Privacy Policy

FloraMind (“we”, “us”, “our”) develops and operates the FloraMind mobile application for iOS and Android. The Application enables users to track houseplants, manage care schedules, review care history, submit photographs for AI-assisted plant identification and health diagnosis, and record wild plants they encounter as “discoveries”.

This Privacy Policy applies to all users of the Application regardless of geographic location and constitutes a legally binding statement of our data-handling practices. By downloading, installing, or using the Application, you acknowledge that you have read and understood this Policy. Where your use of the Application is subject to a separate end-user licence agreement, this Policy is incorporated into and forms part of that agreement.

If you do not accept the terms of this Policy, you must discontinue use of the Application and, if you hold a registered account, exercise your right to deletion as described in Section 12 (Your Rights).

FloraMind does not sell personal information and does not disclose it to third parties for their own marketing or advertising purposes.

For the purposes of applicable data-protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR, the data controller responsible for personal information processed through the Application is:

All privacy enquiries, data-subject requests, and security disclosures should be directed to the contact address above. We will acknowledge receipt within 5 business days.

Location is optional. If you grant the Application location permission, it sends your latitude and longitude with plant identification and discovery requests. If you decline, or later revoke the permission in your device settings, those features continue to work without it.

Two separate things happen with those coordinates:

• They are sent to Open-Meteo (api.open-meteo.com), a third-party weather service, to look up local temperature, humidity and precipitation so that care advice matches your actual conditions. Your exact coordinates leave our systems when this lookup happens. Open-Meteo is a separate recipient of that data and handles it under its own terms.
• For discoveries only, they are stored. The exact latitude, longitude and an optional place name are written to our database as part of the discovery record and kept indefinitely, until you delete the discovery or your account.

We process location on the basis of your consent (GDPR Art. 6(1)(a)), given through your device's location permission prompt. You may withdraw that consent at any time by revoking the permission in your device settings. Withdrawal does not affect processing carried out before you withdrew, and existing discovery records keep their stored coordinates until you delete them.

Where the GDPR or equivalent legislation applies, we rely on the following legal bases for processing personal data:

Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment and determined that those interests are not overridden by your interests or fundamental rights. You may request a copy of that assessment by contacting us at cucereanumdev@gmail.com.

Photographs and related context sent for AI processing are handled by Google Gemini (Google LLC), which may process data on servers located in the United States or other jurisdictions outside the European Economic Area (“EEA”) or the United Kingdom. Where you consented to location processing, your coordinates are sent to Open-Meteo; in-app feedback containing your email address and name is transmitted through Resend; and our hosting and image storage providers, Railway and Cloudflare, may also process data outside the EEA and the UK.

Where such transfers occur, we rely on the transfer mechanisms offered by each provider, including Standard Contractual Clauses where applicable. In respect of transfers to the United States, Google LLC participates in and is certified under the EU–US Data Privacy Framework and the UK Extension thereto. You may review Google's data-processing terms and transfer mechanisms at policies.google.com/privacy.

Separately, note that photographs stored in our public-read bucket are reachable from anywhere in the world by anyone holding the address, as described in Section 4.

Legal and regulatory disclosure. We may disclose personal data to competent authorities, courts, or other bodies where we are required to do so by applicable law, a court order, or enforceable governmental request. Where legally permitted, we will endeavour to notify you before complying with such a request.

Business transfers. In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, personal data held by us may be transferred to the successor entity. We will publish at least 30 days’ advance notice on this page and in the Application before any such transfer takes effect and before your data becomes subject to a materially different privacy policy. If you do not accept the new policy, you may delete your account before the transfer.

In-app account deletion. You may delete your account at any time via Settings → Account → Delete Account. Removal of your server-side data is immediate and is described in detail in Section 9.

Withdrawing consent for location. Revoke the Application's location permission in your device settings. To remove coordinates already stored with past discoveries, delete those discoveries or your account.

Right to lodge a complaint. If you are located in the EEA or United Kingdom and believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local supervisory authority. In the EU, the relevant authority is the data protection authority of your country of residence or establishment. In the UK, the relevant authority is the Information Commissioner's Office (ICO) at ico.org.uk.

Exercising any of the above rights will not result in you being penalised or disadvantaged in your use of the Application.

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the rights below. The categories of personal information we collect, the purposes for which we use them, and the parties to whom we disclose them are set out in Sections 3 to 6 and Section 11. In CCPA terms, the categories we collect are identifiers (email address, display name, provider user ID, IP address), internet or network activity limited to rate-limiting records, geolocation data where you consented, and visual information (your photographs).

• Right to know the categories and specific pieces of personal information we have collected, their sources, the purposes, and the categories of third parties to whom we disclosed them.
• Right to delete personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to limit the use of sensitive personal information. We use precise geolocation only for the weather lookup and discovery records described in Section 5, and for no other purpose.
• Right to non-discrimination for exercising any of these rights.

We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding twelve months. We do not use or disclose personal information for cross-context behavioural advertising. To exercise a California right, email cucereanumdev@gmail.com; you may use an authorised agent, and we will verify your request against the account details we hold.

The Application is not directed at, and is not intended for use by, children. For the purposes of this Policy:

• In the United States, we do not knowingly collect personal information from children under the age of 13, consistent with the Children's Online Privacy Protection Act (COPPA).
• In the European Economic Area and the United Kingdom, we do not knowingly collect personal information from children below the applicable age of digital consent in their country of residence, which is 16 years in most EU member states unless a lower age (minimum 13) has been set by national law.
• In all other jurisdictions, we apply the higher of the locally applicable minimum age for online consent or 13 years.

How this is enforced. Users confirm that they meet the minimum age when they accept our Terms of Service. We do not carry out any further age verification and do not knowingly collect data from anyone below the applicable age. We act on reports that we receive.

If you are a parent or legal guardian and believe that a child under the applicable age has provided us with personal information without your consent, please contact us at cucereanumdev@gmail.com. Upon verification, we will promptly delete such information from our systems.

We reserve the right to amend this Privacy Policy at any time. The effective date displayed at the top of this page will be updated to reflect the date on which any revision takes effect. The current version of the Policy will always be available within the Application and at this URL.

For amendments that materially affect the way we collect, use, or share your personal data — including any change to the legal basis for processing or to data-sharing arrangements — we will provide at least 14 days’ advance notice through an in-app notification and on this page. We do not send email to users, so please do not expect notice by email; this page is the authoritative record.

Your continued use of the Application after the revised Policy takes effect constitutes acceptance of those changes to the extent permitted by applicable law. Where applicable law requires explicit consent for a particular change, we will seek that consent separately and will not treat continued use alone as sufficient.