CropBro Privacy Policy
Effective date: 24 October 2026 · Last updated: 28 October 2026
1. Who we are
This Privacy Policy explains how CropBro ("CropBro", "we", "us") handles personal data when you visit cropbro.com (the "Site") or use CropBro Office (office.cropbro.com) and the CropBro Field app on mobile or web (together, the "Platform").
CropBro is currently offered as a free beta. Features can change while we build.
2. Our two roles
- When we act for ourselves (Data Fiduciary / Controller). For your CropBro account (for example, your name, email and phone), for running and securing the Platform, and for Site visits, CropBro decides how and why the data is used.
- When we act for a farm (Data Processor). A farm business that uses CropBro (an "Organisation") decides what to record about its workers, plots, crops, attendance, wages and work. For that data the Organisation is the Data Fiduciary (DPDP Act) or Controller (GDPR), and CropBro processes it on the Organisation's instructions under our Data Processing Addendum (available on request). If you are a worker, contact your employer first. We will help them respond.
3. What we collect
Account and profile: full name, phone number, email address, organisation name, preferred language and time zone. Organisation phone number. Email addresses on invitations and join links.
Workers and teams (entered by the Organisation): display name, worker code, engagement type, phone number and notes, and whether the worker has a linked CropBro account.
Attendance: check-in and check-out times, status, source, notes, pay rate, a device identifier, the time the device captured the entry, and the GPS location and accuracy at check-in and check-out. If GPS is not available, the worker can give a reason instead.
Location: we collect location only while the app is open and in use (foreground), for example on check-in, when attaching a photo, logging work, reporting an issue or walking a field boundary. We do not track location in the background. Boundary walking pauses when the app goes to the background.
Farm data: farms, blocks, plots, boundaries (drawn, walked or imported from GeoJSON/KML/KMZ files), crops and crop cycles, season plans, work assignments, activity logs, issues and spray products.
Photos and videos: photos and short videos (60 seconds or less) taken as work evidence or attached to issues, which may include location.
Payroll and wages: pay terms, daily wage and payroll records.
Expert contacts: names, phone numbers, emails and addresses of advisers an Organisation adds.
Device data for notifications: device platform and an installation identifier (used for push notifications once they are enabled).
Questions to the AI assistant: the questions you ask and the answers given (see section 6).
Technical and error data: error reports from the Field app, which may include device and app details (see section 8).
What we do not collect: bank account details, Aadhaar, PAN or other government ID numbers, date of birth, gender, or biometric data. We do not store face or fingerprint data. Any future face verification would only be launched with separate notice and consent.
4. Why we use it and our lawful basis
| Purpose | DPDP Act 2023 | GDPR / UK GDPR basis |
|---|---|---|
| Creating and running your account | Consent / legitimate use under s.7 | Contract (Art. 6(1)(b)) |
| Delivering the Platform for Organisations (workforce, attendance, farm records, payroll) | On the Organisation's behalf, as its processor | Controller's basis; we act as processor |
| Sending sign-in, invitation and alert emails | Consent / legitimate use | Contract |
| Security, fraud prevention, audit logs, error fixing | Legitimate use; legal obligation | Legitimate interests (Art. 6(1)(f)); legal obligation |
| AI suggestions, briefs and photo reading | Consent | Contract / legitimate interests |
| Weather, satellite and map features | Consent / legitimate use | Contract |
| Keeping financial, payroll and audit records | Compliance with law | Legal obligation (Art. 6(1)(c)); legitimate interests |
| Beta feedback and improving the Platform | Consent | Legitimate interests |
We do not sell personal data and we do not use it for advertising.
5. Consent and notice (India)
Where we rely on consent, we ask for it with a clear notice, in plain language, and in English or another language listed in the Eighth Schedule where available. You can withdraw consent at any time as easily as you gave it, by writing to the Grievance Officer (section 13). Withdrawal does not affect processing before it, and some features may stop working.
6. AI features
CropBro offers AI-assisted features such as answers to questions, daily briefs and reading farm photos. AI output is a suggestion only. A person must review and confirm it before anything is acted on. CropBro does not make decisions with legal or similar significant effects about you based solely on automated processing.
To answer, we send the AI provider a snapshot of the relevant farm context: farm, block and plot names, crops, work titles, status and dates, issues, activity logs, labour counts, the full names of team members, your question and, for photo features, the photo. We replace internal database identifiers with tokens before sending.
AI provider: OpenAI and Google Gemini. These providers may process data outside India (see section 9).
7. Who we share data with
- Your Organisation. Data you record in an Organisation's workspace is visible to people that Organisation authorises.
- Service providers (sub-processors) who help us run the Platform: Supabase (database, sign-in, server functions; AWS Mumbai, India), Vercel (hosting), Cloudflare R2 (photo and video storage), Resend (email), Sentry (error reporting), Google Maps (maps), Expo, Google Firebase Cloud Messaging and Apple Push Notification service (push notifications, once enabled), the AI provider in section 6, and Copernicus Data Space / Sentinel Hub (satellite imagery, which receives farm boundary geometry). The full list is in the Data Processing Addendum (available on request).
- Public data services. Weather requests to MET Norway and NASA POWER are sent from our servers with farm coordinates, not your IP address.
- Legal reasons. When required by law, court order or a government authority, or to protect rights, safety and property.
- Business transfers. In a merger, acquisition or sale of assets, subject to this Policy.
8. Error reporting
The Field app sends crash and error reports to Sentry so we can fix problems.
9. International transfers
Our main database is hosted in India (AWS Mumbai). Some providers (for example hosting, email, error reporting, maps, push notifications and AI) may process data in other countries, including the United States and the European Union. We transfer data out of India only to countries not restricted by the Government of India under section 16 of the DPDP Act. For data from the EEA, UK or Switzerland, we rely on adequacy decisions or the EU Standard Contractual Clauses / UK International Data Transfer Addendum, plus supplementary measures.
10. How long we keep data
- Account data: while the account is active, then deleted within 90 days of account closure.
- Organisation operational data: while the Organisation's workspace is active; deleted within 90 days after the Organisation is deleted, subject to legal holds.
- Attendance GPS points: 24 months, then removed or aggregated.
- Payroll, wage, accounting and audit records: 8 years, matching Indian books-of-account requirements, because the law requires us or the Organisation to keep them. These records are kept tamper-evident and are not edited or deleted during that period.
- Photos and videos: as long as the related record, maximum 36 months.
- Error logs: 90 days.
- Notifications: until expiry.
- Invitations and join links: until expiry.
- Backups: daily backups kept for 7 days, then overwritten. Under the DPDP Act, where the purpose has been served and you have not engaged with us for the prescribed period, we will erase personal data after notice, unless the law requires us to keep it.
11. Your rights
Everyone (DPDP Act, India): right to access a summary of your data and processing, and the identities of those we shared it with; right to correction, completion, updating and erasure; right to grievance redressal; right to nominate another person to act for you in the event of death or incapacity. You must not file false or frivolous complaints or impersonate others.
EEA/UK (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), withdrawal of consent, and the right to complain to your supervisory authority.
California and other US states: we do not sell or "share" personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics. You can ask to know, delete or correct your information, and we will not discriminate against you for using these rights.
How to use them: email us at info.agribhai@gmail.com. We will verify your identity and reply within 30 days (GDPR: one month, extendable where permitted). Self-serve account deletion is not yet available. If the data belongs to an Organisation's records, we will pass your request to that Organisation.
Some records (payroll, accounting, audit and evidence history) are kept tamper-evident to meet legal and audit duties, so we may restrict rather than erase them until the retention period ends.
12. Security
We use access controls by organisation and role, encryption in transit, private storage for photos and videos, and audit logging. CropBro staff can view an Organisation's workspace only with that Organisation's time-limited, revocable consent, only after two-factor authentication, and every access is recorded in an audit log that cannot be altered. No system is perfectly secure.
Breaches: if a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act and its Rules, notify the relevant supervisory authority within 72 hours where GDPR requires it, and inform affected Organisations without undue delay.
13. Grievance Officer, DPO and representatives
- Grievance Officer (India): email us at info.agribhai@gmail.com. We will respond within 7 days to acknowledge, 30 days to resolve, or the period set by DPDP Rules. If you are not satisfied, you may complain to the Data Protection Board of India.
14. Children
CropBro is a business tool for adults. You must be at least 18 years old to create an account, and Organisations must not register workers under 18 on the Platform without verifiable parental consent where the law requires it. If we learn we hold a child's data without required consent, we will delete it.
15. Cookies and local storage
See our Cookie and Storage Notice. We do not use advertising cookies or analytics cookies. cropbro.com uses cookieless page analytics from our website host, Lovable, to understand how the site is used.
16. Changes
We will post changes here and update the date above. For material changes we will notify account holders by email or in the app before they take effect.
17. Contact
CropBro. Email us at info.agribhai@gmail.com.