Privacy Policy
How YouFarm collects, uses, shares, and protects personal information
Effective August 17, 2026
This Privacy Policy explains what information YouFarm collects, why we hold it, who else sees it, how long we keep it, and how to have it removed.
YouFarm is published by Grant Scientific Ltd. ("we", "us", "Grant Scientific"), General Delivery, 704-4th Ave S, Lethbridge, AB, T1J 3Y2, Canada.
This policy covers all three YouFarm surfaces: the YouFarm web application, the YouFarm Mobile app for iPhone and Android, and the YouFarm marketing website at youfarmstudio.ca. Where a surface differs, we say so explicitly in §3.
1. Who YouFarm is for
YouFarm is a professional tool for agronomists. It is sold to agricultural retailers and agronomy service providers, and it is used by the agronomists who work for them to manage grower, farm, and field records and to produce fertility recommendations.
Accounts are created for individual agronomists by YouFarm staff at the request of the subscribing organization. There is no self-service sign-up, and there is no purchasing of any kind inside the mobile app. YouFarm is not directed at children, and we do not knowingly collect information from anyone under 18.
2. Two kinds of information, two different responsibilities
This distinction runs through the whole policy, so it is worth stating plainly at the outset.
| Your account information | Your organization's agronomic records | |
|---|---|---|
| What it covers | Your name, work email address, sign-in credentials, role, and app preferences. | Growers, farms, fields, field boundaries, soil-sampling jobs, samples, and the recommendations generated from them. |
| Who is responsible | We are, directly. We decide how it is handled, and this policy governs it. | The organization you work for. It is not yours personally and it is not ours: that organization instructs us about it, and we hold and process it on their behalf under our agreement with them. Who owns grower-originated data is a separate question, addressed in §7. |
| Where to send a request | To us — see §10.1 and §14. | To your organization. We will point you to them and act on their instruction. |
In the language of privacy law, we are the controller of your account information and the processor (or service provider) for your organization's agronomic records. Our obligations to the subscribing organization are set out in our agreement with them, including a Data Processing Addendum available to subscribing organizations on request.
Growers. Where a farm is a sole proprietorship, a partnership of individuals, or a family operation, records about that farm may also be information about identifiable people. We treat such records as personal information. The farming operation owns its own data, and we do not sell it — see §7.
3. What each surface collects
| Web application | Mobile app | Marketing website | |
|---|---|---|---|
| Account and profile information | Yes | Yes | No |
| Agronomic records | Yes | Yes | No |
| Map area being viewed | Yes | Yes | No |
| Cookies strictly necessary for sign-in | Yes | Not applicable | No |
| Analytics or measurement | No | No | No |
| Contact-form or newsletter details | No | No | Yes, if you submit them |
| Advertising identifiers or ad networks | No | No | No |
| Location from your device | No | No | No |
4. What we collect and why
4.1 Information you or your organization give us
| Information | Why we hold it |
|---|---|
| Work email address and password | To authenticate you. Passwords are stored only as salted hashes by our authentication provider — we never see or store your password in readable form. |
| Name and profile details | To identify you in the application and to colleagues working the same jobs. |
| Application preferences, including notification and map-transparency settings | So your settings follow you between devices. |
| Agronomic records you view or create | The core function of the service. See §2 — this is your organization's data. |
| Support correspondence | To answer your question and to keep a record of the issue. |
4.2 Information generated by your use
| Information | Why we hold it |
|---|---|
| The map area you are viewing | Sent to our imagery and land-description services to fetch the correct map tiles. See §6. |
| Access and security logs, including IP address, timestamp, and action taken | To secure the service, investigate problems, detect abuse or automated extraction, and meet our record-keeping obligations. |
| Record attribution — which account created or modified a record | So your organization can audit its own records. |
4.3 What the YouFarm applications do not do
The web application and the mobile app:
- No advertising and no advertising identifiers. There are no ad networks in either application.
- No analytics, no behavioural tracking, and no crash-reporting SDK. We do not track you across other companies' apps or websites, and there is no third-party analytics code in the applications.
- No location collection. Neither application requests or collects your device's location. If a future version does, we will update this policy and ask your permission first.
- No access to your contacts, photos, microphone, calendar, or health data.
- We do not sell or share your information. Not to anyone, for any purpose, and not for cross-context behavioural advertising.
4.4 The marketing website
The marketing website at youfarmstudio.ca does not require an account and sets no cookies beyond those strictly necessary to serve the site securely. We do not use analytics, advertising, or tracking cookies on it, and there is no consent banner because there is nothing to consent to. Anything you type into a contact or demonstration-request form is used to respond to you and, if you separately opt in, to send you product news. Marketing consent is always a separate, unticked choice — it is never bundled with anything else, and every marketing email carries an unsubscribe link that we honour promptly.
4.5 Cookies and similar technologies in the web application
The web application uses strictly necessary cookies and local storage only. There is nothing to consent to or opt out of — without them you cannot sign in.
| Cookie | Purpose | Duration |
|---|---|---|
| Authentication session | Keeps you signed in and identifies your session to our servers. | Session, or until you sign out |
| Session refresh token | Lets your session renew without asking you to sign in repeatedly. | Persists between visits; cleared when you sign out |
| Security and abuse prevention | Detects session hijacking and automated access. | Session |
| Interface preference | Remembers interface choices that are not stored on your account. | Persists between visits |
We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies anywhere in the web application. The YouFarm Mobile application does not use cookies, analytics, crash reporting, or advertising identifiers at all — see §4.3 above. Every major browser lets you block or delete cookies; blocking strictly-necessary cookies will prevent you from signing in to the web application. We do not use Do Not Track or Global Privacy Control signals for anything, because there is no tracking or targeted advertising here for those signals to switch off.
5. How we use it
We use the information described above only to run the YouFarm service: to sign you in, to show you the records you are authorized to see, to save your work and preferences, to generate the recommendations you ask for, to secure the service, and to provide support when you ask for it.
We do not use it for advertising, for profiling, for automated decision-making that produces legal or similarly significant effects about you, or for building products unrelated to YouFarm.
5.1 Improving our agronomic models
We may use agronomic records to improve and validate the agronomic models behind the service, but only in aggregated and de-identified form — stripped of any identifier of an organization, a person, a farm, a field boundary, or a coordinate, and aggregated across enough distinct operations that no individual operation can be inferred. We do not sell those aggregated datasets. A subscribing organization, or a grower through that organization, may opt out of inclusion at any time by writing to privacy@mail.youfarmstudio.ca, and opting out does not affect the service, its price, or its availability.
6. Who else receives it
| Recipient | What they receive | Why |
|---|---|---|
| Supabase — database and authentication hosting | Account credentials and all application data | Supabase hosts the database and authentication service behind YouFarm. They process it on our instruction and do not use it for their own purposes. |
| YouFarm backend services — our own servers | Your access token and the requests you make | Not a third party. This is our own infrastructure, listed so the picture is complete. |
| Google Maps Platform (Map Tiles API) | The geographic area of the map being displayed, and an identifier for the YouFarm application. Your name, email address, and account identity are not sent. | To supply the satellite imagery beneath field maps. Google acts as an independent controller for this data and its handling is governed by the Google Privacy Policy. |
The table above names the recipients that can see your account information or your organization's agronomic records. We also use service providers for functions that touch a narrower set of data — sending account and support email, and processing subscription payments for subscribing organizations. Subscribing organizations receive the current list of these providers, and notice of changes to it, under our agreement with them.
We require every third party that receives information through YouFarm to protect it to a standard at least equal to the one described in this policy, and we bind each of them by written contract to do so.
We do not otherwise disclose your information, except where we are legally required to. Where we are permitted to tell you, we will. We would also transfer information as part of a merger, acquisition, or sale of assets, in which case we would give notice before your information became subject to a different privacy policy.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws.
7. Agricultural data
Data generated on a farming operation belongs to that operation. We say so plainly because it matters more in agriculture than the general law of privacy captures — much farm data is not "personal information" at all, and would otherwise fall outside privacy law entirely.
- The grower owns their agricultural data. Field boundaries, soil results, yield and acreage records, and the recommendations produced from them originate on the grower's operation and belong to it.
- We do not sell agricultural data. Not in identifiable form, not in de-identified form, not to input suppliers, not to commodity traders, not to anyone. Where a law requires a producer's express written consent before agricultural data may be sold, no such consent is sought or implied anywhere in our agreements.
- We do not use agricultural data to speculate in commodity markets, and we do not provide it to anyone who does.
- Aggregation is opt-out. See §5.1.
- It is portable. A subscribing organization can export its complete records at any time, in a structured, machine-readable format and without charge, under its agreement with us. A grower can ask for a machine-readable copy of its own data at any time, including before we delete it; write to us at the address in §14.
8. Where your information is held, and cross-border transfers
Data is stored on servers located in Canada. Map imagery requests are served by Google's global infrastructure.
Information held or processed outside Canada may be accessible to the courts, law enforcement, and national security authorities of the country where it is held. We say this plainly because Canadian privacy law requires us to, and because it is something you should know before you ask.
8.1 Our service providers outside Canada
Alberta's Personal Information Protection Act requires us to tell you the following about service providers outside Canada:
| Countries where information may be collected, used, stored, or disclosed | Canada (database and authentication hosting), United States (Google Maps imagery) |
| Purposes for which those service providers are authorized to act | Database and authentication hosting; supply of satellite map imagery. Nothing else. |
| How to obtain our written policies and practices | They are this document. A copy is available on request from the contact below. |
| Who to ask about out-of-country handling | Privacy Officer, Grant Scientific Ltd. — privacy@mail.youfarmstudio.ca, General Delivery, 704-4th Ave S, Lethbridge, AB, T1J 3Y2, Canada. |
9. How long we keep it
| Information | Retention |
|---|---|
| Your account and profile | For as long as your organization subscribes and your account is active. On closure, deleted or anonymized within 30 days. |
| Application preferences | Deleted with the account. |
| Agronomic records | Retained under our agreement with the subscribing organization — they decide, not us. On termination of that agreement, deleted or returned within 90 days. See §2. |
| Access and security logs | Kept for a limited period for security monitoring and incident investigation, then deleted. |
| Support correspondence | Kept while the matter is open and for a limited period afterwards to handle follow-up, then deleted. |
| Records of a privacy breach | 24 months, as Canadian law requires, whether or not the breach was reportable. |
| Records we must keep by law | For as long as the law requires, then deleted. |
Backups are encrypted and overwritten on our ordinary rotation; information in a backup remains protected by this policy until the backup is overwritten.
10. Your choices and your rights
Under Canadian privacy law — the federal Personal Information Protection and Electronic Documents Act, and provincial legislation including Alberta's and British Columbia's Personal Information Protection Act where it applies — you can:
- See and correct your profile information, in the application under User Profile.
- Ask for a copy of the personal information we hold about you.
- Ask us to correct information that is inaccurate or incomplete.
- Withdraw consent and close your account — see Deleting your YouFarm account.
- Withdraw marketing consent at any time, using the unsubscribe link in any marketing email or by writing to us.
- Complain — to us first, and then to the Office of the Privacy Commissioner of Canada or your provincial commissioner if we do not resolve it. In Alberta that is the Office of the Information and Privacy Commissioner of Alberta; in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia.
10.1 How we handle a request
Write to privacy@mail.youfarmstudio.ca from the address your account is registered to, or tell us another way to verify your identity. We will acknowledge within 2 business days and resolve within 30 days, which meets or beats the response window each applicable Canadian privacy statute sets. Where any law that applies to you gives a shorter window, we apply the shorter one. There is no charge.
One practical caveat. Because your account is provisioned by the organization you work for, closing it may require their involvement as an access-management step. We will tell you if that is the case when you ask, and we will not use it as a reason to refuse a valid request about your own personal information.
11. How we protect it
- All traffic between the applications and our servers is encrypted in transit using TLS.
- Data is encrypted at rest by our hosting provider.
- Your sign-in session on a mobile device is stored using a key held in the device's hardware-backed secure storage (iOS Keychain, Android Keystore).
- Access to records is enforced at the database level, not only in the application, so you can only reach data belonging to the organization you work for.
- Access to production systems is limited to named personnel, requires multi-factor authentication, and is logged.
- Personnel are bound by written confidentiality obligations and trained on privacy and security.
- If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the appropriate regulator as the law requires, and we keep a record of every breach for at least 24 months whether or not it is reportable.
No system is perfectly secure, and we do not claim otherwise. What we commit to is a level of protection appropriate to the sensitivity of the information, and prompt, honest notice if something goes wrong.
12. Automated access
We apply rate limits, bot detection, and other technical protection measures to the service and to our website. Restrictions on automated access, reverse engineering, and use of our materials to train AI systems are set out in Section 8 of the Terms of Service.
13. Changes to this policy
If we change this policy in a way that materially affects how we handle your information, we will update the effective date at the top, notify account holders, and — where the law requires consent for the change — ask for it. Continuing to use the service after the effective date means you accept the updated policy.
14. Contact us
Questions, requests, or complaints about privacy:
Privacy Officer privacy@mail.youfarmstudio.ca Grant Scientific Ltd., General Delivery, 704-4th Ave S, Lethbridge, AB, T1J 3Y2, Canada
We aim to acknowledge privacy requests within 2 business days and resolve them within 30 days.