Privacy Policy

Who’s responsible for your data

Verdalia is operated by Artyom Balamutyuk, who is the data controller for the information described here; you can reach us at support@verdalia.app. Paid subscriptions are sold by Fundacja Rozwoju Przedsiębiorczości "Twój StartUp" as merchant of record — the foundation issues your invoice and is the controller for the billing and accounting records it is legally required to keep. If your question is about an invoice, we’ll route it to them.

What we collect

Your account email and, optionally, a display name — plus the basic profile Google or Apple confirms to us, if you choose to sign in that way. The plants, locations, photos, notes and care history you add. Subscription and payment records: which plan you’re on, when it renews, and the amount, currency and status of each payment — card numbers never reach us, they go straight to the payment provider. A device push token, if you turn on push notifications in the mobile app. And basic technical data — request logs, error reports and product-analytics events — needed to run, secure and debug the service. That includes your IP address, and the approximate location our analytics and error-monitoring providers derive from it.

How we use it

To provide the app: show your plants, work out care reminders, sync across your devices and keep the service running. To manage your subscription and payments, and to send transactional email such as billing notices and password resets, plus — only if you’ve opted in — the weekly digest and occasional product emails about news and announcements; every product email includes an unsubscribe link and both can be turned off in Settings at any time. To keep the service secure and diagnose faults. And, in aggregate, to see which features get used so we can improve them. We don’t use your plant data or photos for advertising, we don’t sell them, and we don’t use them to train AI models.

Our legal basis

Where the GDPR applies: we process your account, plant and care data to perform our contract with you (Article 6(1)(b)). We keep billing and invoice records to meet legal accounting and tax obligations (Article 6(1)(c)). We use technical logs, error reports and aggregate analytics under our legitimate interest in a secure, working and improving service (Article 6(1)(f)) — you can object to this, see “Your rights and choices” below. Where we ask for your consent, such as push notifications, the weekly digest or product emails, that’s Article 6(1)(a), and you can withdraw it at any time in Settings.

Where it’s stored

Verdalia runs in the EU: the application is hosted in Frankfurt, the database is in the EU (eu-central-1), and product analytics go to an EU-region service. Your photos are kept in S3-compatible object storage; everything else lives in the database. Some providers listed below are companies established outside the EEA, or may store or access limited data outside it — where that happens, the transfer relies on that provider’s data-processing terms and on the European Commission’s standard contractual clauses.

Who else processes your data

We use a small set of service providers (“subprocessors”) to run Verdalia. Each one only processes what its job requires, acts on our instructions, and may not use your data for its own purposes. As of the date at the top of this page, they are:

• Fly.io — application hosting in Frankfurt (EU), including the server that runs our own plant-recognition model.
• Neon — the managed PostgreSQL database holding your account, plants and care history (EU, eu-central-1).
• Tigris — S3-compatible object storage for your plant photos.
• Resend — delivery of our email: transactional messages such as billing notices and password resets, plus the weekly digest and product emails if you’ve opted in.
• Porkbun — our domain registrar, which forwards email you send to our contact address on to the mailbox we read.
• PostHog (EU Cloud) — product analytics. Events are tied to your account identifier rather than your email, and session recording is switched off.
• Better Stack — error monitoring and uptime checks. Our error reporting is configured not to attach personal data.
• Stripe — card payment processing, if you pay by card. Stripe receives your card details directly; we never see them.
• Google and Apple — if you choose to sign in with them, to verify that sign-in.
• Expo, and through it Apple’s and Google’s push services — delivery of push notifications to your device, if you turn them on in the mobile app. A notification can name the plant it is about.

Photos and plant identification

Your plant photos are stored privately and shown to you through short-lived links. Search-by-photo runs on our own server inside our own infrastructure — your photo is not sent to any third-party AI service, and it is not used to train anything. The reference pictures in the species library are a separate, public set of images of species; they are not your photos.

Sharing with other people

We don’t sell your data and we don’t share it with third parties for their own marketing; we disclose data to authorities only where the law requires it. Inside the app, you control sharing: if you invite someone to help care for a plant, they can see and log care for that plant while the invitation is active, and you can revoke it at any time. If you switch on a public collection link, anyone holding that link can see what it shows until you switch it off.

How long we keep it

We keep your account and its content for as long as your account exists, so your care history stays useful to you. Billing and invoice records are kept for as long as accounting and tax law requires the seller to keep them, even after an account is closed. Technical logs, error reports and analytics events are kept only for the retention window each provider applies, which is far shorter than the life of an account. If you stop using Verdalia for a while we pause the weekly digest rather than keep emailing you.

Your rights and choices

You can edit or delete any plant, photo or note at any time — deleting a plant also deletes its stored photo files; if our storage doesn’t confirm a deletion right away, which is rare, the file is no longer reachable from the app immediately — we automatically keep retrying behind the scenes until the deletion is confirmed. Notification and language preferences are in Settings. Where the GDPR applies you also have the right to access your data, correct it, have it erased, restrict or object to how we use it, and receive a copy in a portable form. You can download a copy of your data or delete your account any time in Settings → Account — deletion is immediate and permanent, and we keep only the billing records the law requires. Prefer email? Write to support@verdalia.app instead and we’ll action it within 30 days. If you think we’ve handled your data badly, you’re entitled to complain to your local data-protection authority.

Changes

We may update this policy as the service grows. Changes are reflected in the “Last updated” date above, and where a change materially affects how we use your data we’ll tell you by email.

Contact

Privacy questions, or want your data exported or deleted? Reach us at support@verdalia.app.