← Back to Organic Assistant

Privacy Policy

Last Updated: August 5, 2026

1. Introduction

Harrow Software LLC ("we," "our," or "us") operates Organic Assistant (organicassistant.app), a conversational AI tool that helps farmers, inspectors, and organic stakeholders with organic certification and farm recordkeeping.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including our web application and Telegram bot (FieldAgent).

2. Information We Collect

2.1 Information You Provide

  • Account Information: When you create an account, we collect your name, email address, and password.
  • Profile Information: Optional details such as your role (farmer, inspector, etc.), state, and organic certification status.
  • Chat Content: Questions and conversations you have with Organic Assistant about organic farming and certification.
  • Farm Records: Farm activity data you enter in the app or capture through FieldAgent (our Telegram bot), including planting records, harvest logs, purchases, inventory, and related notes.
  • Sample Downloads: If you request our sample Organic System Plan, we store the email address you enter, the page you were on, and any campaign parameters in the link you arrived from. We may use that address to send occasional OSP tips, with an unsubscribe link in every message. We keep that record until you delete an account using that address or ask us to erase it.
  • Uploaded Documents and Files: Spreadsheets, CSVs, PDFs, scanned or photographed paperwork, invoices, and saved emails that you upload to import records or attach to an Organic System Plan (OSP) section.
  • Photos and Voice Memos: Images and audio you send to FieldAgent or record in the app, plus the text transcribed from them.
  • Emailed Records: Messages and attachments you send to our records@ and fieldagent@ addresses.
  • OSP Content: The answers, narratives, and drafts you and the assistant produce while building your Organic System Plan.

2.2 Information Collected Automatically

  • Usage Data: Information about how you interact with our services, including pages visited, features used, and session duration.
  • Device Information: Browser type, operating system, and device identifiers.
  • Analytics: We use PostHog for product analytics to improve our service.

2.3 Information from Third Parties

  • Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google.
  • Telegram: If you use FieldAgent, we receive your Telegram username and messages sent to the bot.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process and respond to your questions about organic certification
  • Store and organize your farm records and activity logs
  • Sync data with Google Sheets when you authorize this integration
  • Send you service-related communications
  • Extract farm records from the documents, photos, voice memos, and emails you send us, and draft OSP sections from your own records
  • Analyze usage patterns to improve our AI responses and user experience
  • Comply with legal obligations

3.1 What We Do Not Do With Your Data

  • We do not use your content to train AI models. Your questions, records, documents, photos, and voice memos are sent to our AI providers only to process your own request, and we use those providers under terms that do not permit them to train their models on it.
  • We do not sell your personal information or your farm data, and we do not use it for advertising.
  • We do not share your farm data with your certifier, or with anyone else, unless you ask us to — other than the service providers listed below, who process it on our behalf to run the service. Nothing is submitted to a certifier automatically.

We do review individual conversations, answers, and extraction results through our own monitoring tools when we are diagnosing a problem or checking quality, and we use real examples from submitted content to measure how accurately the service reads documents and answers questions. This is human and service review, not model training.

4. Files, Documents, and Media You Upload

When you import documents, attach a file to an OSP section, or send a photo, voice memo, or email to FieldAgent, this is what happens to that file:

  • Where it is stored: The file itself is stored in Google Cloud Storage, in a bucket we control that is not open to the public. The records, transcripts, and text extracted from it are stored in our PostgreSQL database, hosted by Neon.
  • How it is linked from your spreadsheet: When a record is written to your farm's Google Sheet, any attached photo or document is referenced by a time-limited link that opens the file without a further sign-in. Those links currently last seven days, so anyone you share that sheet or link with can open the file during that window.
  • Who processes it: Google (Gemini) reads documents, photos, and scans to extract farm records, and transcribes the voice memos you send to FieldAgent. OpenAI transcribes voice notes you record in the web app, and generates the search embeddings used to find relevant regulations. Anthropic (Claude) drafts answers and OSP sections from the resulting text. Resend delivers and receives email, including anything you send to our records@ and fieldagent@ addresses.
  • What it is used for: Only to build your records, draft your plan, and answer your questions — see "What We Do Not Do With Your Data" above.
  • How long it is kept: This depends on where the file came from, so it is set out case by case in "Data Retention and Deletion" below. Files captured through FieldAgent are kept as an audit trail and are not currently on an automatic deletion schedule.

5. Farm Accounts and Shared Access

Farm data belongs to the farm, not to an individual login. Anyone you add as a member of your farm — through a farm invite or by linking a Telegram chat to the farm — can see that farm's records, uploaded files, and OSP content, and can add or edit records attributed to them.

Records captured in a linked Telegram group chat are visible to everyone in that chat, because that is how the chat works. Removing a member, or unlinking a chat, stops future access; it does not retroactively unsend what they already saw.

If you delete your account while other members remain on a shared farm, that farm's records and uploaded files stay with the farm and your personal attribution is removed. Your own Organic System Plans are an exception: they belong to you, so they are deleted with your account even on a shared farm, and the remaining members lose access to them. If you are the only member, the farm and its data are deleted with your account.

6. Third-Party Services

We use the following third-party services to operate Organic Assistant:

  • Google Cloud: Authentication (OAuth), Google Sheets and Drive integration, AI services (Gemini) for extracting records from documents and photos and for transcribing voice memos sent to FieldAgent, and Cloud Storage for the files and media you upload
  • Anthropic: AI language model (Claude) for answering certification questions and drafting OSP sections
  • OpenAI: Voice memo transcription and the search embeddings used to retrieve relevant regulations
  • Resend: Sending transactional email (sign-in links, verification, notifications) and receiving email sent to our records@, fieldagent@, and contact addresses
  • Neon: PostgreSQL database hosting
  • Vercel: Web application hosting
  • Railway: Backend service hosting
  • PostHog: Product analytics. This includes session replay, which records what happened on screen as you use the app, and it attaches your email, name, and profile details to your activity so we can support your account
  • Langfuse: AI observability and response quality monitoring
  • Sentry: Error and performance monitoring. Error reports can include the part of a question, draft, or email address involved in the failure
  • Upstash: Redis queueing and rate limiting, which briefly holds messages in transit
  • Telegram: FieldAgent bot platform

These services have their own privacy policies governing their use of your data.

7. Google User Data

When you connect your Google account, we request access to:

  • Basic profile information: Your name and email address for account creation and authentication
  • Google Drive & Sheets: Access to files and spreadsheets created by the app for managing your farm records. We can only access files the app itself creates — we cannot see or modify any other files in your Drive.

We only access Google data that you explicitly authorize. We do not access your Gmail, Calendar, or other Google services. You can revoke access at any time through your Google Account settings.

Google API Services User Data Policy: Organic Assistant's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only use Google user data to provide and improve the farm recordkeeping features visible in the app
  • We do not transfer Google user data to third parties except as necessary to provide or improve the app, comply with applicable laws, or as part of a merger or acquisition with adequate data protection
  • We do not use Google user data for serving advertisements
  • We do not allow humans to read Google user data unless we have your affirmative consent, it is necessary for security purposes, to comply with law, or the data is aggregated and anonymized for internal operations

8. Data Retention and Deletion

We retain your information for as long as your account is active or as needed to provide you services. You can delete your account yourself from your account settings, or contact us to request deletion of specific data.

  • Account data is retained until you delete your account
  • Chat history is retained to provide conversation continuity
  • Farm records are retained as long as needed for your recordkeeping purposes
  • A record you delete is hidden from the app immediately and can be restored. We keep the hidden entry so that restore stays possible, and it is erased when the farm it belongs to is deleted
  • Import files you upload but never confirm expire after 24 hours and are removed by our daily cleanup job on its next run
  • A file you delete from a record is erased from our storage right away, unless the same file is still attached to another record — in that case the stored copy stays until the last record using it is gone. If instead you delete the record itself, its files are erased 30 days later
  • An OSP section attachment you delete is hidden immediately and erased from our storage 30 days later by the same cleanup job
  • Photos, voice memos, and documents captured through FieldAgent are kept in our storage as an audit trail and are not currently on an automatic deletion schedule. Deleting the record they produced, the farm, or your account removes them from the app, but the stored original may remain. If you want those originals erased, email us and we will remove them

Deleting your account is permanent and immediate — there is no recovery window. It deletes your profile, chat history, Organic System Plans, and any farm where you are the only member, including that farm's records and uploaded files. Farms you share with other members are preserved for them, with your personal attribution removed — including any records you deleted before leaving, which stay hidden with the farm. We erase the underlying stored files as part of the same deletion. If a file cannot be reached at that moment, OSP attachments are retried automatically by the daily cleanup job; for other file types the failure is logged for us to clear by hand, so a stored copy can survive until we do. Media captured through FieldAgent is covered by the bullet above.

Backups and third-party service logs may retain copies for a short period after deletion before they age out on their own schedules.

9. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

  • Encryption of data in transit (HTTPS/TLS)
  • Encryption at rest: our database (Neon) and file storage (Google Cloud Storage) encrypt the data they hold on disk
  • Secure password hashing (bcrypt)
  • Access controls and authentication: records and plans are scoped to the farm they belong to, and are visible only to that farm's members — see "Farm Accounts and Shared Access" above for who that includes
  • Human review before an AI-extracted record counts as approved: it stays marked pending until someone on the farm approves it, and the approval time is recorded
  • Regular security reviews

A plain-language version of this list is on the About page. Deletion is covered in "Data Retention and Deletion" above, and export in "Your Rights" below.

10. Your Rights

Depending on your location, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Delete your personal information
  • Export your data in a portable format
  • Opt out of analytics tracking

To exercise these rights, contact us at the address below. You do not have to wait on us for two of them: you can export your records and your Organic System Plan yourself from within the app at any time, and you can delete your account yourself from your account settings.

11. Children's Privacy

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Harrow Software LLC
Email: privacy@organicassistant.app