coordinates to improve diagnosis accuracy.

2. How We Use Your Information

We use your data to provide the GrowPilot service: plant identification, health diagnosis, and personalized recommendations. We store your scan history so you can revisit past diagnoses. We use your email for account-related communications including subscription confirmations and payment notifications.

3. Third-Party Services

GrowPilot relies on a small set of third-party service providers to operate the platform. We share personal data, on a need-to-know basis, with the following categories of recipients (each acting as a processor on our behalf, or in some cases as an independent controller for their own service):

• Authentication and identity verification providers (US-based)
• Cloud database hosting providers (US-based)
• AI plant identification providers (EU-based)
• AI language model providers for diagnostic refinement (US-based) paid tiers only
• Payment processing providers (US-based, PCI-DSS Level 1)
• Application hosting and image-storage providers (US-based)
• Rate-limiting and abuse-prevention infrastructure providers (US-based)
• Transactional email delivery providers (US-based)

Each provider processes personal data according to its own privacy policy under a data processing agreement we have in place. A current list of the specific subprocessors behind each category is available on request from privacy@aigrowpilot.com; we respond within 30 days, in line with your access right under GDPR Article 15 and the equivalent right under the CCPA / CPRA.

4. Data Retention

Your account data and scan history are retained as long as your account is active. You may delete your account and all associated data at any time from the Settings page.

Abuse-prevention retention. To prevent abuse of our free tier (creating multiple accounts to claim repeated free scans), we retain a one-way hashed version of your email address and signup device fingerprint indefinitely, even after account deletion. These hashes cannot be reversed to identify you or recover your email , they only allow us to detect repeat signups from the same identity. If you require complete erasure including this anti-abuse data for GDPR purposes, contact us at support@aigrowpilot.com and we will process a hard-deletion request within 30 days.

5. Your Rights

You have the right to access, correct, or delete your personal data. You can delete your entire account and all associated data (excluding the abuse-prevention hashes described above) from the Settings page, which also offers a JSON or CSV export of everything we hold about you. For data access or hard-erasure requests, contact us at support@aigrowpilot.com.

5a. Cookies and analytics

We use strictly-necessary cookies to keep you signed in (managed by Clerk) and to remember your cookie consent choice. We do not load analytics, performance-monitoring, or advertising cookies until you grant consent via the banner shown on your first visit. You can change your preference at any time by clearing your browser's site data for www.aigrowpilot.com, the banner will reappear and you can choose again.

The non-essential technologies we use are: Vercel Analytics and Speed Insights for aggregate usage and performance measurement (no user identification); Google Analytics 4 for the same purpose; and the Meta (Facebook) Pixel, which measures the effectiveness of our Meta Ads campaigns by tracking which of our pages you visit after clicking an ad. The Meta Pixel sets a _fbp first-party cookie and shares your IP address, user agent, and page URL with Meta.

How we ask for permission depends on where you are. If you are in the European Economic Area, the United Kingdom, Switzerland, Brazil, Canada, or any location we cannot confidently identify, we load nothingnon-essential until you actively choose “Accept all” — this is the prior-opt-in standard required by the GDPR, UK PECR, LGPD, and Quebec's Law 25. Everywhere else, including the United States, these technologies load by default and we give you a clear, always-available way to turn them off.

Turning tracking off. Select Your Privacy Choicesin the site footer at any time to re-open the preferences panel and opt out. For California residents, that control is our mechanism for opting out of the “sale” or “sharing” of personal information under the CCPA/CPRA — sharing identifiers with Meta for advertising measurement falls within that definition even though no money changes hands. We also honor the Global Privacy Control (GPC) signal: if your browser or extension sends it, we treat that as an opt-out automatically and load nothing non-essential, regardless of where you are. When you opt out, the scripts are not loaded at all — no data is transmitted, rather than transmitted and then discarded.

6. Security

All data is transmitted over HTTPS. API keys and credentials are stored as environment variables and never exposed to clients. Database connections use SSL. Payment information is handled entirely by Stripe and never touches our servers.

7. Contact

For privacy questions, contact us at support@aigrowpilot.com, or write to us at: