Agro Notes is available on Google Play and the App Store. Android · iPhone

Agro Notes

Website privacy policy

Version 1.6 · effective from October 28, 2026

This policy applies only to the website agronotes.app (the “Website”). Data processing in the Agro Notes mobile app is described in the separate app privacy policy.

Data controller

The controller of personal data collected through the Website is Krzysztof Kołecki, running a business under that name (Polish tax ID (NIP) 5862270852, REGON 389974516), address: ul. Oskara Kolberga 18C/31, 81-881 Sopot, Poland. Contact: [email protected].

What data we collect

The contact form collects your email address and the text of your message so that we can answer your question, request for help or suggestion. Before a message is accepted, Cloudflare Turnstile checks that it does not come from a bot and may receive your IP address and technical browser data for this purpose. The hosting provider processes standard server logs, including IP addresses. Umami Cloud receives the technical visit data described in the section on cookies and analytics.

The pages that handle links from emails (email confirmation and setting a new password) process the one-time token from that message only to carry out the requested action on your app account.

Purpose and legal basis

We process contact form data to reply to a message you sent on your own initiative, and the Turnstile check to reject automated submissions. The legal basis for both is our legitimate interest in handling correspondence and protecting the form (Article 6(1)(f) GDPR). We process server logs on the basis of our legitimate interest in keeping the Website secure (Article 6(1)(f) GDPR). The one-time token from an email is processed to perform the contract for the app (Article 6(1)(b) GDPR).

Retention

  • Contact form messages: for the duration of the correspondence, no longer than 12 months after the last message on the matter, unless the law requires a longer period.
  • Hosting provider logs (Cloudflare): in line with the hosting provider's policy, limited to the logs needed to run and secure the Website; we do not enable additional, longer retention of HTTP logs.
  • Umami visit data: no longer than 24 months, or less if it is no longer needed to assess traffic on the Website.

Your rights

  • The right to access your data and obtain a copy.
  • The right to rectification.
  • The right to erasure (“right to be forgotten”).
  • The right to restrict processing.
  • The right to data portability.
  • The right to object to processing based on legitimate interest, on grounds relating to your particular situation. This applies in particular to contact form correspondence, the Turnstile check and Website security logs.
  • The right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work, or with our lead supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise these rights, contact us: [email protected].

Recipients of data

  • Supabase (Supabase, Inc. (USA), infrastructure in the EU): Handling email confirmation and password reset links, and passing contact form messages on for delivery. Scope: One-time token from an email message; email address and message text from the contact form. Place of processing: European Union (Frankfurt, Germany).
  • Cloudflare Pages (Cloudflare, Inc. (USA)): Hosting the static agronotes.app website and checking the contact form for automated submissions (Turnstile). Scope: IP address and standard server logs; when the form is sent, also the Turnstile result and the technical browser data needed for that check. Place of processing: Global CDN network.
  • Umami Cloud (Umami Software, Inc. (USA)): Measuring website visits without cookies, without a Distinct ID and without session replay. Scope: Page URL, referring page, browser and operating system type, screen size, language and approximate location; Umami creates a technical session identifier (a hash of, among others, the IP address and user agent) that is rotated periodically. Place of processing: European Union.
  • Resend (Resend, Inc. (USA)): Delivering messages sent through the contact form to the Agro Notes inbox. Scope: Email address and message text from the contact form. Place of processing: United States.

We do not sell or share email addresses with third parties for marketing.

Transfers outside the European Economic Area

Our core infrastructure runs in this region: European Union (Frankfurt, Germany). Some providers are based outside the European Economic Area. In those cases transfers rely on one of the mechanisms provided for in Chapter V of the GDPR:

  • Supabase: Standard contractual clauses for any technical support access from outside the EEA.
  • Cloudflare Pages: Standard contractual clauses.
  • Resend: Standard contractual clauses.

Cookies and analytics

The Website does not use tracking or advertising cookies. Umami does not store an analytics identifier in your browser; sessions are distinguished on the server side. The details, including the fact that the dashboard shows the course of individual sessions and not only totals, are in the Cookie and device storage policy.