Privacy policy

01What this document covers

This policy applies to agradex.com (the marketing site), app.agradex.com (the app) and the installable web app (PWA). They all run on the same server against the same database.

One thing up front, for honesty: Agradex is still in development, and no registered legal entity (company name, registration number, registered address) has been declared behind the product. This document therefore names no formal data controller. Every request about your data reaches the team running the platform at [email protected].

The document covers our system only. Links that take you off Agradex — for example to the official pages of the satellite data sources — have privacy rules of their own.

02Account data

This is what we store when you sign up and when you change your settings:

• Email address — it is your login identifier and is unique.
• Password — only as a bcrypt hash. We neither store nor can recover the plain password.
• Full name (optional), interface language, country and region.
• Role: farmer, laboratory, consulting agronomist or supplier.
• Area-unit preference (hectare / dönüm / sotka) — derived from your country if you have not chosen one.
• Notification preferences (which channels you switched off) and the email-digest opt-out flag.
• For every device on which you turn push notifications on, the subscription the browser hands us (delivery endpoint, encryption keys, browser string) — the row is deleted when you unsubscribe.
• Name-visibility preference — whether your name is shown to other users.
• The answers to the short quiz on the marketing page (crop, country, region, main problem, needs), if you filled it in before signing up.
• Email verification state and a temporary 6-digit code — the code is deleted the moment it is used.
• Last-seen time — written at most once an hour, only to know whether the account is still in use.

There is a phone-number column in the database, but the signup form never asks for it — so in practice no phone number is collected. No card or payment data is collected at all (see "Packages and payment" in the Terms of use).

03Field and farm data

The substance of the platform is the farm data you enter:

• The field boundary drawn on the map and its area (always stored in hectares — the unit setting only affects display).
• Field, farm and organisation names.
• The field passport: crop, variety, planting and harvest dates, soil type and pH, irrigation method, growth stage, previous crop, free-text notes.
• Scouting observations, photos you upload, field operations, yield records, tasks and seasons.
• Ledger, sales, inventory and equipment rows, and documents you upload.
• Soil laboratory analyses — the scan you upload and the values read out of it by OCR.

On top of that, the system computes and stores:

• Per-scene statistics for 9 indices (NDVI, NDMI and the rest) and raster files clipped to your field.
• Weather history, the field wellness score, growing degree days (GDD).
• The AI advice text, the inputs it was generated from, which model wrote it and in which language.
• AI chat messages, notifications, share-link tokens.
• Token and cost accounting for AI usage.
• Seven specific product events (quiz started, field created, crop set, first scene seen, advice viewed, Telegram connected, checklist completed) — that list is fixed in the code; nothing else you do is tracked.

04Where the data lives

Everything is stored on a single Hetzner server in Helsinki, Finland (European Union). The database is our own Postgres 16 + PostGIS installation running in Docker on that machine. Files you upload sit on that server's local disk, and the satellite rasters in a separate folder on the same disk.

We use no managed third-party database (such as Supabase) and no third-party object storage (S3 and the like) — that is a deliberate architectural decision.

Backups are kept on a server operated by the same team, inside the European Union. No formal retention period is configured for backups.

05Who the data is sent to

These are the external services the platform uses. The list is complete — we do not pass your data to advertising networks, data brokers or marketing platforms, and we do not sell it.

06Artificial intelligence

Advice, chat and photo diagnosis run on Anthropic's Claude models. The context sent to the model is about the field, not about your identity — the code that assembles it reads no column from the accounts table.

The token count and estimated cost of every AI call is recorded in our own database, for quota accounting and cost control.

If the AI key is removed from the configuration the system degrades gracefully: no advice is generated, chat stops answering, and everything else keeps working.

AI answers are automated analysis and can be wrong. Their limits are set out separately in the Terms of use.

07Email

The only recurring message is the weekly digest — sent every Wednesday at 07:00 Baku time, and technically incapable of being sent more than once a week.

Apart from that there are only transactional messages: the verification code, the welcome mail and the report that arrives when your field is ready for the first time. Each of those is sent at most once per 24 hours.

Every digest carries a one-click unsubscribe link at the bottom — no login required. You can switch the same setting off on the account page. Note: even after unsubscribing, transactional messages (such as the verification code) keep arriving, because the account does not work without them.

We send no advertising mail and share your address with no one. For honesty: the digest currently reaches Turkish, German, Hungarian, Italian and Polish readers in English — the translation is not finished yet.

08Cookies and browser storage

There are two cookies, both functional:

• bagban_session — the login session. httpOnly (JavaScript cannot read it), SameSite=Lax, Secure over https, 7 days. It is used for nothing else.
• bagban_locale — remembers the language you chose, 1 year.

That is all. There is no Google Analytics, Google Tag Manager, Plausible, Hotjar, Mixpanel, PostHog, Facebook pixel or any other tracker anywhere in the code. That is precisely why the site shows you no cookie consent banner — there is nothing to ask about.

Separately, your browser's local storage holds a few interface preferences: the basemap, data-saver mode, the offline queue, the state of the getting-started checklist, and the answers to the quiz you filled in before signing up. They stay on your device; the quiz answers travel to the server only together with the signup request.

09Who can see your data

• Other members of your organisation — they see its fields according to their role; the permission is checked on the server on every request.
• A share link (/s/…) shows a deliberately minimal, read-only field card to anyone holding it. You can revoke the link at any time.
• If you switch name visibility off, your name is replaced by a "user_…" alias on every surface other users see.
• Comparison and benchmark figures are not computed without a cohort of at least 5 other fields, and they never name a specific field or farm.
• The team running the platform — through an admin panel that sees usage, AI cost and accounts across all organisations, and, as the server's operators, with technical access to the database.

10Retention and deletion

Deleting a field is a soft delete: it disappears from the list and can be restored; it is not physically removed from the database.

Closing your account (the button on the account page) is irreversible and does exactly this:

• You have to type your own email address to confirm.
• If an organisation you own still has other active members, the request is refused — hand the organisation over first.
• All memberships are deleted, so access ends immediately.
• Fields of organisations where you were the only member are soft-deleted.
• The email address is rewritten to a non-routable internal address — which frees your real address, so you can register with it again.
• Name, country, region, quiz answers and notification preferences are cleared; the password hash is replaced with a value no password can produce; the account is deactivated.

What survives: the records you wrote — fields, boundaries, observations, ledger rows, yields. The reason is technical and we are not hiding it: fifteen tables reference the user, and a cascading delete would destroy a whole farm's history because one worker left. Those records stay, but they no longer point to an identifiable person. The usage ledger, the email send log and the event rows keep a user identifier that no longer resolves to anyone.

There is no automatic expiry for satellite or derived data.

11Your rights and what you can do today

All of this is on the account page, immediately, by yourself:

• Change your password.
• Edit your name, country and region.
• Change the interface language and the area unit.
• Adjust the notification matrix (category × channel).
• Switch off name visibility.
• Opt out of the email digest.
• Close the account.

Field boundaries can be downloaded as GeoJSON or KML from the field creation screen.

There is no automated full-account export yet — we are not hiding that. If you want a copy of your data or its complete deletion, write to [email protected] and we will prepare it by hand.

12Changes

This document describes the system, so it has to change when the system does. The date of the last update is shown at the top of the page.

Any material change to what is collected or where it is sent will be announced in advance, through an in-app notification or the weekly digest.