This Privacy Policy explains how AGROINSIGHTS TECHNOLOGIES LTD, operating under the trade name “AgroPulse AI” (“we”, “us”, “our”, or the “Company”), collects, uses, stores, shares, and protects your personal data when you access or use our agricultural management platform available at pulseagroai.com (the “Service”).
AGROINSIGHTS TECHNOLOGIES LTD is the data controller for all personal data processed through the Service within the meaning of the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the Brazilian Lei Geral de Proteção de Dados (LGPD), and all other applicable data protection legislation worldwide.
If you have any questions about this Privacy Policy or our data practices, you may contact our Data Protection Officer at [email protected].
2. Definitions
For the purposes of this Privacy Policy, the following terms have the meanings set out below:
“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
“Data Subject” means the identified or identifiable natural person to whom the Personal Data relates. In the context of this Service, Data Subjects include account holders, farm managers, employees whose records are stored in the platform, and any other individuals whose data is processed through the Service.
“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. AGROINSIGHTS TECHNOLOGIES LTD is the Controller for data processed through the Service.
“Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller. Our third-party service providers (listed in Section 7) act as Processors on our behalf.
3. Data We Collect
We collect and process several categories of data to provide the Service. Below is a comprehensive description of each category:
3.1 Account Data
When you create an account, we collect:
Full name
Email address
Phone number (optional)
Password (stored as a cryptographic hash using bcrypt with salt rounds; we never store plaintext passwords)
User role and organisational membership
Subscription tier (free, starter, pro, or enterprise)
Profile preferences (language, locale, theme)
3.2 Farm & Agricultural Data
To deliver core agricultural management functionality, we collect:
Farm names, addresses, and descriptions
GPS coordinates and geographical locations of farms
Field boundaries stored as PostGIS polygon geometries
Satellite imagery and NDVI (Normalised Difference Vegetation Index) data for field health monitoring
3.3 Employee & HR Data
If you use our HR management features, we process:
Employee names and contact information
Job titles and departmental roles
Timesheet and attendance records
Leave requests and balances (annual, sick, personal)
Hourly rates and payroll-related data
All employee data classified as personally identifiable information (PII) is encrypted at rest using AES-256 encryption. This includes names, email addresses, phone numbers, and compensation data.
3.4 Financial & Commerce Data
For financial management and marketplace features, we collect:
Production cost records and budgets
Purchase orders, invoicing, and sales revenue data
Products listed in the marketplace (descriptions, pricing, images)
Order details, transaction histories, and shipping addresses
Subscription billing records
Payment processing is handled entirely by Stripe, a PCI-DSS Level 1 certified payment processor. We do not store credit card numbers, CVVs, or full payment card details on our servers. We receive only transaction confirmation data, billing addresses, and the last four digits of the card for display purposes.
3.5 Equipment Data
For equipment management features, we collect:
Equipment names, types, and descriptions
GPS positions and location tracking data
Usage logs and operating hours
Maintenance records, service histories, and scheduled upkeep
3.6 AI Interaction Data
When you use our AI-powered features, we collect:
Chat transcripts and queries submitted to the AI assistant
Meeting summaries and notes generated by AI
AI-generated insights, recommendations, and analyses
Contextual farm data provided to the AI to generate relevant responses
AI interactions are processed by OpenAI. Please refer to Section 7 for details about how data is shared with AI processors.
3.7 Technical & Usage Data
We automatically collect:
IP addresses
Browser type and version
Device type, operating system, and screen resolution
We collect Personal Data through the following methods:
4.1 Directly From You
When you register an account, fill in your profile, add farm or field data, record crop and livestock information, enter employee details, list products in the marketplace, submit orders, interact with the AI assistant, or contact our support team, you provide data directly to us.
4.2 Automatically
When you use the Service, we automatically collect technical and usage data through server logs, cookies, and session management mechanisms. This includes IP addresses, browser information, device characteristics, and interaction patterns with the Service.
4.3 From Third Parties
We receive data from the following third-party sources:
AgroMonitoring (agromonitoring.com) — Weather forecasts, historical weather data, soil data, and NDVI satellite imagery for your registered field locations.
Stripe — Payment confirmations, subscription status updates, and billing event notifications (webhooks).
5. Legal Basis for Processing (GDPR Article 6)
Under the GDPR, we must have a valid legal basis for processing your Personal Data. We rely on the following legal bases:
5.1 Performance of a Contract (Article 6(1)(b))
Processing your account data, farm data, employee data, financial data, equipment data, and commerce data is necessary for the performance of the contract between you and us — specifically, to provide the agricultural management platform and its features as described in our Terms of Service. Without this processing, we cannot deliver the Service to you.
5.2 Legitimate Interests (Article 6(1)(f))
We process certain data based on our legitimate interests, which include:
Analysing usage patterns to improve the Service and develop new features
Ensuring the security and integrity of the platform, including fraud prevention and abuse detection
Maintaining audit logs and access records for security purposes
We have conducted legitimate interest assessments and determined that our interests do not override your fundamental rights and freedoms, particularly given the data protection safeguards we have implemented.
5.3 Consent (Article 6(1)(a))
We rely on your explicit consent for the following processing activities:
Sending marketing communications and promotional emails
Processing your data through AI features (sending farm context and queries to OpenAI for AI-powered recommendations)
Setting non-essential cookies (functional cookies for preferences)
You have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw consent through the Settings page of your account or by contacting us at [email protected].
5.4 Legal Obligation (Article 6(1)(c))
We process and retain certain data to comply with legal obligations, including tax reporting requirements, financial record-keeping obligations, and responses to lawful requests from public authorities (e.g., court orders, regulatory inquiries).
6. How We Use Your Data
We use the data we collect for the following purposes:
Service Delivery: Providing, operating, and maintaining the agricultural management platform, including farm management, field mapping, crop tracking, livestock management, HR management, financial tracking, equipment management, and marketplace features.
AI-Powered Features: Delivering AI-driven recommendations, insights, meeting summaries, and chat-based agricultural assistance. This involves sending relevant farm context data to our AI processor (OpenAI) to generate personalised responses.
Weather & Satellite Monitoring: Retrieving and displaying weather forecasts, soil conditions, and NDVI satellite imagery for your registered farms and fields via AgroMonitoring.
Billing & Subscriptions: Managing your subscription, processing payments through Stripe, generating invoices, and maintaining billing records.
Communications: Sending transactional emails (account verification, password resets, order confirmations, security alerts) and, with your consent, marketing communications.
Analytics & Improvement: Understanding how users interact with the Service to improve functionality, performance, and user experience.
Security: Detecting, preventing, and responding to security incidents, fraud, abuse, and violations of our Terms of Service.
Legal Compliance: Fulfilling our legal and regulatory obligations, including tax reporting and responding to lawful government requests.
7. Data Sharing & Third Parties
We share your data only with the third-party service providers necessary to operate the Service. Each provider acts as a data Processor on our behalf and is contractually bound to process data solely for the purposes we specify. We conduct due diligence on all Processors to ensure adequate data protection.
OpenAI (United States)
Purpose: AI chat assistant, agricultural recommendations, meeting summaries, and AI-generated insights.
Data Shared: User queries, chat transcripts, and contextual farm data (crop information, field data, livestock data) necessary to generate relevant AI responses.
Safeguards: Data processing is governed by OpenAI’s data processing agreement. We use API endpoints that do not use submitted data for model training. Transfer protections include Standard Contractual Clauses (SCCs).
Stripe (United States)
Purpose: Payment processing, subscription management, and billing.
Data Shared: Billing name, email address, subscription tier, and payment method details (processed directly by Stripe; card numbers never touch our servers).
Safeguards: Stripe is PCI-DSS Level 1 certified, the highest level of payment security certification. Stripe maintains its own comprehensive privacy policy and data protection measures. Transfer protections include SCCs and adherence to the EU-US Data Privacy Framework.
AgroMonitoring (agromonitoring.com)
Purpose: Weather data retrieval, soil data, and NDVI satellite imagery for agricultural monitoring.
Data Shared: Field polygon coordinates (GPS boundaries) necessary to retrieve location-specific weather, soil, and satellite data for your farms.
Safeguards: Only geographic coordinate data is shared; no personal identifiers are transmitted. Data minimisation principles are applied.
Cloudflare (United States)
Purpose: Content delivery network (CDN), DDoS protection, DNS resolution, and web application firewall.
Data Shared: IP addresses and HTTP request headers are processed as part of routing traffic through Cloudflare’s network.
Safeguards: Cloudflare is certified under ISO 27001, SOC 2 Type II, and the EU-US Data Privacy Framework. Cloudflare processes data in accordance with their Data Processing Addendum and SCCs.
Hetzner (Germany, European Union)
Purpose: Server hosting, database storage, and compute infrastructure.
Data Shared: All data stored in the Service resides on Hetzner infrastructure. Hetzner provides the physical and virtual servers on which the platform operates.
Safeguards: Data is physically stored in data centres located in Germany within the European Union, subject to GDPR. Hetzner is ISO 27001 certified and operates under strict EU data protection standards.
Zoho (India / United States)
Purpose: SMTP email delivery for transactional emails (account verification, password resets, order notifications, security alerts).
Data Shared: Recipient email addresses, email subject lines, and email body content for transactional messages.
Safeguards: Zoho maintains SOC 2 Type II, ISO 27001, and ISO 27701 certifications. Email transmission is encrypted via TLS. Transfer protections include SCCs.
We Do Not Sell Your Personal Data
We do not sell, rent, or lease your Personal Data to any third party for monetary or other valuable consideration. This applies under all jurisdictions, including the CCPA definition of “sale” and the CCPA/CPRA definition of “sharing” for cross-context behavioural advertising. We have not sold Personal Data in the preceding 12 months and have no intention of doing so.
8. International Data Transfers
Your data is primarily stored and processed within the European Union on servers hosted by Hetzner in Germany. However, to provide the full functionality of the Service, certain data is transferred to processors located outside the EU/EEA.
8.1 Transfer Mechanisms
EU to United States (OpenAI, Stripe, Cloudflare): Transfers are protected by Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where applicable by the EU-US Data Privacy Framework adequacy decision. We assess each transfer to ensure the recipient country provides an adequate level of data protection or that appropriate safeguards are in place.
EU to India/United States (Zoho): Transfers are protected by SCCs. Zoho’s data processing activities are governed by their Data Processing Addendum, which incorporates the latest version of the SCCs.
8.2 Data Minimisation in Transfers
We apply data minimisation principles to all international transfers. Only the minimum amount of data necessary for each Processor to perform its specific function is transferred. For example, AgroMonitoring receives only GPS polygon coordinates (not personal identifiers), and Stripe processes payment data directly without card details passing through our servers.
9. Data Retention
We retain your data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The specific retention periods are as follows:
Data Category
Retention Period
Account data
Retained while your account is active, plus 30 days after a deletion request is submitted to allow for account recovery
Farm & operational data
Retained while your account is active. You may export your data at any time before requesting deletion
Employee & HR data
Retained while your account is active. Deleted upon account deletion, subject to legal retention requirements
Financial records
7 years from the date of the transaction, as required by tax and financial reporting obligations
Audit & access logs
2 years, for security monitoring and incident investigation purposes
AI chat transcripts
Retained while your account is active. Permanently deleted upon account deletion
Encrypted backups
Retained for 30 days using GPG encryption, then automatically purged
When data reaches the end of its retention period, it is securely deleted or anonymised so that it can no longer be associated with you. Backup copies are encrypted with GPG and are automatically purged after 30 days.
10. Data Security
We implement comprehensive technical and organisational measures to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:
10.1 Encryption
Encryption at rest: All personally identifiable information (names, email addresses, phone numbers, and compensation data) is encrypted using AES-256 encryption before storage in the database.
Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL (Transport Layer Security) with certificates issued by Let’s Encrypt. HTTPS is enforced on all endpoints.
Password hashing: Passwords are never stored in plaintext. They are hashed using the bcrypt algorithm with cryptographic salt rounds, making them computationally infeasible to reverse.
Backup encryption: All database backups are encrypted using GPG (GNU Privacy Guard) before storage.
10.2 Authentication & Access Control
JWT token authentication: We use JSON Web Tokens with token versioning for session management. Tokens are stored in httpOnly cookies to prevent cross-site scripting (XSS) access.
Two-factor authentication (2FA): Time-based One-Time Password (TOTP) authentication is available for all accounts, providing an additional layer of security beyond passwords.
Account lockout: Accounts are temporarily locked after 5 consecutive failed login attempts to prevent brute-force attacks.
Role-based access control (RBAC): Users can only access data and features appropriate to their assigned role within their organisation. Permissions are enforced at both the API and user interface levels.
10.3 Infrastructure Security
Rate limiting: Global rate limits of 1,000 requests per 15 minutes are enforced to prevent abuse and denial-of-service attacks. Authentication endpoints have stricter limits of 15 requests per 15 minutes.
Security headers: We use Helmet.js to set comprehensive HTTP security headers, including Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Strict-Transport-Security.
CORS protection: Cross-Origin Resource Sharing policies are configured to restrict API access to authorised origins only.
DDoS protection: Cloudflare provides distributed denial-of-service protection and web application firewall capabilities.
Automated backups: Database backups are performed automatically on a scheduled basis, encrypted, and retained for 30 days.
While we implement robust security measures, no method of electronic transmission or storage is 100% secure. We continuously monitor for vulnerabilities and update our security practices in response to emerging threats. In the event of a data breach, we will notify affected users and relevant supervisory authorities in accordance with applicable law (within 72 hours under GDPR Article 33).
11. Your Rights
Depending on your location and applicable law, you have specific rights regarding your Personal Data. We are committed to facilitating the exercise of these rights.
11.1 Rights Under the GDPR (EU/EEA and UK Residents)
If you are located in the European Union, European Economic Area, or the United Kingdom, you have the following rights under the General Data Protection Regulation:
Right of Access (Article 15): You have the right to obtain confirmation as to whether your Personal Data is being processed and, if so, to access that data along with information about the purposes of processing, categories of data, recipients, and retention periods. You can export your data at any time through Settings > Legal & Privacy in the Service.
Right to Rectification (Article 16): You have the right to request correction of inaccurate Personal Data and to have incomplete data completed. You can update most of your data directly through your account settings.
Right to Erasure (Article 17): You have the right to request deletion of your Personal Data (“right to be forgotten”) when the data is no longer necessary for the purposes for which it was collected, you withdraw consent, you object to processing and there are no overriding legitimate grounds, or the data has been unlawfully processed. Account deletion is available through your account settings. Note that certain data may be retained where required by law (e.g., financial records for 7 years).
Right to Data Portability (Article 20): You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format (JSON). You can export your data through the Service at any time.
Right to Restrict Processing (Article 18): You have the right to request restriction of processing in certain circumstances, including when you contest the accuracy of the data, when processing is unlawful but you oppose erasure, when we no longer need the data but you require it for legal claims, or when you have objected to processing pending verification.
Right to Object (Article 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to processing for direct marketing, the processing will cease immediately.
Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing performed before the withdrawal.
Right to Lodge a Complaint (Article 77): You have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement. We encourage you to contact us first so we can address your concerns.
11.2 Rights Under the CCPA/CPRA (California Residents)
If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) provides you with the following rights:
Right to Know: You have the right to request disclosure of the categories and specific pieces of Personal Information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom it is shared.
Right to Delete: You have the right to request deletion of Personal Information we have collected from you, subject to certain exceptions (such as data needed to complete a transaction, detect security incidents, comply with legal obligations, or exercise free speech).
Right to Correct: You have the right to request correction of inaccurate Personal Information.
Right to Opt-Out of Sale or Sharing: You have the right to direct us not to sell or share your Personal Information for cross-context behavioural advertising. As stated in Section 7, we do not sell your Personal Data and have not done so in the preceding 12 months.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, different quality of service, or be denied service for exercising your rights.
Right to Limit Use of Sensitive Personal Information: Where we process sensitive Personal Information (such as precise geolocation), you have the right to limit our use to what is necessary to perform the Service.
To submit a verifiable consumer request under the CCPA/CPRA, please contact us at [email protected]. We will verify your identity before processing your request and respond within 45 days.
11.3 Rights Under PIPEDA (Canadian Residents)
If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act grants you the following rights:
Right to Access: You have the right to request access to your personal information held by us, including information about how it has been used and to whom it has been disclosed. We will respond to your request within 30 days.
Right to Challenge Accuracy: You have the right to challenge the accuracy and completeness of your personal information and have it amended as appropriate. Where we disagree with the requested amendment, we will note the disagreement in our records.
Right to Withdraw Consent: You have the right to withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. We will inform you of the implications of withdrawal.
Right to Complain: You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada if you believe we have not complied with PIPEDA.
11.4 Rights Under the LGPD (Brazilian Residents)
If you are a Brazilian resident, the Lei Geral de Proteção de Dados provides you with the following rights:
Right to Confirmation of Processing: You have the right to confirmation that your personal data is being processed by us.
Right to Access: You have the right to access all personal data we hold about you.
Right to Correction: You have the right to request correction of incomplete, inaccurate, or outdated personal data.
Right to Anonymisation, Blocking, or Deletion: You have the right to request anonymisation, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD.
Right to Data Portability: You have the right to receive your personal data in a structured format for transfer to another service provider, in accordance with regulations issued by the Autoridade Nacional de Proteção de Dados (ANPD).
Right to Deletion of Data Processed with Consent: You have the right to request deletion of personal data processed on the basis of your consent, except where retention is legally required.
Right to Information About Shared Data: You have the right to know which public and private entities your personal data has been shared with.
Right to Information About Consent: You have the right to be informed about the possibility of denying consent and the consequences of such denial.
Right to Revoke Consent: You have the right to revoke your consent at any time through an express request, at no cost.
To exercise your rights under the LGPD, please contact our Data Protection Officer at [email protected]. You also have the right to file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).
How to Exercise Your Rights
You can exercise most of your rights directly through the Service by navigating to Settings > Legal & Privacy. This section allows you to export your data (JSON format), request account deletion, manage consent preferences, and review your data processing settings. Alternatively, you may email us at [email protected] with your request. We will respond to all rights requests within 30 days (or within the timeframe mandated by your applicable law). We may need to verify your identity before processing your request.
12. Cookies & Tracking
We use a minimal set of cookies necessary to operate the Service. We do not use third-party analytics or advertising cookies.
12.1 Essential Cookies
These cookies are strictly necessary for the Service to function and cannot be disabled. They include:
Session / Authentication cookies: JSON Web Tokens stored in httpOnly, secure cookies to maintain your authenticated session. These cookies are not accessible to JavaScript and are transmitted only over HTTPS.
CSRF protection cookies: Tokens used to prevent cross-site request forgery attacks.
12.2 Functional Cookies
These cookies enable enhanced functionality and personalisation:
Language preference: Stores your selected language to provide a consistent experience.
Theme preference: Stores your selected visual theme (light/dark).
Locale settings: Stores regional settings for date formats, number formats, and currency display.
12.3 What We Do Not Use
We do not use Google Analytics or any third-party analytics platform
We do not use advertising cookies or tracking pixels
We do not use social media tracking widgets
We do not engage in cross-site tracking or behavioural advertising
12.4 PWA Service Worker
The Service uses a Progressive Web App (PWA) service worker to enable offline functionality and improve performance. The service worker caches application assets locally on your device. It does not track your behaviour or transmit data to third parties. You can clear the service worker cache at any time through your browser settings.
13. Children’s Privacy
The Service is designed for use by agricultural professionals and business operators and is not intended for individuals under the age of 16. We do not knowingly collect, solicit, or process Personal Data from children under 16 years of age.
If you are a parent or guardian and you believe that your child under 16 has provided us with Personal Data, please contact us immediately at [email protected]. If we become aware that we have collected Personal Data from a child under 16 without verification of parental consent, we will take steps to delete that data promptly.
For users in the United States, we comply with the Children’s Online Privacy Protection Act (COPPA), which sets a threshold of 13 years of age. We apply the higher threshold of 16 years to ensure compliance with the GDPR and provide broader protection.
14. Automated Decision-Making
Our Service incorporates AI-powered features that analyse your farm data to provide recommendations, insights, and summaries. These features include crop management suggestions, weather-based alerts, resource allocation recommendations, and AI-assisted agricultural planning.
These AI features are advisory in nature only. They do not make legally binding decisions, do not produce legal effects, and do not significantly affect you in a similar manner within the meaning of GDPR Article 22. All recommendations and insights generated by AI are presented as suggestions for your consideration.
You always retain full decision-making authority. No automated process within the Service will take action on your behalf without your explicit approval. You are free to accept, modify, or disregard any AI-generated recommendation.
If you have concerns about how AI features process your data, you may disable AI features in your account settings or contact us for more information about the logic involved and its potential consequences.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the features of the Service. When we make changes, we will update the “Effective Date” at the top of this page.
For material changes — those that significantly alter how we collect, use, or share your Personal Data, or that reduce your rights under this policy — we will provide at least 30 days’ prior notice before the changes take effect. Notice will be provided through one or more of the following methods:
A prominent notification within the Service (e.g., a banner or in-app notification)
An email to the address associated with your account
An update to this page with a clear indication of what has changed
Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the Service and request deletion of your account before the new policy takes effect.
16. Data Protection Officer
AGROINSIGHTS TECHNOLOGIES LTD has designated a Data Protection Officer (DPO) responsible for overseeing our data protection strategy, ensuring compliance with applicable data protection laws, and serving as the point of contact for data subjects and supervisory authorities.
You may contact our Data Protection Officer for any questions or concerns regarding:
How your Personal Data is processed
Exercising your data protection rights
Reporting a data protection concern or potential breach
Requesting information about our data protection practices
We aim to respond to all enquiries within 5 business days. For data protection rights requests, we will respond within the timeframe required by applicable law (generally 30 days under GDPR, 45 days under CCPA/CPRA).