Privacy Policy

1. Data controller

The controller of your personal data is David Santos, tax number 209463171, a sole trader established in Portugal, operating the service under the PlantDiary brand (website, web app and Android mobile app). You can contact us at any time at contact@plantdiary.app, including on data protection matters.

2. Data we collect

We only collect the data needed to provide the service. Depending on how you use it, we may process:

• Account data: name, email address, phone (optional), password (stored only as a hash) and preferred language.
• Social sign-in data: if you sign in with Google or Apple, we receive your identifier, name and email from those providers. We never receive or access your password for those services.
• Your plant data: names, species, rooms and houses, watering schedules, treatment records, notes, badges, milestones and care history.
• Photos: images of your plants that you voluntarily upload from your device's camera or gallery.
• Location: if you allow it, the coordinates (latitude/longitude) of the home where your plants are, used for weather forecasts and frost warnings. You can enter them manually instead of using GPS, and change or remove them at any time in settings. Collection is always optional.
• Payment data: handled directly by Stripe. We neither receive nor store card numbers; we only keep the Stripe customer identifier, the plan, the subscription status and billing details.
• Notification data: your device's push notification token and alert preferences, so we can send you reminders.
• Usage and technical data: access dates, features used (aggregated per account), app version, and technical logs needed for security and error diagnosis.
• Artificial intelligence requests: the photo and description you send to the plant identifier or Plant Doctor, along with the generated response — see section 4.

3. Purposes and legal basis

Where processing is based on your consent (location, push notifications on your device), you can withdraw it at any time — in the app settings or your operating system — without affecting the lawfulness of processing carried out beforehand.

4. Artificial intelligence features

Plant identification by photo and Plant Doctor run through the Anthropic API (Claude models). When you use these features:

• The photo you choose and the text you write are sent to Anthropic for processing, on PlantDiary's behalf and solely to generate the response shown to you.
• Under Anthropic's commercial terms applicable to the API, the content sent is not used to train their models.
• We keep a log of these requests — including the text sent, the generated response and, where applicable, the photo — for quota control, abuse detection and troubleshooting. These logs are accessible only to authorised personnel and are deleted automatically after the retention period set out in section 7.
• Responses are generated automatically and may contain errors. They do not constitute professional advice and produce no legal effects on you; the decision about what to do with your plants is always yours.

Please avoid including personal data in photos or descriptions where it isn't needed (for example, other people's faces, documents or visible addresses).

5. Processors and sharing with third parties

We do not sell your data, nor do we share it for advertising purposes. We rely on the following providers, which process data on our behalf and on our instructions:

We may also disclose data to public authorities where legally required, or to lawyers and accountants in the context of defending legal rights and meeting legal obligations.

6. International transfers

Your data is hosted in the European Union. Some of the providers listed above (Anthropic, Stripe, Google and Apple) may process data in the United States. Those transfers are carried out under the Standard Contractual Clauses approved by the European Commission and/or certification under the EU-US Data Privacy Framework, together with appropriate supplementary measures. You can ask us for more information about these safeguards using the contact in section 1.

7. Data retention

• Account and content (plants, photos, records): kept for as long as the account is active.
• After account deletion: data becomes inaccessible immediately and is permanently erased from our systems within 90 days. This period exists so the account can be recovered in case of accidental deletion. You can ask us for immediate erasure at any time.
• AI feature logs (text, response and associated photo): deleted automatically at the end of the configured retention period, which does not exceed 12 months.
• Logs of notifications sent: kept for as long as the account exists, to avoid repeat sends.
• Invoicing documents: kept for 10 years, as required by Portuguese tax law.
• Backups: may retain data for a limited additional period, after which they are overwritten.

8. Sharing care with other people

The service lets you generate a sharing link so another person (for example, whoever looks after your plants while you're away) can see the watering tasks and the associated plants. That link gives whoever holds it access to the shared plants' data, has a limited validity and can be revoked by you at any time in your account settings. You control who you share it with.

9. Your rights (GDPR)

You have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your account and all associated data
• Portability — receive your data in a structured, machine-readable format
• Objection and restriction — object to processing based on legitimate interests, or restrict it
• Withdrawal of consent — at any time, regarding location and notifications

We respond to any of these requests within one month at most. To exercise them, contact us at contact@plantdiary.app or use the account deletion page. If you believe your rights have not been respected, you have the right to lodge a complaint with the Portuguese data protection authority, CNPD, or with the supervisory authority in your country of residence.

10. Mobile app permissions

The Android app requests the following permissions, all optional and refusable (the app keeps working, just without the corresponding feature):

• Camera and photos — to photograph your plants
• Notifications — to receive watering reminders and frost warnings
• Location — solely to obtain the weather forecast for your home
• Biometrics — if you enable fingerprint unlock, validation is performed by your device's operating system. We never receive or store biometric data.

11. Cookies

We use technical cookies essential to running the service and, on the plantdiary.app site and only with your consent, Google Analytics analytics cookies. We do not use advertising cookies. See the Cookie Policy for details.

12. Children

The service is not intended for children under 16. We do not knowingly collect data from children of that age without the authorisation of whoever holds parental responsibility. If we become aware that this has happened, we will delete the data in question. If you are responsible for a child and believe they have provided us with data, please contact us.

13. Security

We apply technical and organisational measures appropriate to the risk, including encrypted communications (HTTPS/TLS), passwords stored as hashes, authentication via time-limited tokens, logical separation of each account's data, and access restricted to authorised personnel. No system is completely impenetrable, but we undertake to notify you and the supervisory authority, as legally required, should a data breach occur that poses a high risk to your rights.

14. Changes to this policy

We may update this policy whenever necessary. The date of the last update appears at the top of the page and, in the event of significant changes, we will inform you by email or through a notice in the app before they take effect.

15. Contact

For any question about this policy or about the processing of your personal data, contact us at: contact@plantdiary.app