Privacy Policy

SOILWATER is the data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and other applicable data protection law. Contact details are at the end of this policy.

• Account & login data: your name, email address, and a securely hashed password (we never store your password in plain text), plus the tokens needed to keep you signed in.
• Content you provide: locations, fields, soil/water/compaction samples, observations, photos, schedules, and any other data you enter to use the Service.
• Technical data: IP address, browser and device information, and basic usage/error logs, collected automatically to operate, secure, and troubleshoot the Service.
• Cookies: a single essential, httpOnly cookie used to keep you signed in. We do not use advertising or third-party tracking cookies.

• To create and manage your account and authenticate you.
• To provide the core functionality of the Service — storing, syncing, and displaying your location, field, and sample data.
• To maintain security, prevent abuse, and diagnose technical problems.
• To communicate with you about your account or material changes to the Service.

We do not sell your personal data, and we do not use it for third-party advertising.

• Performance of a contract: processing needed to provide the Service you've signed up for.
• Legitimate interests: security, fraud prevention, and improving the Service.
• Legal obligation: where we're required to retain or disclose data by law.
• Consent: where we ask for it separately, such as optional communications.

• Account and login data is retained for as long as your account remains active.
• Field, sample, and other content data is retained for as long as it's stored in your account, or as long as needed to provide the Service to you and the other members of your locations.
• If you delete your account or request erasure, we will delete or irreversibly anonymize your personal data within 30 days, except where we're required to retain certain records longer to comply with a legal obligation, resolve disputes, or enforce our agreements.
• Data may persist in encrypted backups for a limited additional period before being purged in the ordinary backup rotation cycle.

We use a small number of service providers (data processors) to operate QSoil, under data processing agreements where applicable:

• Cloud hosting and compute providers, to run the Service.
• Backblaze B2, for encrypted storage of uploaded photos and documents.

We do not sell, rent, or otherwise disclose your personal data to third parties for their own marketing purposes.

Some of our processors operate outside the European Economic Area (EEA), including in the United States. Where this is the case, we rely on appropriate safeguards recognized under GDPR, such as Standard Contractual Clauses, to protect your data.

We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS), hashed passwords, and access controls limiting who can view your data. No system is completely secure, and we can't guarantee absolute security — this applies with particular force during the current beta period (see our Terms and Conditions).

If you are located in the EEA, UK, or another jurisdiction with similar protections, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data (the "right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

To exercise any of these rights, including a formal GDPR data request, contact us using the details below. We will respond within one month, as required by GDPR.

QSoil is not directed at children under 16, and we do not knowingly collect personal data from them.

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above, and for material changes we'll make reasonable efforts to notify active users.

For any question about this policy, or to exercise your data protection rights, contact: [insert contact email — e.g. privacy@yourdomain].