Verdalune Privacy Policy

Effective date: September 29, 2026

Verdalune is operated by DataNaat. Contact us about privacy, access, correction, or deletion at info@datanaat.com. This single policy applies to Verdalune users wherever they live. Mandatory privacy rights available to you under applicable law remain intact.

We use information to provide the gardening features you choose. We do not sell account or garden information, use it for advertising, or show a public feed. We do use technical service providers to operate accounts, synchronization, weather, purchases, notifications, and optional analytics. A photograph sent for plant identification is different: it goes to an external AI provider only after a separate affirmative choice and is subject to the special rights described below.

1. Information and purpose

Account email, sign-in identifiers, optional display name, language and settings: Create and secure your account, restore access, synchronize private records, and apply your preferences. We do not receive the password of a third-party sign-in account.
Garden names, plants, nicknames, schedules, reminders, journal entries, harvests and notes: Show and synchronize your private garden, history and care tasks. They are not public to other users.
Selected place and approximate location: Provide local weather, frost and soil information, growing zones, planting windows, seasons for your hemisphere, and relevant plant-identification suggestions.
Personal garden photographs: Display a photograph you choose for a garden or plant record. Saving one does not itself send it for AI identification. Depending on the app version and device settings, it may remain on your device and in operating-system backups.
Optional identification photograph: Obtain plant identification or visible plant-health suggestions after a separate notice and affirmative choice. See Section 3.
Purchase and subscription identifiers and status: Confirm paid access, restore purchases, provide support and prevent fraud. The app store handles card details; we do not receive your full card number.
Push token, reminders and notification preferences: Send only the reminders or service messages you enable.
Optional product-usage events: Improve usability only if you opt in. These events are configured without your name, email, account ID, location, photographs, garden content or notes.
Support messages and limited technical logs: Answer requests, protect accounts, diagnose errors and prevent abuse. Network services necessarily receive an IP address and request metadata.

Do not put passwords, payment-card numbers, identity documents or another person’s sensitive information in garden notes or support messages.

2. Location

You can select a place manually instead of giving device-location permission. A selected place is needed for local guidance; GPS permission is optional. If you permit GPS, Verdalune uses the exact coordinate momentarily in memory and rounds it to increments of 0.1 degrees before saving or sending it from Verdalune. The resulting cell is about 11 km north to south, with width varying by latitude. We do not continuously track you or request background location.

The device’s place-name service may receive the exact coordinate when converting it to a locality, or the place text you enter manually. Weather services receive the approximate cell and requested weather variables, not your Verdalune account ID from us. Approximate area may also make a voluntary plant-identification result more relevant. You may withdraw location permission in device settings; without a selected place, local features cannot work.

3. Photographs submitted for identification

Plant identification and visible health analysis are optional. Before the first upload, the app explains the transfer and requests separate affirmative consent. If you agree, Verdalune removes the photograph’s original EXIF metadata and sends the selected image, analysis type and, when relevant, an approximate location cell through our backend to an external plant-identification AI provider. We do not send that provider your account ID, email, display name or exact coordinate. The backend transmits the photograph in memory and does not keep the original; it may keep a one-way file hash, scan time and type, usage records and results.

Important rights over a submitted photograph: you keep your ownership rights, but the provider’s standard terms require a non-exclusive, unlimited and irrevocable license. The provider may retain or modify the image, use it commercially and to develop or improve AI, include it in results for other customers, and share it under Creative Commons Attribution-ShareAlike 4.0 or a later version. The provider says it blurs faces before further uses, but other visible details may identify a person or place. Photograph only the plant and submit only images you own or may authorize.

The provider makes the photograph and result available to Verdalune through its API for six months and says end-user personal data is then anonymized. Six months is not a promise that the image, copies, model improvements or the irrevocable license are erased. Withdrawing consent stops future uploads, but may not undo prior uses or licenses. We will help with an applicable privacy request when the image remains identifiable and the law requires action. You may use Verdalune without this feature and search for plants by name.

4. Who processes information

We disclose only what is needed for a requested feature or to run and protect the service:

Account and database infrastructure processes sign-in data, private garden records, approximate location and entitlement information on our behalf so information can synchronize.
Weather services receive the approximate location cell and requested variables. Their server logs may be retained for up to 90 days.
The external plant-identification AI provider receives only photographs you choose to submit and the limited scan data in Section 3, under the special license there.
App stores and a subscription processor handle purchases, receipts, subscription identifiers and entitlement status. Device platforms may handle sign-in, place names and push delivery.
An optional analytics processor receives limited usage events only after opt-in. Network information is used to make a daily identifier whose salt is discarded after 24 hours; events may be held for up to five years and cannot be selectively erased once they are no longer attributable to a person.
We may disclose information when required by valid law, to address fraud or serious security incidents, or during a lawful business transfer with appropriate protections.

These processors may handle information internationally. Where applicable law requires transfer safeguards, we use contractual and organizational measures. Contact info@datanaat.com to ask about them. We do not provide account or garden information to advertisers or use advertising identifiers or cross-app tracking. The special commercial rights for an optional scan photograph are explained in Section 3; we do not describe that transfer as a sale-free guarantee.

5. Retention and deletion

Account and private garden information is kept while your account exists or until you remove records, subject to limited legal and security retention. Verdalune does not store the exact GPS coordinate. Approximate location remains while needed for your garden; weather information organized by approximate cell may be kept for up to three years, and non-personal climate aggregates longer. Scan usage and results remain while needed for history, credits, support and security; the image-provider limits are in Section 3. Purchase, support, security and legal records are kept only as long as needed for their respective purposes or legal obligations. Push tokens remain while needed for enabled notifications. Protected backups follow their normal deletion cycle.

To request account deletion or access, correction, portability, restriction, objection or another applicable right, write to info@datanaat.com from or identifying your account email. We may verify your identity to protect the account and will explain the outcome. A completed deletion removes or de-identifies account-linked records from active Verdalune systems except information that must be retained by law or cannot be attributed to the account. It cannot necessarily recall photographs, derivatives or licenses already given to the external identification provider. Deleting your Verdalune account does not cancel an app-store subscription.

You can also use manual location, turn off notifications, decline or withdraw future photo uploads, and leave optional analytics off or disable it in Settings. Withdrawing consent does not undo processing already lawfully performed.

6. Security, age and changes

We use encrypted connections, account-based access controls, restricted service credentials and data minimization. No system is risk-free. Verdalune is intended for people aged 16 or older. If we learn that a younger person has an account, we will take reasonable steps to close it and remove information we can identify, subject to legal and provider limits.

We may update this policy as features or data practices change. We will show the current version and its effective date here and provide additional notice or request new consent when required. For questions, requests or complaints, contact DataNaat at info@datanaat.com. You may also contact a competent privacy authority when applicable law gives you that right.