Privacy policy
Last updated 1 September 2026. This explains what PlantPhrase collects, why, and who else sees it.
The short version
We collect the email address you give us and the photos and readings you send to the product. We do not sell any of it, we do not run advertising, and we do not use your photos to train models. The one third party that sees a plant photo is the vision provider that analyses it, described below.
This website
The marketing site sets no cookies and runs no analytics or tracking scripts. Our host, Vercel, keeps standard server logs (IP address, user agent, requested URL, timestamp) for operational and security purposes. We do not combine those logs with anything else.
When you submit the contact or early-access form we receive the email address you entered, your name and message if you provided them, and the topic you selected. That is delivered to our mailbox and nowhere else. We use it to reply to you and, if you asked for beta access, to contact you when a place opens.
The product
If you use the PlantPhrase application, we additionally process:
- Account details — your email address and a hashed password. Passwords are hashed with Argon2id and are never stored or transmitted in a recoverable form.
- Plant photos — the images you upload, kept against your account so you can see your own history.
- Environment readings — the temperature, humidity, leaf wetness and related measurements you or your sensors send, plus a plant location if you choose to set one.
- Derived results — diagnoses, risk scores and recommendations calculated from the above.
Who else processes your data
We keep this list short on purpose, and it is complete:
- Vercel — hosting and server logs for this website and the API.
- Zoho — our email provider. Anything you send through a form or by email is stored in that mailbox.
- Plant.id — the vision provider. Plant photos you upload to the product are sent to Plant.id to be analysed and a result returned. This is the only third party that receives your photographs.
- Open-Meteo — consulted for historical weather when a plant has a location set and sensor data is missing. It receives approximate coordinates and a date range. No account or photo data is sent.
We do not use advertising networks, data brokers, or third-party analytics.
Training
Your photos are used to answer your question. They are not a training corpus for us, and we do not license them to anyone for that purpose. Plant.id processes images under its own terms as our vision provider; if that is a concern for you, it is a fair question to ask us before uploading anything sensitive.
How long we keep it
Account data, photos and readings are kept while your account is open, because the accumulating models depend on history. Delete your account and we remove them. Form submissions and email correspondence stay in our mailbox until we have no reason to keep them. Server logs are retained on our host's standard schedule.
Your rights
Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email support@plantphrase.com and we will action it. We do not charge for this and we will not make you create an account to ask.
If you are in the UK or EU, you additionally have the right to complain to your data protection authority. If you are a resident of Texas, California, or another US state with a consumer privacy law, you have equivalent rights of access, correction and deletion, and we honour them through the same email address. We do not sell personal data or share it for cross-context behavioural advertising, so there is nothing for you to opt out of on that front.
Security
Access to data is restricted at the database level rather than by application convention: the analysis components cannot delete records anywhere, and that restriction is enforced by database grants and asserted in our tests. Traffic is served over HTTPS. No system is perfectly secure, and we will tell you promptly if something goes wrong that affects you.
Children
PlantPhrase is not directed at children and we do not knowingly collect data from anyone under 16.
Changes
If we change this policy we will update the date at the top. Material changes affecting existing users will be sent by email.
Contact
Questions about any of this go to support@plantphrase.com, or through the contact form.
PlantPhrase is operated by Jerome Francis, an individual based in Texas, United States, who is the data controller for the purposes of the UK and EU GDPR. For any privacy request, or to ask for a postal address for formal correspondence, contact support@plantphrase.com.