Privacy Policy

1. Introduction

Nkolefarm ("the Service") is operated by Mubangizi Moses ("we", "us", "our"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our farm management platform.

We are committed to protecting the privacy of smallholder farmers and their teams. We only collect data necessary to operate the Service and never sell your personal information to third parties.

Which law applies

Nkolefarm is built for farmers in Uganda, so this policy is written to meet the Uganda Data Protection and Privacy Act 2019 and its 2021 Regulations, which are administered by the Personal Data Protection Office within NITA-U. If you use Nkolefarm from the European Economic Area or the United Kingdom, the GDPR and UK GDPR apply to you in addition, and where the two regimes differ we apply whichever gives you the stronger protection.

Why we are allowed to process your data

• To run your account and your farm: because it is necessary to provide the service you asked for under our contract with you
• Photos, voice notes and AI features: your consent, given when you use the feature, and withdrawable at any time
• Keeping the service secure and working: our legitimate interest in preventing abuse and fixing faults
• Payment and tax records: our legal obligation to keep them

2. Information We Collect

Account Information

• Name, email address, and phone number (provided during registration)
• Farm name and role (owner, partner, worker, or veterinarian)
• Account credentials (passwords are hashed and never stored in plain text)

Farm Data

• Livestock records (animals, breeding, health, weights)
• Crop records (plots, stages, harvests, sales)
• Task assignments and worker performance
• Financial transactions and purchase requests
• Chat messages and voice notes within your farm team
• Photos uploaded for AI analysis (crop/animal health)

Automatically Collected

• Device type and browser information
• IP address (used for rate limiting and security)
• Service usage patterns (pages visited, features used)

Payment Information

Payment details (mobile money numbers, card information) are processed directly by our third-party payment processors. We do not store your full payment credentials. We retain transaction references and amounts for billing records.

3. How We Use Your Information

• Operating the farm management platform and syncing data across your devices
• Providing AI-powered features (briefings, health analysis, market intelligence)
• Processing payments and managing subscriptions
• Sending service-related notifications (weekly plans, morning briefings)
• Protecting the security of your account and preventing abuse
• Improving the Service based on aggregated, anonymized usage patterns

4. AI Data Processing

When you use AI features, your farm data (context about crops, animals, finances) is sent to our AI provider (Groq) to generate responses. This includes:

• Chat messages when you mention @nkolefarm
• Photos submitted for crop or animal health analysis
• Voice notes submitted for transcription
• Farm context data used to personalize AI responses

We do not send passwords, payment details, or authentication tokens to AI providers. AI providers process data according to their own privacy policies. Groq's API terms state that data submitted through the API is not used to train its models; that is their commitment rather than ours, and it is the one part of this policy whose performance we do not directly control.

5. Data Storage and Security

Your data is stored using the following infrastructure:

• Database: Supabase (PostgreSQL) with row-level security policies ensuring users can only access their own farm's data
• File storage: Supabase Storage for photos, voice notes, and documents
• Hosting: Vercel with HTTPS encryption in transit
• Offline cache: IndexedDB on your device for offline access (data stays on your device)

We implement security measures including encrypted connections (TLS), row-level security, rate limiting, and regular security audits to protect your data.

6. Data Sharing

We share your data only in the following circumstances:

• Within your farm: Team members you invite can see shared farm data according to their role permissions
• Service providers: Supabase (database), Vercel (hosting), Groq (AI), third-party payment processors (billing) — only as needed to operate the Service
• Legal requirements: If required by law, court order, or government request

We never sell your personal information or farm data to third parties.

Where your data goes

Every provider above operates outside Uganda, so using Nkolefarm involves transferring your data abroad. Section 19 of the Data Protection and Privacy Act 2019 permits this where the receiving country offers adequate protection or the transfer is covered by appropriate safeguards, and we rely on the data protection terms in our contracts with each provider for that. For users in the EEA or the UK, those same contracts carry the relevant standard contractual clauses. Ask us and we will tell you which safeguard applies to a given provider.

7. Data Retention

• Active accounts: Data is retained for as long as your account is active
• Closed accounts: Data is retained for 30 days after account closure to allow export, then permanently deleted
• Payment records: Transaction records are retained for 7 years as required for tax and legal compliance

8. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you and your farm
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and associated data
• Export: Download your farm data in a standard format
• Restriction: Request that we limit how we process your data
• Objection: Object to processing we carry out on the basis of our legitimate interests
• Withdraw consent: Turn off the AI features at any time; withdrawing does not undo processing already carried out

You can also complain to a regulator, and you do not have to contact us first. In Uganda that is the Personal Data Protection Office at NITA-U. In the UK it is the Information Commissioner's Office at ico.org.uk. In the EEA it is the supervisory authority for the country where you live or work.

To exercise any of these rights, contact us at hello@mosematic.com. We will respond within 30 days.

9. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us to have it removed.

10. Cookies and Local Storage

We use essential cookies for authentication session management. We use IndexedDB for offline data caching. We do not use tracking cookies or third-party analytics that track you across websites.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Service or email. The "last updated" date at the top of this page indicates the most recent revision.

12. Contact

For privacy questions or data requests, contact:

Mubangizi Moses
Email: hello@mosematic.com