Privacy Policy

FloraCure — Plant Health App

Last updated: April 12, 2025

1. Who We Are (Data Controller)

FloraCure is a mobile application for plant health diagnosis. The data controller responsible for your personal data is:

Mohsen Maaleki
Verona, Italy
Email: support@floracure.app

"We", "us", or "our" in this policy refers to the data controller above.

2. Data We Collect

Account Data

When you create an account, we collect your email address and optionally your display name. This is processed by our authentication provider, Clerk.

Plant Scan Images

When you scan a plant, the image you capture or select from your photo library is sent to Google Gemini (an AI service by Google LLC) for analysis. Images are processed transiently and are not stored by Google for training purposes under our agreement. We store the diagnosis result (text) linked to your account, not the raw image permanently.

Device Identifiers

We assign an anonymous device identifier to track scan usage for free-tier limits. This identifier is not linked to your name or email unless you create an account.

Location Data

If you use the weather and care forecast feature, we request your device location (GPS coordinates). These coordinates are sent to the Open-Meteo weather API to retrieve local weather data. We do not store your precise location permanently — only the weather result is cached.

Push Notification Token

If you opt in to push notifications during onboarding, we store your device's push notification token to send you plant care reminders. This is optional and can be revoked at any time in Settings.

Purchase & Subscription Data

If you subscribe to FloraCure Premium, purchase transactions are processed by the app store (Google Play or Apple App Store) and by RevenueCat Inc., our subscription management provider. We receive confirmation of your subscription status but do not process your payment card details.

Crash Reports & Diagnostics

We use Sentry for crash reporting. This is opt-in only — you must explicitly enable crash reporting in Settings. If enabled, Sentry collects anonymized diagnostic data (device model, OS version, app version, error stack traces). No personal data or plant images are included in crash reports. You can withdraw consent at any time in Settings → Crash Reports.

Referral Data

If you use a referral code or share one, we record the referral relationship (which user referred whom) to credit bonus scans. No additional personal data is collected for this purpose.

3. Legal Basis for Processing (GDPR Art. 6)

DataLegal Basis
Account data (email, name)Performance of contract (Art. 6(1)(b))
Plant scan images & AI analysisPerformance of contract (Art. 6(1)(b))
Device identifier for scan limitsLegitimate interest (Art. 6(1)(f)) — to prevent abuse of the free tier
Location for weatherConsent (Art. 6(1)(a)) — requested in-app before access
Push notification tokenConsent (Art. 6(1)(a)) — opt-in during onboarding
Subscription statusPerformance of contract (Art. 6(1)(b))
Crash reportsConsent (Art. 6(1)(a)) — explicit opt-in in Settings
Referral relationshipsLegitimate interest (Art. 6(1)(f)) — to credit referral rewards
Deletion audit logsLegal obligation (Art. 6(1)(c))

4. How We Use Your Data

We do not sell your data. We do not use your plant images to train AI models. We do not use your data for advertising.

5. Third-Party Data Processors

We use the following third-party services to operate FloraCure. Each is bound by a Data Processing Agreement (DPA):

ServicePurposeCountry
Clerk Inc.User authentication & account managementUSA
Convex Inc.Database & backend infrastructureUSA
Google LLC (Gemini)AI-powered plant image analysisUSA
RevenueCat Inc.Subscription & purchase managementUSA
Sentry (Functional Software)Crash reporting (opt-in only)USA
Open-MeteoWeather data (location coordinates only)Switzerland / EU
Expo (650 Industries)Push notification deliveryUSA
Brevo (Sendinblue SA)Transactional email (account deletion notices)France / EU

AI provider note: We currently use Google Gemini for plant image analysis. If we change AI providers in the future, this policy will be updated with a new "Last Updated" date.

6. International Data Transfers

Several of our service providers are located in the United States. Transfers of personal data to the USA are made on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of protection for your data.

Open-Meteo is based in Switzerland (and operates EU infrastructure), which the European Commission has recognized as providing adequate data protection.

Brevo (Sendinblue SA) is headquartered in Paris, France and operates within the EU, with no transfer issues.

7. Data Retention

Data TypeRetention Period
Account & scan dataUntil account deletion is completed
Soft-deleted accounts30-day grace period, then permanently deleted
Immediately deleted accountsDeleted within minutes of hard-delete request
Device identifiers (anonymous)Maximum 1 year of inactivity, then purged
Deletion audit logs90 days from deletion date
Crash reports (if consented)Governed by Sentry's retention policy (90 days)

8. Your Rights Under GDPR

As a resident of the EU/EEA, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at support@floracure.app. We will respond within 30 days.

9. Children's Privacy

FloraCure is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us at support@floracure.app and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For material changes that affect how we process your personal data, we will notify you via the app or by email.

We encourage you to review this policy periodically.

11. Supervisory Authority

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Italian data protection authority:

Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma, Italy
Website: www.garanteprivacy.it

12. Contact Us

For any questions, data requests, or concerns about this Privacy Policy, please contact:

Mohsen Maaleki
Verona, Italy
support@floracure.app