Privacy Policy

1 Who we are and what this covers

Herd Farm Central ("Herd Farm Central", "we", "us") is a livestock and farm management service headquartered in Calgary, Alberta, Canada. This policy explains how we handle personal information on our public website (herdfarmcentral.com) and in the Herd Farm Central app, including its installable offline version and mobile apps.

Our customers are farm businesses, and our role depends on the information:

On a farm's behalf. For the records a farm enters about its staff, buyers, suppliers, visitors, animals and operations, we are the farm's service provider. The farm decides what to collect and why, and responds to requests from those people. If you are an employee, buyer, supplier or visitor of one of our customers, please contact that farm first. We will help them respond.
For ourselves. We are responsible for platform account data, billing data, support enquiries, security and fraud-prevention data, product analytics and error reports, and enquiries sent through our website.

Privacy contact. Our Privacy Officer is accountable for this policy and answers privacy questions, including questions about our service providers outside Canada: Privacy Officer, Herd Farm Central, Calgary, Alberta, Canada · support@herdfarmcentral.com (subject "Privacy request").

2 Information we collect

Category	Examples
Account details	Name, email address, phone number, role, profile photo and notification preferences. Passwords are stored only as a one-way hash; two-factor authentication secrets are encrypted.
Farm records you enter	Animals, breeding, health and treatments, vaccinations, weights, housing, feed, produce, batches, sales, costs, purchase orders, and the contact details of your buyers and suppliers.
Workforce and payroll records	Employee names and contact details, departments, schedules, attendance and clock-ins, leave, pay rates, payroll runs, deductions and payment history.
Security records	Patrol logs, incident reports, and visitor logs (visitor names and visit details).
Files you upload	Photos, documents, and pictures or files of paper records submitted for scanning.
Billing information	Billing name, company, email, country, plan and payment history. Payment card and bank account details are collected and processed by the payment provider; we do not store full card or bank account numbers.
Technical and usage information	IP address, approximate location worked out from the IP address, device and browser type, sign-in times, pages used, the audit log of changes you make, and error reports.
Website enquiries	The name, email address and message you send through our contact or demo forms.

3 How we use it

To provide the service: storing your records, running calculations and alerts, generating reports, and syncing work done offline.
To keep accounts secure: verifying sign-ins, spotting sign-ins from unusual devices or locations, and keeping audit logs of important actions and changes.
To send the notifications you or your farm set up, by email, SMS and push notification.
To run the AI-assisted features described in section 5, where your company has enabled them.
To answer support requests and website enquiries.
To find and fix errors and understand which parts of the app are used, so we can improve it.
To bill for subscriptions and meet our legal, tax and accounting obligations.

We do not sell personal information, and we do not use it for advertising.

We collect, use and disclose personal information with consent, which may be express or implied from the circumstances, or where the law otherwise permits or requires it. For example, we rely on what is needed to perform our contract with your farm business, to protect the security of the service, and to meet legal obligations such as tax record keeping.

A farm business that enters information about its own staff, buyers, suppliers or visitors is responsible for having the right to do so and for giving any notice the law requires.

5 AI-assisted features

If your company enables AI-assisted features, selected records, uploaded documents, or aggregated operational data may be processed by the AI providers identified below and in the feature's own notice. AI-generated results are suggestions and should be reviewed by authorized staff before use.

AI Insights (the weekly farm summary, growth prediction and feed efficiency): the relevant farm records are sent to Google (Gemini).
Bulk Animal Import and scanning paper records: uploaded files are scanned for malware first, on our own systems, and a file that cannot be scanned is refused. Their content may then be sent to Google (Gemini) and, if Gemini is unavailable, to Groq. For text files and PDFs with a text layer only the extracted text is sent; scanned PDFs go to Gemini only; photos that neither provider can read are read by text-recognition software on our own server. Records found are shown for review before anything is saved, and source files are deleted after 30 days.
Spreadsheet column matching: the column headings and a few sample rows may be sent to the AI providers to suggest how columns map to fields.

We will update this policy before adding another AI provider. AI output can be wrong. Please check it before relying on it.

6 Service providers we use

We rely on the following companies to run the service. Each receives only what it needs for its task.

Provider	What it does for us	Information involved
Supabase (on Amazon Web Services)	Main database, file storage and background functions	All account, farm, workforce and file data
Railway	Hosts the app's server	All data passing through the app
Vercel	Hosts the app's web pages and this website	IP address, device information
Upstash	Caching and sign-in rate limiting	Short-lived request data, IP address
Google (Gemini) and Groq	AI Insights, Bulk Animal Import, scanning of paper records, and spreadsheet column matching, where enabled	Farm records, uploaded files or their extracted text, and spreadsheet headings sent for analysis
Stripe and Paystack	Subscription and add-on payments	Billing name, email, company, amounts; card and bank details are handled by the payment provider, not stored by us
ClamAV (run on our own systems)	Malware scanning of uploaded import files	Uploaded files, which do not leave our systems for this
Twilio	SMS alerts and sign-in codes	Phone number, message content
OneSignal	Push notifications	Device identifier, notification content
Resend or our email host	Email alerts, sign-in codes and password resets	Email address, message content
Sentry	Error monitoring, including short screen recordings of sessions where an error occurs and a small sample of other sessions	Name, email, device information, what was on screen (everything typed into fields is masked)
PostHog	Product analytics and session recordings	Name, email, role, pages visited, clicks, what was on screen (passwords are masked)
EmailJS	Delivers messages from our website contact form	Name, email address, message
Google Fonts	Serves the fonts on our website	IP address, browser information

Session recordings. Sentry and PostHog recordings mask everything typed into form fields, including passwords and sign-in codes. Other text shown on screen, such as farm records, can appear in a recording. Recordings are used only to fix problems and improve the app, are kept for the provider's standard retention period, and cannot currently be switched off by customers. Contact us if this is a concern for your farm.

We may also disclose information when the law requires it, to protect people or animals from harm, or as part of a sale or merger of our business. In a sale or merger, we will require the recipient to protect personal information in line with this policy.

7 Where your data is stored

Herd Farm Central currently stores and processes customer data using third-party infrastructure that may be located outside Canada, mainly in the United States. This applies wherever you are, including in Canada or Nigeria.

Provider	Purpose	Where it may be processed
Supabase (Amazon Web Services)	Database, files, backups and background processing	United States
Railway	Application hosting	The region the app is deployed in, currently the United States
Vercel	Website and web-app hosting	United States and other regions of its network
Google (Gemini) and Groq	AI assistance, where enabled	United States or other regions the provider supports
Twilio, OneSignal, Resend, Sentry, PostHog, Upstash, Stripe and Paystack	Notifications, email, error monitoring, product analytics, caching and payments	Outside Canada, mainly the United States

These providers collect, use and disclose personal information on our behalf for hosting, storage, backup, authentication, notifications, payments, error monitoring, product analytics, AI assistance and support. To find out more about their policies and practices, contact our Privacy Officer at support@herdfarmcentral.com.

While your information is outside your country it is subject to the laws of the country where it is held, and courts, law enforcement or national security authorities there may be able to access it.

Nigeria. Personal information of customers or individuals in Nigeria is transferred outside Nigeria only where an appropriate basis applies under the Nigeria Data Protection Act, such as adequate protection in the receiving country, contractual safeguards, or another lawful basis.

Provider locations and services can change. We keep these lists up to date.

8 How we protect it

We use technical and organizational safeguards designed to protect customer data, including encryption in transit, access controls, tenant-scoped data authorization, multi-factor authentication for designated privileged roles, and audit logging for important actions.

Each company's data is authorized by tenant, so one customer cannot read another's.
Access is limited by role, and sign-in attempts are rate-limited.
Our support staff can see a company's account only when its owner approves, for a limited time, and that access is logged.
Audit logs record important actions and changes.

No system can guarantee absolute security. Access controls and security features depend on account configuration and supported browsers and devices. If a breach creates a real risk of significant harm, we will notify affected customers without unreasonable delay, help them meet their own notification obligations, and notify the relevant privacy authority where required.

9 How long we keep it

Different records have different retention periods. We keep personal information only as long as it is needed for the purpose it was collected for, or longer where the law, a contract, a security investigation, tax, payroll, animal-traceability or audit obligations require it. The periods below are our default periods. Your farm may be subject to longer retention rules in its jurisdiction or industry, and where local law requires longer retention, that law applies. Some periods may also be extended for a legal claim, an active investigation or a legal hold. Backups are overwritten on their normal cycle.

Records the service keeps for its own operation (sign-in sessions and security events, import source files, Trash, visitor identity details and support tickets) are deleted or anonymized automatically when their period ends. Your company's business records (financial, payroll, animal, health, traceability, pedigree and staff records) stay in your account while it is active, because they are yours; you decide when to remove them, subject to these periods. When an account ends, those records are kept for the periods below and then deleted or anonymized.

Record type	Default retention	Counted from	Notes
Financial transactions, invoices, payments, purchases, payroll output	7 years	End of the relevant financial or tax year	Supports common accounting and tax record needs
Audit logs for privileged, financial, security, health and data-export actions	7 years	Event date	Access-controlled; not editable by customers
Animal identity, movement, sale, death, breeding, treatment, vaccination and withdrawal records	7 years after the animal's exit, death or last event	Exit, death or last event	10 years where contracts, regulators or certifications require it
Animal pedigree and genetic records	10 years, or the life of the lineage plus 7 years	Last linked animal event	Kept for traceability and breeding history
Health treatment, medicine lot, protocol, quarantine and withdrawal records	7 years	Final treatment or withdrawal event	Confirmed per jurisdiction and product requirements
Pharmacy, feed-lot, inventory and recall traceability	7 years	Inventory movement date	Lot and supplier traceability is kept
Employee payroll, tax, remittance, pay slip, attendance and leave-balance records	7 years	End of the tax year or employment event	Stricter local employment rules apply where required
Employee HR profile after departure	3 years	Employment end date	Extended only for a legal claim, tax or payroll, or contractual reasons
Support tickets	3 years	Ticket closure	Unnecessary attachments are removed earlier
Security incidents, visitor logs and patrol scans	3 years	Event date	7 years for serious or open investigations
Notification delivery records (who was sent which alert, by which channel, and whether it arrived)	90 days	Send date	Deleted automatically
Sign-in sessions and device history	90 days after expiry or revocation	Session end	Security events are kept separately
Failed sign-in and security monitoring events	1 year	Event date	Longer for an active investigation
Uploaded animal-import source files	30 days	Upload date	The imported records themselves follow the animal rows above
AI prompts and source snapshots	30–90 days	Generation date	Only metadata and audit references are kept longer
AI output summaries	1–3 years	Generation date	Depends on whether they are saved as a business record
Deleted user profiles and animals moved to Trash	30-day restore period	Deletion date	Then archived or anonymized according to the records linked to them
Website enquiries and marketing leads who do not become customers	12–24 months	Last meaningful contact	Deleted or anonymized sooner on request when no lawful basis remains

When your account ends, you can export your records first; records are then kept only for the periods above and deleted or anonymized when they end.

10 Your choices and rights

Access and correction: you can ask to see the personal information we hold about you and have it corrected.
Deletion: you can ask us to delete eligible personal information. Some information may be retained where required by law, contract, security investigation, tax, payroll, animal-traceability, or audit obligations (see section 9).
Export: available records can be exported while your account is active, subject to your permissions and to retention, legal-hold, billing and security requirements: animal records, reports and movement manifests to CSV, Excel or PDF from inside the app.
Notifications: you can change email, SMS and push preferences in your profile.
Withdrawing consent: you can withdraw consent to optional uses. Some information is essential to run the service, so withdrawing it may mean closing the account.

To make a request, email support@herdfarmcentral.com with "Privacy request" in the subject, or use our contact form. We may need to verify your identity before responding, and we aim to respond within 30 days.

Concerns and complaints. If you have a privacy concern, contact our Privacy Officer first. We will acknowledge it, investigate, and tell you what we found. If you are not satisfied with our answer, you can contact your privacy regulator:

Canada: the Office of the Privacy Commissioner of Canada or, in Alberta, the Office of the Information and Privacy Commissioner of Alberta.
Nigeria: the Nigeria Data Protection Commission.
United States: residents of states with consumer privacy laws may have additional rights under those laws, and can exercise them through the same email address.

11 If you use Herd Farm Central for your farm

Farm businesses that use the service are responsible for:

collecting staff, visitor, buyer and supplier information lawfully, and giving those people any notice the law requires;
setting appropriate roles and access for their users;
responding to requests from their own staff, buyers, suppliers and visitors, with our help where needed;
keeping their records accurate; and
reviewing AI output before relying on it.

12 Cookies and browser storage

The app uses one secure cookie to keep you signed in, and stores data in your browser so you can keep working offline. Analytics and error monitoring use cookies or browser storage where enabled. Our website sets no cookies of its own and uses browser storage only for its interactive demo. We do not use advertising cookies. Our Cookie Policy lists each one.

13 Children

The service is meant for farm businesses and their staff. We do not knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.

14 Changes to this policy

If we change this policy, we will update the date at the top and tell account owners about significant changes before they take effect.