Legal
Privacy Policy
Last updated: [date — set when the company entity is confirmed]
1. Data controller
[Company name] is the data controller for personal data processed on this platform. Enquiries about personal data can be sent to [email].
2. What we process
Enquiry forms: name, email address, organization, optional phone number and your message — used solely to respond to your enquiry.
Partner portal accounts (invitation-only): name, email address, login sessions and the organization membership needed to show your organization's projects.
Technical data: system logs necessary for operation and security. Anonymous form submissions are protected by a captcha (Cloudflare Turnstile) and rate limiting; rate-limit records never store raw IP addresses.
3. Purpose and legal basis
We process this data to respond to enquiries, to operate the partner portal under our agreements with partner organizations, to meet legal obligations, and to keep the platform secure.
4. Processors
We use the following processors: Neon (database), Vercel (hosting), Cloudflare (R2 file storage and Turnstile captcha), Sanity (public site content — never personal data) and Resend (email delivery). Transfers outside your jurisdiction rely on appropriate contractual safeguards.
5. Safety-sensitive data
Because of the operating context, we treat precise project locations, farmer and household identities and staff details as safety-sensitive. They are never published; public pages show approximate locations only.
6. Retention and deletion
Enquiries are kept while we handle them and for a reasonable follow-up period. Portal account data is kept while the account is active; records required by law are kept as required.
7. Cookies
We only use strictly necessary cookies: a session cookie for signed-in portal users and a locale preference. No tracking, analytics or marketing cookies.
8. Your rights
You have the right to access, rectify and erase your data, and to restriction, portability and objection. Write to [email] to exercise your rights; you may also complain to your local data protection authority.