HeyPlant Privacy Policy

Effective Date: August 11, 2026

This Privacy Policy explains how Sanae Karmous, trading as Zaad (registered with the Belgian Crossroads Bank for Enterprises under number BE 0797.185.986, referred to in this policy as "Zaad," "we," "us," or "our"), collects, uses, shares, and protects personal data when you use the HeyPlant mobile application (the "App" or "Service").

We are established in Belgium, and we act as the data controller for the personal data described in this policy under Regulation (EU) 2016/679 (the "GDPR").

If you have any questions about this policy or about how we handle your personal data, contact us at nodesend0@gmail.com.

1. Personal Data We Collect

1.1 Account information

When you sign in with Google, we receive and store:

• Your email address (if shared by Google)
• Your name (if shared by Google)
• A unique identifier issued by Google for your account

1.2 Plant identification photos

When you take or upload a photo to identify a plant, that photo is sent to PlantNet (see Section 3) to generate identification results. If you choose to save an identified plant to "My Plants," the photo and the resulting information (species name, your custom nickname, care notes, and the timeline of care events you log — watering, fertilizing, repotting, pruning, and any notes you add) are stored on our servers, linked to your account.

1.3 Subscription and purchase information

If you subscribe to HeyPlant Pro, your purchase is processed directly by the Google Play Store — we never receive or store your payment card details. We do receive, via our subscription infrastructure provider RevenueCat (see Section 3), non-financial information about your subscription status (e.g., which plan you're on, whether your trial or subscription is active, and renewal/expiration dates) so the App can unlock the correct features for your account.

1.4 Information that stays only on your device

The following data is stored locally on your device using your device's local storage and is not transmitted to or stored on our servers:

• Your recent identification history (the last few plants you've identified)
• Care reminders you set and their notification schedule

Because this data never leaves your device, we have no access to it, cannot recover it if you lose your device, and it is not affected by deleting your HeyPlant account on our servers.

1.5 Technical and usage information

To operate the Service, our servers automatically process standard technical information transmitted by your device when it communicates with our backend (such as IP address and request timestamps) for security, debugging, and abuse-prevention purposes. We do not use third-party analytics, advertising, or tracking SDKs in the App — we do not sell, and have never sold, personal data to advertisers or data brokers.

2. How and Why We Use Personal Data (Legal Bases)

Under the GDPR, we rely on the following legal bases for each purpose:

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

3. Who We Share Data With

We share limited personal data with the following categories of recipients, only as necessary to provide the Service:

• PlantNet — the photo you submit for identification is sent to PlantNet's API to generate species matches. PlantNet is operated by a French research consortium (Cirad, INRAE, Inria, IRD, and CNRS jointly with the Tela Botanica association). See PlantNet's own terms for how they process submitted images.
• OpenAI — the first time any user identifies a plant species that isn't yet in our catalog, we send the plant's species name (not your photo, and not any personal data about you) to OpenAI's API to generate general care-guide text for that species, which is then stored in our shared catalog for all users.
• RevenueCat — our subscription management provider, which receives purchase and entitlement data from Google on our behalf so we can determine whether your account has active Pro access.
• Google — when you sign in or subscribe, Google processes the underlying authentication or payment transaction according to its own privacy policy.
• Hosting and infrastructure providers — we use reputable third-party cloud infrastructure providers to host our database and backend servers, including infrastructure located in the European Union, solely to operate the Service on our behalf.

We do not sell your personal data. We do not share your personal data with advertisers or data brokers.

International transfers

Some of the providers above (including OpenAI and RevenueCat) are based in the United States. Where we transfer personal data outside the European Economic Area, we rely on the safeguards available under GDPR Chapter V, such as those providers' adherence to the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

4. Data Retention

• Account and saved-plant data is retained for as long as your account is active.
• If you delete your account through the in-app "Delete Account" feature, your account, saved plants, care history, and related data are deleted immediately from our live database. Deleting your account does not automatically cancel an active Google Play subscription — you must cancel that separately through Google Play, as explained in-app.
• Locally-stored data (recent identifications, reminders) is deleted when you delete the App from your device, or can be removed at any time by clearing the App's local data.

5. Your Rights

If you are located in the European Economic Area or the United Kingdom, under the GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Erase your personal data (also available directly in-app via Delete Account)
• Restrict or object to our processing of your personal data
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, Belgium — www.gegevensbeschermingsautoriteit.be — or with the supervisory authority of your own EU member state.

To exercise any of these rights, email nodesend0@gmail.com. We will respond within the timeframes required by applicable law.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the "sale" or "sharing" of personal information — we do not sell or share your personal information as those terms are defined under California law
• Not be discriminated against for exercising these rights

To exercise these rights, email nodesend0@gmail.com.

6. Children's Privacy

HeyPlant is not directed at children under 13, and you must be at least 13 years old to use the App. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us at nodesend0@gmail.com and we will delete it.

7. Data Security

We take reasonable technical and organizational measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including encrypted transmission of data between the App and our servers and secure storage of your authentication credentials on your device. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by other reasonable means before the change takes effect. The "Effective Date" at the top of this policy indicates when it was last revised.

9. Contact Us

Sanae Karmous, trading as Zaad KBO/BCE: BE 0797.185.986 Belgium

Email: nodesend0@gmail.com