Version 2026-11-01, en vigueur à partir du 1 novembre 2026.
Pas encore de texte en français. Voici le texte qui fait foi, en anglais.
This notice explains how Truleaf handles personal data in Truleaf Fields, the professional farm monitoring service at truleaf.org/fields. The general truleaf.org privacy notice covers the rest of our site.
Truleaf Fields is operated by Matheus Paranhos, a sole trader (empresário em nome individual) established in Portugal, trading as Truleaf ("Truleaf", "we"), tax and VAT number PT308520050, tax address R. Antonio Manuel Frutuoso 54, 3700-042 São João da Madeira (Porto Metropolitan Area), Portugal.
Privacy contact: hello@truleaf.org. We have not appointed a data protection officer: the law does not require one for our activity.
| Data | Why we use it | Legal basis (GDPR Art. 6(1)) | How long we keep it |
|---|---|---|---|
| Account: email, name, username, password hash, language, time zone, sign-in provider ids | To create and run your account and sign you in | Contract (b) | Until you delete your account, plus 30 days |
| Workspaces, members, invitations, advisor links and the consents given for them | To run workspaces, roles and advisor access, and to prove who agreed to what | Contract (b). For invited people: legitimate interest (f) of the workspace that invited them | Life of the workspace. Invitations: 90 days after they expire or are accepted. Consent records: 5 years after withdrawal or workspace deletion |
| Security: sessions, audit log, access log with IP address, application logs | To keep the service and accounts secure and investigate abuse | Legitimate interest (f) | Sessions: until they expire. Audit log: 24 months. Access log: 7 months; for users outside Brazil, IP addresses are shortened after 30 days. Application logs: 30 days |
| Billing: billing name, email, address, tax ids, invoices | To charge for plans and meet tax law | Contract (b); legal obligation (c) | As tax and accounting law requires 10 years (Portuguese VAT and tax law), longer only where tax losses are carried forward |
| Notifications: email address, push subscriptions, preferences, delivery records | To send the alerts, digests and account messages you set up | Contract (b) | Notifications 180 days; delivery records 90 days; email events 30 days; push subscriptions unseen for 60 days are disabled and deleted 30 days later |
| Professional verifications: for example a ROPO advisor number or applicator card and the document you upload | To show a verification badge and pre-fill your records | Contract (b) | Documents: deleted 90 days after our decision. Record: 1 year after it expires |
| Product analytics (self-hosted Umami, no cookies) | To understand and improve how the product is used | Legitimate interest (f) | 14 months |
| Kwáu usage counts (no conversation content) | To apply plan allowances and bill | Contract (b) | 24 months |
| Kwáu conversations you choose to share with us, and improvement cases from workspaces that switched on "Help improve Kwáu" | To review and improve Kwáu's answers | Legitimate interest (f), only with these opt-ins | Shared items: as long as the conversation. Improvement cases: until the workspace switches the setting off, plus 30 days, and at most 3 years |
| Support conversations and demo requests | To answer you | Contract (b) or steps you asked for before a contract (b) | Demo requests: 24 months after the last contact, unless you become a customer |
About analytics. Inside the Fields app (/fields/app) analytics events carry no user id, no page titles and no specific addresses of pages. On other truleaf.org pages, events are linked to your user id when you are signed in, and to your user type and number of workspaces. Umami runs on our own server and shares nothing with third parties. You can object at any time (section 8).
No special categories. Fields does not ask for health or other special-category data. Please do not enter it in notes or forms.
As processor, we store and process for the workspace: farm locations and field outlines; seasons, crops and the logbook (treatments, irrigation, operators and their professional numbers, equipment); observations, photos (which may show people or carry a location) and tasks; sensor connections (credentials encrypted) and readings; satellite and weather results per field; alerts; exports; Kwáu conversations about the workspace's data; "Find my fields" sessions, including the address you type and any screenshots you upload; and client lists an advisor imports.
We keep this data for as long as the workspace exists. When a workspace is deleted, it is kept 30 days so it can be restored, then deleted. Some items are deleted sooner:
| Item | Deleted |
|---|---|
| Kwáu conversations | 18 months after the last message, or within 30 days after you delete them. Conversations of an advisor that used a client's data are hidden as soon as the advisor loses access and deleted 30 days later |
| Screenshots uploaded to "Find my fields" | 30 days after the session ends (only a copy without metadata is kept) |
| "Find my fields" sessions and suggested outlines | 30 days after the session ends |
| Client lists uploaded with "Import my clients" (file and cell values) | 7 days after the import is committed, cancelled or expires |
| Generated export files | 30 days |
Kwáu is Truleaf's AI assistant. It runs on models provided by Anthropic. The same service reads screenshots you give as hints in "Find my fields" and suggests column mappings in "Import my clients".
We use these service providers. Each receives only what it needs.
| Provider | What for | What it receives | Where |
|---|---|---|---|
| [to be completed before launch: hosting provider, entity and region for the database, files and servers] | Database, file storage and the servers that run our API and workers | All Fields data, data in transit and in memory, logs | EU |
| MongoDB Atlas (MongoDB, Inc.) | Account and sign-in store | Account data, sessions, demo requests | [to be completed before launch: MongoDB Atlas region and transfer basis] |
| Vercel (Vercel Inc.) | Delivery of the website | IP address, requested addresses and headers in its logs | Global network; US company (EU-US Data Privacy Framework and Standard Contractual Clauses) |
| Anthropic | Kwáu and AI-assisted steps (section 5) | See section 5 | US/global (Standard Contractual Clauses) |
| Resend | Sending email | Email address, name and message content | US (Standard Contractual Clauses and EU-US Data Privacy Framework) |
| Stripe (Stripe Payments Europe, Ltd.) | Payments | Billing name, email, address, tax ids, payment details | Ireland, with onward transfers to Stripe, LLC in the US |
| [to be completed before launch: invoicing provider and location] | Legal invoices | Invoice data | See the provider column |
| OpenStreetMap Foundation (public Nominatim service) | Finding a place from an address, while Fields runs as an invite-only pilot | Only the address or place text you type, or the town of a client list you import, the language and the country you chose; for a point you pick on the map, its coordinates. No user or workspace id, no IP address: the requests come from our servers | United Kingdom (European Commission adequacy decision) |
| [to be completed before launch: basemap provider and location] | Satellite basemap shown behind your fields | Your device's IP address, the map area viewed, a session token | See the provider column |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Delivering push notifications you switched on | An encrypted message, the push address, its size and time | US |
| [to be completed before launch: off-site backup provider, safeguard and retention period] | Encrypted backups | Encrypted copies only; the provider cannot read them | EU region |
| Google and Apple sign-in | Sign-in, if you choose it | Sign-in tokens | They act as independent controllers |
Planned change. When the pilot ends, address search moves from the OpenStreetMap Foundation to Geoapify (KEPTAGO LTD, Cyprus, EU), which receives the same kind of text and a rough location bias, and no user or workspace id. We will update this list when it happens.
Public data sources. Satellite imagery (Copernicus Sentinel through Element 84 Earth Search), weather (Open-Meteo, MET Norway, NASA POWER, which receive only the coordinates of grid points) and, for farms in Spain, official registers and services (SIGPAC, Catastro, PNOA, AEMET, SiAR) receive map tiles, grid points, dates or register references, not personal data. For Spanish address searches, the text you type may also go to CartoCiudad (Spanish National Geographic Institute).
Sensors you connect. When you connect your own weather station or probe account (for example Pessl FieldClimate or Davis WeatherLink), we read your data from that provider with the credentials you give us. That provider is yours, not ours.
Your workspace and advisors. Members of a workspace, and advisors it gives access to, see the workspace's data according to their role.
Authorities. We disclose data to authorities only where the law requires it.
A list of our sub-processors, with changes announced 30 days in advance, is kept at Annex 3 of the data processing agreement.
Workspace data is stored in the EU. Address searches go to the OpenStreetMap Foundation in the United Kingdom, which the European Commission recognises as giving adequate protection (adequacy decision renewed until 27 December 2031). Other transfers outside the EU happen only through the providers marked above as US or global, under Standard Contractual Clauses and, where the provider takes part in it, the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards at the privacy contact above.
You can ask us to access, correct, delete or export your data, to restrict its use, or object to it, including to analytics. Where we rely on your consent, you can withdraw it at any time.
When you delete your account, you are signed out everywhere and the account is closed at once. You have 30 days to change your mind. Then we delete it. If you are the only owner of a workspace with other members, a subscription or client farms, you need to transfer ownership or delete that workspace first.
Some records stay after deletion, for the reasons given: audit entries that name you (24 months, security and the workspaces' accountability), access logs (7 months), usage counts without content (billing), the record that your account was deleted (5 years, proof of erasure) and invoices (tax law). Records you created in a shared workspace stay in that workspace; they no longer link to your account.
Deleted data leaves our backups when those copies expire (see the backup provider in section 6).
Workspace data is stored in the EU, and Fields data is encrypted in transit and at rest. Each workspace's data is separated in the database itself. Credentials for connected sensors are encrypted with a separate key. Truleaf staff open a workspace's data only for support, with a recorded reason, and workspace owners can see when this happened.
Fields keeps your sign-in session and some app files in your browser's storage so the app works and keeps your notes when you lose signal. We consider this strictly necessary for the service you asked for. Fields uses no advertising cookies. See the truleaf.org cookie policy for the rest of the site.
We send the alerts, digests, invitations and account messages that the service needs. You can switch off each kind of alert email with one click from the email or in your settings. Account and security messages cannot be switched off. We send no marketing email to users of the service unless they ask for it.
Truleaf Fields is for adults using it for their business or profession.
Each version of this notice has a date. When a change affects how we use your data, we publish a new version and workspace owners are asked to accept it.
Truleaf may contact people at farms, advisory practices, cooperatives and other businesses who do not use Fields yet, to tell them about Truleaf. We tell them this at the first contact at the latest.