PlantOn j.d.o.o. za računalno programiranje
Matije Gupca 74, 31300 Beli Manastir, Hrvatska
OIB: 16675597658 · MBS: 030255445
Email: info@planton.me
Last updated: 1 September 2026.
1. Controller and scope
The controller for the website, user accounts and PlantOn digital features is PlantOn j.d.o.o. za računalno programiranje, Matije Gupca 74, 31300 Beli Manastir, Croatia, OIB 16675597658, MBS 030255445 ("PlantOn"). For privacy questions and requests, email info@planton.me with the subject "Data protection". This Policy applies to planton.me, PlantOn customer and producer applications, the administration application and connected services. A producer receiving your request acts as a separate controller for data used to contract and deliver its agricultural service, issue invoices and meet its own legal obligations.
2. Data we process
Depending on how you use PlantOn, we may process: • identity and contact data: name, email, phone and sign-in details; • profile and addresses: language, profile image, town, primary and delivery addresses; • producer data: business or farm name, tax identifier, contact and location, team permissions, verification data, IBAN for direct payments and PlantOn plan details; • service data: requests, gardens, plots, crops, activities, planting and harvest orders, deliveries, payment records, complaints and fulfilment status; • communication and support: customer-producer messages, attachments, survey responses and the name, email, topic and message submitted through the public contact form; • photos and images: garden, plant and activity photos, AI analysis images and garden camera images; • technical and security data: IP address, request date and time, device and browser type, error logs, session identifiers, push token or web-push subscription and security audit logs; • preferences and consent: language, notifications, marketing, personalised recommendations and usage analytics; • approximate garden location and weather data linked to that location. We do not request special-category data such as health data, political opinions or biometric data. Please do not include such data in free-text fields or images.
3. Data sources
Most data comes directly from you when you create an account, edit a profile, submit a request or message, upload an image, order a service or contact support. The producer may add garden and fulfilment records. If you choose Google sign-in, we receive the basic account information you approve, generally an identifier, name, email and profile image. Technical data is generated through system use and weather data comes from an external weather source.
4. Purposes and legal bases
We process data only where a legal basis applies: • contract or pre-contract steps: creating and managing accounts, displaying offers, sending requests, connecting you with a selected producer, communication, garden records, orders, delivery, support and producer plan management; • legal obligation: tax and accounting records, complaint handling, consent evidence, responses to authorities and other statutory duties; • legitimate interests of PlantOn or users: system security, fraud and abuse prevention, troubleshooting, legal claims, basic administration and service reliability improvements, after assessing that your rights do not override those interests; • consent: optional marketing, certain personalised recommendations and analytics, device push notifications and any non-essential cookies introduced in the future. You may withdraw consent at any time without affecting prior lawful processing; • vital interests or public-interest tasks only exceptionally where genuinely applicable. Where name, contact, address or payment information is necessary to conclude or perform a service, we may be unable to process the request or provide the relevant feature without it.
5. Visibility and recipients
We do not sell personal data. We disclose only what is needed to: • the selected producer and authorised team members to review requests, communicate and provide pickup, delivery or another service; • the customer where producer details are needed for offer transparency and the contractual relationship; • a delivery partner selected by the producer or customer, solely for a specific delivery; • infrastructure and processing providers: Supabase for authentication, database and storage, Render for application hosting and other technical suppliers acting on our instructions; • Paddle for purchasing and managing producer plans; PlantOn does not store full payment card numbers; • Google if you choose Google sign-in; • Expo and relevant Apple, Google or browser push services if notifications are enabled; • Open-Meteo to retrieve weather data for the garden location; • OpenRouter and the selected AI model provider when you explicitly use an AI feature; we send context needed for the answer and recommend that you do not include unnecessary personal data; • professional advisers, insurers, auditors, authorities or courts where needed for law, security or legal claims. We select suppliers with regard to security and contractually require confidentiality and processing on documented instructions where they act as processors.
6. International transfers
Some providers or subprocessors may process data outside the European Economic Area. In those cases we rely on a European Commission adequacy decision or safeguards such as Standard Contractual Clauses, transfer assessments and supplementary technical measures. You may request information or a copy of the relevant safeguard at info@planton.me.
7. Retention periods
We retain data only as long as needed for its purpose, with these more specific rules: • active account, gardens, contractual records, messages and activities: while the service is used and afterwards as needed for open obligations, statutory business-record retention and legal claims; • public contact enquiries: 24 months after receipt unless the message becomes part of a contract, complaint or legal matter requiring longer retention; • written consumer complaint records: at least one year after receipt and longer if needed for an open procedure or legal claim; • garden camera images: 90 days; the text event record may remain in garden history; • images attached to AI analyses: 12 months; analysis text may remain in garden history; • weather records: 24 months; • security audit logs: five years; • tax, accounting, billing and other business records: for the periods required by applicable law; • data based only on consent: until consent is withdrawn, except consent evidence and data retained on another legal basis. At expiry we delete, anonymise or separate data from active systems. Backups are removed through the regular overwrite cycle, with restricted access and no reuse for unrelated purposes.
8. Account deletion and anonymisation
You may request deletion through available account settings or at info@planton.me. A 14-day grace period follows during which you may withdraw the request. After it expires, the profile is anonymised: direct identifiers, street-level address data, push subscriptions, the user's message content and garden images that may show a person are removed. Records needed by the producer or PlantOn for contracts, invoices, system reliability or statutory retention may remain without a direct link to your identity. Erasure is not absolute where retention is legally required or data is needed to establish, exercise or defend legal claims.
9. Your rights
Depending on the circumstances, you have the right to: • know whether we process your data and receive access and a copy; • correct inaccurate and complete incomplete data; • request erasure or restriction; • receive data you supplied in a structured, commonly used and machine-readable format and transmit it to another controller where portability applies; • object to processing based on legitimate interests and to direct marketing at any time; • withdraw consent at any time; • not be subject to a decision based solely on automated processing producing legal or similarly significant effects, subject to statutory exceptions; • complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or another competent EU supervisory authority. Send requests to info@planton.me. We may proportionately verify identity to protect your data. We respond without undue delay, generally within one month, subject to the lawful extension for complex or numerous requests. Requests are generally free.
10. Automation and AI
PlantOn may use AI to analyse a plant image, compose an informational answer, summarise garden status or assist a producer. The output is a recommendation, not a decision with legal effect. People make final decisions on user acceptance, garden activation, cultivation, billing, complaints and account termination. Before sending content to an AI provider, we aim to limit it to the context needed for the response. Do not include personal or confidential data that is unnecessary for the AI request.
11. Notifications and marketing
Service messages about accounts, security, requests, gardens, orders or delivery are sent where needed for a contract or legitimate service administration. Optional push notifications depend on device permission and may be disabled in the app or device settings. We send promotional messages only with a valid legal basis and each electronic marketing message will provide an easy opt-out. Withdrawing marketing consent does not affect necessary service messages.
12. Security
We use appropriate technical and organisational measures, including encrypted transmission, role-based access, logging of sensitive administrative actions, backups, request rate limiting and incident-response procedures. No system is completely secure. If a personal data breach presents a risk, we will notify the authority and, where required, affected people within statutory time limits.
13. Children and images of others
PlantOn is not intended for independent contracting by people under 18 and we do not knowingly create their user accounts without appropriate parent or guardian authority. Contact us if you believe we received such data so we can investigate and remove it. Garden cameras and photos should focus on plants and the garden, not public space, neighbouring property or people. A user installing a camera or uploading an image is responsible for respecting others' privacy and providing notices or obtaining an appropriate legal basis where required.
14. Changes and contact
We may update this Policy for changes in features, suppliers or law. The new version and date will appear here and, where required, registered users will receive appropriate notice of material changes. Controller contact: PlantOn j.d.o.o. za računalno programiranje Matije Gupca 74, 31300 Beli Manastir, Croatia Email: info@planton.me Subject: Data protection