Privacy Policy

C.S. VENTURE LAB, SASU, registered at 4 Rue du Pensionnat Notre-Dame de France, 43000 Le Puy-en-Velay, France, SIREN 130 812 811 ("we", "us"), operates Plaasjapie and is the data controller for visitors to our website and for farm account owners. For the operational records a farm captures about its own staff and equipment, the farm is the controller and we act as its processor under written instruction.

Privacy queries and data subject requests: support@plaasjapie.eu. Our Information Officer (POPIA s.55) can be reached at the same address.

• Account data — name, email address, hashed password credentials, role (owner, farm manager, driver, mechanic), farm membership and language preference.
• Operational data — fuel and service logs, machine hours, odometer readings, jobs assigned to you, fields worked, and the time a tag was scanned.
• Uploaded content — equipment photos and receipts/invoices you scan, including any text extracted from them.
• Field locations — boundaries and coordinates you draw on the farm map.
• Billing data — subscription plan, status and seat count. Card details are handled solely by our payment processor; we never receive or store them.
• Technical data — IP address, browser type, and security/error logs needed to run the service safely.

We do not knowingly collect special personal information or children's data, and the service is not intended for anyone under 18.

• Contract (GDPR Art. 6(1)(b); POPIA s.11(1)(b)) — creating accounts, recording logs and jobs, showing analytics, and billing subscriptions.
• Legitimate interests / legitimate business purpose (Art. 6(1)(f); POPIA s.11(1)(f)) — securing the platform, preventing abuse, and improving reliability.
• Consent (Art. 6(1)(a); POPIA s.11(1)(a)) — optional analytics storage and any marketing email. You may withdraw consent at any time.
• Legal obligation — tax, accounting and lawful requests from authorities.

We do not sell personal information, and we do not use your farm data to train third-party AI models. Receipt scanning sends only the image you upload to our AI provider for extraction; the output is returned to your farm's records.

We use a small number of vetted processors bound by data processing agreements. Farm data is also visible to the members and managers of your own farm according to their role.

• Lovable Cloud (Supabase) — database, authentication and file storage.
• Stripe — subscription and AI credit payments; card details are handled only by Stripe.
• Lovable Cloud (Supabase Auth, built-in email) — delivery of password resets, sign-up confirmations and account emails. Invites are shared as links by your farm and are not emailed by us.
• Lovable AI Gateway (Lovable Labs Incorporated), using Google Gemini 2.5 Flash — receipt extraction, field detection, Ask Plaasjapie AI answers, and reading fuel-pump and meter photos (Google Gemini via Lovable AI Gateway).
• Lovable Labs Incorporated — hosting and content delivery.
• Driver phones — drivers don't need an email or password: the farm links a driver's phone with a single-use QR code. We store the phone model, the date it was linked and when it was last seen. The farm can unlink a phone at any time, which signs it out immediately.

Our providers may process data outside South Africa or the EEA. Where that happens we rely on transfer mechanisms recognised by GDPR Chapter V (such as the EU Standard Contractual Clauses) and on POPIA s.72, which permits transfer where the recipient is subject to comparable protection or where you have consented.

• Account and farm records: for the life of the account, then deleted within 30 days.
• Fuel, service, job and invoice records: retained while the farm needs them, and 10 years after account closure where tax or accounting law requires it.
• Security and error logs: up to 12 months.
• Cookie consent record: 12 months, then we ask you again.

Under GDPR and POPIA you may request:

• access to a copy of your personal information;
• correction of inaccurate or incomplete data;
• deletion of data we no longer need to keep;
• restriction of, or objection to, certain processing;
• portability of the data you supplied, in a machine-readable format;
• withdrawal of consent, including for analytics storage and marketing;
• not to be subject to solely automated decisions with legal effects — we make none.

Email support@plaasjapie.eu and we will respond within 30 days. Our lead supervisory authority is the French CNIL (Commission nationale de l'informatique et des libertés, cnil.fr). If you are in South Africa you can also complain to the Information Regulator (inforeg@justice.gov.za).

Data is encrypted in transit (TLS) and at rest by our cloud provider. Access is restricted per farm through row-level security policies and role checks, passwords are stored hashed, and administrative actions on farm accounts are recorded in an audit trail. If a security compromise affects your personal information we will notify you and the Information Regulator as required by POPIA s.22 and GDPR Arts. 33–34.

See our Cookie Notice for the full list of cookies and local storage we use and how to change your choice.

We will post any update on this page and, for material changes, notify account owners by email before the change takes effect.

You can ask us to delete your account and personal information at any time. See Delete your account for how it works and what we must keep for legal reasons.