Privacy Policy

AgroAI is a precision-agriculture tool for irrigation planning. It reads recent satellite radar (SAR) and optical imagery over a field you draw, combines it with weather data, and shows farmers where their field is wetter and drier. This policy explains how we handle your personal data when you visit agroai.az, create an account, sign in, or use the map.

The data controller responsible for your personal data is AgroAI. For any privacy question, or to exercise your rights, contact the AgroAI team at agroai.com@gmail.com.

We keep data collection to what the product actually needs. Here is everything we collect and why.

a. Account data (email & password sign-up)

• Your email address, which is your account identifier.
• Your name and surname, which are required at registration and used to identify you in the app and in messages we send you.
• Your password, stored only as a one-way bcrypt hash — we never store or see your plain-text password.
• Account timestamps — when the account was created and when you last signed in.
• During sign-up we briefly hold a pending record (your email, the hashed password, and a hashed verification code); it is deleted as soon as you confirm the code or it expires.

b. Google sign-in data ("Continue with Google")

If you choose Continue with Google, we ask Google for the openid, email and profile scopes. Google returns your email address (and whether it is verified), your name, profile picture, and Google account ID. We store your email address and your name — we do not save your profile picture or your Google account ID. See section 4.

c. Email verification

To confirm your inbox is real, we email a 6-digit code to your address using a transactional email provider. The code is stored only as a hash and expires shortly after it is sent. We send a similar code when you ask to reset your password.

d. Location (optional, only with your consent)

We ask for your location for one reason: to centre the map on where you are, so you can find your fields without searching or panning across the country. If you accept the location banner, your browser shares your coordinates once. They are used to position the map and are then immediately discarded — we do not store your location, link it to your account, or derive anything from it. If you decline, we never ask your browser for location, and you can still find your fields by searching or by moving the map yourself.

e. Field boundaries & map activity

When you draw a field and run an analysis, the field's coordinates are sent to our backend and to our satellite/weather data providers to compute your reading for that request. This is not linked to your account and is not stored — each request is computed and discarded. Place searches and the weather page send your search term or coordinates to a geocoding/weather provider to return results.

f. Technical data

Like any website, our hosting provider processes basic connection data (such as your IP address, the request, and a timestamp) to deliver and secure the service. We do not run advertising or analytics trackers. Some page assets (fonts and icons) load from content-delivery networks that receive your IP address — see section 6.

Under the GDPR we must have a lawful basis for each purpose. We rely on the following:

We do not use your data for automated decisions with legal effects, and we do not sell your personal data or use it for third-party advertising.

When you use Google to sign in:

• We request only the openid, email and profile scopes.
• We create or locate your AgroAI account using your verified email, and store that email together with your name.
• Google processes your Google account data under its own Privacy Policy.
• You can review or revoke AgroAI's access at any time in your Google Account → Data & privacy → Third-party access.

We use a small number of cookies — no advertising or cross-site tracking cookies.

Your browser's local storage may also keep small preferences on your device (for example, the last place you searched on the weather page). These stay on your device and are not sent to us. You can clear cookies and local storage in your browser settings, but blocking the strictly necessary cookies will prevent you from signing in.

We never sell or rent your personal data. We share it only with the service providers ("processors") needed to run AgroAI, and only to the extent each one needs to do its job:

• Google LLC — "Continue with Google" sign-in, when you choose it.
• Cloud hosting and database providers — run the application and store your account data.
• A transactional email provider — delivers your verification and password-reset codes.
• Map, geocoding and weather providers — supply base maps, place search, and the weather inputs to the model (they receive your IP address and the map area or search term).
• Satellite data providers — supply the radar and optical imagery for the field you analyze.
• Content-delivery networks — serve fonts and icons; they receive your IP address when the page loads.

What each category receives differs. Your account data (your name, email, and hashed password) is stored by our hosting and database provider, and your email address is passed to our email provider so it can deliver your verification and reset codes. Google receives nothing from us; it simply returns your email and name when you choose to sign in with it. The map, weather, and satellite providers never receive your account data at all: field boundaries, place searches, and map activity are sent without any account identifier, so those requests cannot be traced back to you. We are happy to tell you exactly which providers we currently use — just ask at agroai.com@gmail.com.

We may also disclose data if required by law, to protect our rights, or as part of a merger or acquisition.

Some of the providers above process data outside your country. Your account data is stored on servers in Canada, and our hosting, email and content-delivery infrastructure operates in the European Union and the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision. Contact us for details of the safeguards in place.

• Account data — kept while your account is active. If you ask us to delete your account, we remove it promptly and permanently; we do not keep a copy afterwards.
• Pending verification records — deleted the moment you confirm the code, or automatically when it expires (minutes).
• Session cookie — expires after ~12 hours (or up to 30 days if you stay signed in); the short-lived OAuth cookie expires in ~10 minutes.
• Field boundaries, map searches and location — not stored; processed and discarded per request.

We keep data only as long as necessary for the purposes above or as required by law.

We use technical and organizational measures appropriate to the risk, including: passwords stored only as bcrypt hashes, encrypted connections (HTTPS/TLS), SSL-encrypted database connections, HTTP-only, Secure session cookies, email verification at sign-up, and access to account data limited to authorized administrators. No method of transmission or storage is 100% secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.

Depending on where you live, you have some or all of the following rights over your personal data.

We honor Global Privacy Control (GPC) signals where applicable. To exercise any right, email agroai.com@gmail.com. We will verify your request and respond within 30 days (or the period required by law). Exercising your rights is free unless a request is manifestly unfounded or excessive.

Deleting your account

Self-service account deletion is a feature we plan to add. Until it is available, email agroai.com@gmail.com from your registered address with the subject line "Account Deletion Request". We will process your request within 3 business days to delete the account manually and no data is retained afterwards.

AgroAI is intended for adults. The Service is not directed to anyone under 18, and our Terms of Service require you to be at least 18 to use it. We do not knowingly collect personal data from anyone under that age.

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top. For material changes, we will also give you a more prominent notice, which may include a notification on your profile page and an email to your registered address. Please review it periodically; continuing to use AgroAI after an update means you accept the revised policy.

Questions about this policy or your data? Contact:

This Privacy Policy is governed by the laws of Azerbaijan. If you are located in the EEA or UK, you also keep the mandatory rights granted to you under the GDPR.