Privacy Policy

1. Data controller identification

The controller of your personal data is:

• Controller Sergi López (natural person)
• Email hola@alexia.garden
• Address Valldoreix, Sant Cugat del Vallès, Catalonia, Spain
• Service Alexia.garden — AI-assisted gardening application

2. Minimum age

Use of Alexia.garden is restricted to persons aged 16 or over, in accordance with Art. 8 GDPR and Spanish data protection law (LOPDGDD). If you are under 16, you may not create an account or use the service without the express consent of your parent or legal guardian.

If we become aware that we have collected data from a child under 16 without adequate consent, we will delete it immediately.

3. Data we collect

To provide the service, we may collect the following categories of data:

• Registration data — name, email address and password (or OAuth authentication data from Google/Apple).
• Profile data — photo, location, language preferences and app settings.
• Garden data — plants added to your digital garden, measurement corners, care tasks and history.
• Location data — GPS coordinates while using Sol Real and Light Meter, to calculate solar exposure. Coordinates are processed in the moment and linked to the saved corner.
• Communication data — private messages between users on the platform (PlantaPop, PlantSitter, Services).
• Usage data — pages visited and actions within the app, collected anonymously to improve the service.
• Environmental data — temperature, rain probability, pollen level and sun hours, obtained from third-party weather APIs based on your location.
• Images — plant photos sent to Identifica for AI identification, processed by Anthropic and OpenAI. Photos sent to AlexIA to generate visualizations are also processed via OpenAI (gpt-image-1).

4. Purpose of processing

• Provide and personalise the application service (digital garden, sun measurements, AlexIA).
• Personalise plant recommendations based on your space and climate conditions.
• Facilitate transactions in the PlantaPop marketplace between users.
• Send transactional communications (account confirmation, service notifications) via Resend.
• Improve the application through aggregated anonymous analytics.
• Climate and urban biodiversity analysis — measurement data (sun, light, temperature, pollen) is stored in a completely anonymised, user-unlinked form to build an urban microclimate dataset. This use does not allow you to be identified as a person.

5. Legal basis for processing

Processing of your data is based on the following GDPR legal bases, broken down by type of processing:

• Contract performance (Art. 6.1.b GDPR) — account creation and maintenance; digital garden management (plants, tasks, corners); PlantaPop marketplace transactions; sending service-related transactional emails.
• Consent (Art. 6.1.a GDPR) — GPS location access for Sol Real and Light Meter (consent is explicitly requested each session and may be withdrawn at any time from device settings); optional push notifications (can be disabled from Profile).
• Legitimate interest (Art. 6.1.f GDPR) — service improvement and error detection; platform security and fraud prevention; anonymous aggregated analytics to understand general app usage.
• Legitimate interest — anonymised climate dataset (Art. 6.1.f GDPR, recital 26) — anonymised measurement data does not constitute personal data and is processed for climate and urban biodiversity research. Re-identification of any user from this data is not possible.

6. International transfers

Some technical providers we work with are located outside the European Economic Area (EEA). In all cases we apply the appropriate safeguards required by the GDPR:

• Supabase — database and authentication. EU servers (West EU). GDPR compliant.
• Anthropic (USA) — AI processing (AlexIA, Identifica). Transfer covered by Standard Contractual Clauses (SCCs). Data not used to train models.
• OpenAI (USA) — AI processing: plant identification (GPT-4o vision) and image generation (gpt-image-1). It receives the photos sent to Identifica and, when visualizations are generated in AlexIA from one of your photos, that photo. Transfer covered by Standard Contractual Clauses (SCCs). According to OpenAI's API policy, submitted data is not used to train its models.
• Railway (USA/EU) — backend server hosting. Transfer covered by SCCs.
• Resend (USA) — transactional email sending. Transfer covered by SCCs.
• Groq (USA) — voice transcription. Transfer covered by SCCs.
• Google (USA) — Places, Weather and Pollen APIs. Transfer covered by Google's Standard Contractual Clauses and partial adequacy decision.

You can request a copy of the applicable safeguards by writing to hola@alexia.garden.

7. Your rights (GDPR)

As a user you have the right to:

• Access (Art. 15) — know what data we hold about you.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure · "right to be forgotten" (Art. 17) — delete your personal data. You can do this from Profile → Delete account.
• Portability (Art. 20) — receive your data in machine-readable format.
• Restriction (Art. 18) — request restriction of processing in certain circumstances.
• Objection (Art. 21) — object to processing based on legitimate interest at any time, including processing for analytics and service improvement. Upon objection, we will stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds.
• Withdrawal of consent (Art. 7.3) — withdraw consent given (GPS, push notifications) at any time without affecting the lawfulness of prior processing.

Note on anonymised data: measurement data stored in the climate dataset is completely unlinked from your account. Because it is anonymised, it cannot be individually identified or erased (in accordance with Art. 17.3 GDPR and recital 26).

For any request, write to hola@alexia.garden.

8. Third parties and providers

We do not sell your data. We work with the technical providers detailed in section 6 (International transfers). None of them are authorised to use your data for their own purposes or advertising.

All providers have adequate data protection safeguards in accordance with the GDPR (standard contractual clauses or adequacy decision).

9. Cookies and similar technologies

• Technical session cookies — strictly necessary to keep the authentication session active. No consent required (Art. 5.3 ePrivacy Directive).
• Local storage (localStorage) — used to save language preferences and app settings locally on your device. Not sent to any external server.
• No tracking cookies — no third-party cookies, behavioural advertising cookies or tracking pixels are used.
• No external analytics — we do not integrate Google Analytics, Meta Pixel or any other external analytics tool. Internal analytics are fully anonymous and aggregated.

Since only strictly necessary cookies are used, displaying a cookie banner is not required. If we add non-essential cookies in the future, we will update this policy and request your consent.

10. Data retention

• Account and garden data — retained while the account is active. When the account is deleted, personal data is erased immediately.
• Messages — retained until the user deletes them or closes the account.
• Identifica images — the photo may be saved to your digital garden if you add the plant. Otherwise, it is not stored permanently. Transmitted to Anthropic and OpenAI for identification processing.
• Anonymised data (climate dataset) — retained indefinitely as it is completely unlinked from any identifiable person.
• Server logs — technical server records (errors, access logs) are retained for a maximum of 30 days and deleted automatically.

11. Security

• TLS/HTTPS on all communications.
• JWT for session authentication.
• Row Level Security (RLS) in Supabase, so each user can only access their own data.
• Rate limiting on API endpoints to prevent abuse.

12. EU dispute resolution

If you are a consumer resident in the European Union and have a dispute related to this service, you can access the European Commission's Online Dispute Resolution (ODR) platform:

European Commission ODR Platform

Our contact address for disputes: hola@alexia.garden.

13. Changes to this policy

We may update this Privacy Policy to reflect legal changes or changes to the service. In the event of material changes, we will notify you by email or through a prominent notice in the app at least 15 days in advance. The date of the last update always appears at the top of the document.

14. Contact and complaints

For any privacy query or to exercise your rights, write to hola@alexia.garden. If you believe your data is not being processed in accordance with the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).