Privacy Policy

Last updated: 2026-05-19 · Effective: 2026-05-19

This Privacy Policy explains how FarmBuzz ("FarmBuzz," "we," "us," or "our") collects, uses, stores, shares, and protects your personal information when you use the FarmBuzz mobile app, website, and related services (collectively, the "Platform").

We process personal data in compliance with applicable data protection laws, including but not limited to the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazil's LGPD, and the Philippine Data Privacy Act (RA 10173). Where the protections of more than one law apply to you, we apply the strongest one.

1. Information We Collect

1.1 Information you provide

• Mobile phone number (required for account registration and authentication via SMS one-time code)
• Country and preferred language (set at signup, changeable later subject to a 90-day cooldown)
• Full name and display name
• Profile information (bio, avatar photo, cover photo)
• Community-specific content you create — posts, comments, photos, videos, marketplace listings, and records you choose to keep in any of the supported communities
• Messages you send through the platform (including any group conversations you create)
• Referral code, if you joined via an ambassador or invitation link

1.2 Information collected automatically

• Device information (device type, operating system, browser version)
• IP address and approximate location (city / region level)
• Usage data (pages viewed, features used, interaction timestamps)
• Performance data (page load times, crashes, errors)
• Authentication tokens and session identifiers (set as HttpOnly cookies)

1.3 Information from third parties

• SMS delivery and verification status from our OTP service providers
• Payment processor responses (for paid memberships and marketplace orders) — we never see your card number or banking credentials

2. How We Use Your Information

1. Account management: create, authenticate, and recover your account using your phone number and 6-digit PIN.
2. Platform services: provide the community features you signed up for — connecting with peers, posting content, joining clubs, tracking your craft.
3. AI features: our in-app AI assistant uses aggregated and anonymized data to provide recommendations. Personal data is processed server-side only and is never shared with third-party AI providers in identifiable form.
4. Marketplace: facilitate listings, discovery, and transactions for supplies relevant to your craft.
5. Communication: send SMS verification codes, account notifications, and platform updates.
6. Security: detect and prevent fraud, abuse, account takeover, and unauthorized access.
7. Analytics: understand how the platform is used and improve features. We do not sell behavioral data to third parties.
8. Legal compliance: comply with applicable laws, regulations, and legal processes in the markets we serve.

3. Legal Basis for Processing

• Consent: you provide explicit consent at account creation. You can withdraw consent at any time by deleting your account.
• Contract: processing is necessary to provide the services you requested.
• Legitimate interest: processing for platform security, fraud prevention, and service improvement — balanced against your rights and freedoms.
• Legal obligation: processing required by applicable law in the country where you reside or where FarmBuzz operates.

4. Data Sharing and Disclosure

We do not sell your personal data. We share information only as described below:

• With your consent: when you explicitly authorize a specific share.
• Service providers: trusted vendors who help us operate the platform (SMS gateways, cloud infrastructure, error monitoring, payment processors), bound by data processing agreements that limit them to using your data only for the services they provide us.
• Legal requirements: when required by valid legal process (court order, regulator request) in any jurisdiction where we operate.
• Safety: when necessary to protect the rights, property, or safety of our users or the public.
• Public profile data: your display name, username, avatar, and public posts are visible to other FarmBuzz users by design — that is what makes it a community.

5. Data Retention

• Active account: retained as long as you remain a user.
• After account deletion: personal data is anonymized within 30 days. We may retain anonymized records longer to fulfill legal obligations, resolve disputes, or improve the platform.
• Audit logs: system audit entries (who did what, when, from where) are retained for up to 7 years to comply with applicable financial and regulatory record-keeping rules.
• Anonymized data: aggregated, non-identifiable data may be retained indefinitely for analytics.

6. Your Rights

Depending on the law that applies to you, you have the following rights:

1. Access: request a copy of the personal data we hold about you.
2. Correction: request that inaccurate or incomplete data be corrected.
3. Deletion / erasure: request deletion of your data, subject to legal retention requirements. We verify your identity, soft-delete within 30 days, and anonymize all personally identifiable information thereafter.
4. Data portability: request an export of your data in a structured, commonly used, machine-readable format.
5. Objection: object to certain types of processing, including profiling and direct marketing.
6. Restriction: request that processing of your data be temporarily restricted.
7. Withdrawal of consent: withdraw any consent you previously gave us.
8. Complaint to a regulator: lodge a complaint with the data protection authority of the country where you reside.

You can exercise most of these rights from inside the app at Settings → Account, or by following the steps on our Support page. Account deletion is always reversible during a 30-day grace window by signing back in.

7. Cookies and Local Storage

• Authentication tokens (HttpOnly cookies): set by the server, not readable by JavaScript. Mitigates token theft via cross-site scripting.
• Auth-hint cookie: non-sensitive routing cookie that tells the site whether to show the login screen or the feed. No personal data inside.
• User preferences: language, country, and display preferences stored in localStorage.
• Remembered phone number: if you opt in, your phone number is stored locally for faster login on return visits. You can clear it any time via the "Not you?" link on the login screen.
• Cached profile snapshot: a non-sensitive copy of your display name + avatar so the app renders instantly on repeat visits. Cleared on logout.

We do not use third-party tracking cookies. We do not serve advertisements. We do not participate in ad networks or cross-site behavioral tracking.

8. Data Security

• All data in transit is encrypted using TLS 1.2 or higher.
• PINs are hashed with industry-standard algorithms and never stored in plain text.
• API endpoints are protected by authentication, rate limiting, and origin restrictions.
• Security headers (CSP, HSTS, X-Content-Type-Options, frame-ancestors) are enforced on every response.
• Production systems are accessible only to a limited set of authorized personnel.
• We conduct regular security reviews and dependency audits.

In the event of a personal data breach that poses a risk to your rights, we will notify the appropriate data protection authority and affected users within the timeframe required by the law that applies to you (within 72 hours under GDPR and RA 10173, for example).

9. Age Requirement and Children

FarmBuzz is intended for users 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will close the account and delete the associated data. Parents or guardians who believe their child has provided us with personal data can contact us through the Support page and we will remove the data promptly.

10. International Data Transfers

Your data may be stored and processed in data centers located outside your country of residence. When we transfer data internationally, we use safeguards required by applicable law — including standard contractual clauses, adequacy decisions, or your explicit consent. We never transfer personal data to a country that lacks adequate protections without applying such safeguards.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the platform and, where required, via SMS at least 15 days before the change takes effect. Your continued use of FarmBuzz after a change means you accept the updated policy.

12. Contact