Privacy Policy

Climate Support (“Climate Support”, “we”, “us”), [registration number], , operates the Climate Support platform at https://app.climate-support.org (the “Platform”) and the public produce passport pages reached by scanning a Climate Support QR code. We are the controller of the personal data described in this policy.

Questions and requests about personal data: hello@climate-support.org.

This policy covers the Platform and the passport pages only. The marketing website at https://climate-support.org may carry its own notice.

We collect only what the verification chain needs. Depending on your role, that is:

• Account data — your name, email address, a hashed password, your role (farmer, laboratory, packager, retailer, or administrator), and the date the account was created. Invited partners also have the inviting administrator recorded.
• Farm application data (farmers) — farm name, country, address and map location, contact number, tax identification number, crops grown, growing and management practices, irrigation and input use, harvest and packaging practices, last-season gate prices, certifications held, and the signed declaration with the name typed as a signature and the time of signing.
• Operational records — harvest logs (dates, weights, costs, notes), batch and packaging records, laboratory test assignments, uploaded laboratory reports and the nutrient values transcribed from them, quality grades, and QR code print runs.
• Payment records — the amount and currency of a laboratory test you authorized, when you authorized it, and your sample logistics choice. We do not collect or store card or bank details on the Platform.
• Partner contact details — for laboratories, packagers, and shops: business name, contact email, phone number, address, and website.
• Messages we send you — notifications inside the Platform and transactional emails (verification codes, invitations, password resets, status updates).
• Audit trail — which account performed which administrative or partner action, on what record, and when.
• Technical data — your IP address, held for at most 24 hours to rate-limit sign-in, sign-up, password reset, and QR-scan requests; and the cookies described below.
• QR scans — when a passport page is opened we record the code scanned, the time, and a one-way salted hash of the visitor’s IP address. The hash cannot be turned back into an address; it lets us count distinct scans and spot cloned codes.

• To run the verification chain — reviewing applications, assigning tests, recording results, issuing QR codes, and publishing passports. Basis: performance of our agreement with you (the Terms of Service).
• To communicate with you about your account, applications, tests, and payments. Basis: performance of our agreement.
• To keep the Platform secure and prevent abuse — rate limiting, session expiry, the audit trail, and scan monitoring. Basis: our legitimate interest in operating a trustworthy certification system.
• To meet legal and accounting obligations, such as keeping payment records. Basis: legal obligation.
• To publish a produce passport naming your farm, its country, and the laboratory that tested the batch. Basis: performance of our agreement, and the consent you give in the application declaration, which you may withdraw by contacting us (existing printed codes will be deactivated).

We do not use your data for advertising, and we do not sell it.

Anyone who scans an active QR code sees the crop, the farm name and country, the batch code and serial, the quality grade, the certifications on file, the harvest, packing, and test dates, the laboratory’s name, and the nutrient results for that batch. It never shows a person’s name, contact details, address, tax number, prices, or costs.

• Partners in your chain — a laboratory testing your batch sees the farm and batch details it needs; a packager sees the batch it packs; a shop sees the produce offered to it. Each partner agrees to use that data only for its role.
• Service providers acting on our instructions — Supabase (database, authentication, and file storage), Vercel (hosting and content delivery), and Resend (email delivery). Each is bound by a data processing agreement.
• Authorities and advisers — where the law requires it, or to establish or defend legal claims.

We do not share personal data with anyone else.

The Platform database is hosted by Supabase in [hosting region]. Our email and hosting providers may process data in other countries, including the United States. Where data leaves the country you are in, we rely on the provider’s standard contractual safeguards.

• Account and application data — for as long as your account exists, then deleted within 90 days of closure unless we must keep it longer for a legal or accounting reason.
• Certification records — laboratory reports, results, and batch records tied to a QR code that has been printed are kept for as long as that produce may be on the market, and then for the period consumer-protection law requires, because a shopper may scan the code at any time.
• Payment records — for the period tax and accounting law requires.
• Notifications — read notifications are deleted 90 days after they were read.
• Rate-limit IP records — deleted after 24 hours.
• Scan records — kept as anonymized hashes for statistics and counterfeit detection.
• Audit trail — kept for the life of the record it describes.

Data travels over encrypted connections. Every database table is protected by row-level access rules so each account sees only what its role permits, and every write on behalf of a partner goes through server-side checks. Passwords are stored only as hashes and must meet a minimum-strength policy. Verification codes are stored hashed and expire in ten minutes. Sessions end after inactivity and after 24 hours. Public sign-up is disabled at the authentication layer; accounts are created only through the sign-up flow or by an administrator’s invitation.

If a breach is likely to put your rights at risk we will tell you and, where the law requires it, the relevant authority, without undue delay.

The Platform sets only cookies that are strictly necessary for it to work:

• Authentication cookies set by Supabase that keep you signed in.
• A signed session-activity cookie (“cs-session-activity”) that records when you signed in and when you were last active, so we can end idle sessions. It contains no personal data beyond those timestamps.

We set no analytics, advertising, or third-party tracking cookies, so we do not show a cookie banner. If that changes we will update this policy and ask for consent first.

Depending on where you are, the law gives you the right to:

• ask what personal data we hold about you and receive a copy;
• have inaccurate data corrected — most of your profile and application can be edited in the Platform;
• have your data deleted, subject to the retention reasons above;
• restrict or object to a particular use, including any use based on legitimate interest;
• receive the data you gave us in a portable format;
• withdraw consent where we rely on it, without affecting what was done before;
• complain to a supervisory authority, for example [supervisory authority], or the authority in the country where you live.

To exercise any of these, write to hello@climate-support.org from the email address on your account. We answer within 30 days and may ask you to confirm your identity first.

The Platform is for businesses and their staff. It is not directed at anyone under 18, and we do not knowingly collect data from them. If you believe a minor has an account, contact us and we will remove it.

When we change this policy we will post the new version here with a new effective date and, for material changes, notify account holders by email or inside the Platform before the change takes effect.

Climate Support, . Email: hello@climate-support.org.