Privacy Policy

• Account & profile data — name, email, role, organization, phone number, and notification preferences you provide.
• Operational data you enter — fields, products, application logs, tasks, harvest lots, audits, certifications, and related records.
• Location data — optional GPS coordinates attached to an application log when you choose to geotag it.
• Authentication data — credentials and session tokens managed by our auth provider.
• Technical data — limited logs needed to operate, secure, and debug the Service.

We process data to provide the Service, authenticate users, send task and compliance notifications you opt into, generate compliance reports, secure the platform, and meet legal obligations. For GDPR, our legal bases are performance of a contract, legitimate interests (security and service operation), consent (where required, e.g. SMS/email notifications), and legal obligation.

We retain Customer Data for the duration of your subscription and for a limited period afterward to allow export and to meet legal and audit obligations, after which it is deleted or anonymized.

We do not sell personal information. We share data only with the sub-processors needed to run the Service:

• Supabase — authentication and storage.
• Replit — application hosting and database.
• Twilio — SMS notifications.
• SendGrid — transactional email.
• Cloudflare — CDN and bot/CAPTCHA protection.

We may also disclose data where required by law. The authoritative sub-processor list is maintained in our Data Processing Agreement.

Depending on your jurisdiction, you have the right to access, correct, delete, restrict, or object to processing of your personal data, and the right to data portability. We honor these rights for all users regardless of location where practicable.

• Access & portability— managers and admins can export the tenant’s complete records at any time from Settings → Data & Privacy → Export All Data, which produces a downloadable ZIP of CSV and JSON files.
• Correction — most records can be edited directly in the app.
• Deletion — see the deletion-request process below.

To request deletion of your account and associated data, use the Request Account Deletion action in Settings → Data & Privacy, or email support@acreplus.com with the subject “Data Deletion Request”. We will confirm receipt within 2 business days and complete deletion within 30 days, subject to legal retention obligations.

We enforce tenant isolation at the database level using PostgreSQL row-level security, role-based access controls in the application, encrypted transport, and least-privilege database roles. No system is perfectly secure, but we work to protect your data and to notify you of incidents as required by law.

Data may be processed in jurisdictions other than your own through our sub-processors.

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email, and the “last updated” date above will change.