Privacy Policy

This policy applies from 1 November 2026.

1. Who we are

AgriVale is operated by AGRIVALE LIMITED, a company registered in Ireland under company number 824192, with its registered office at Venture Hub, 136 Capel Street, Dublin, D01 T2C9, Ireland.

Write to us about anything in this policy — including a request to exercise your rights — at info@agrivale.ie, or to the registered office above.

We have not appointed a Data Protection Officer. We are not required to, and no one at AgriVale holds that role. Data protection questions go to the same address as everything else.

This policy covers the AgriVale phone app, the AgriVale website and the AgriVale advisor portal. It explains what we hold, why, and what you can do about it.

2. When we are the controller, and when we act for you

There are two kinds of information in AgriVale, and the law treats them differently.

We are the controller — we decide what is collected and why — for:

• your account, your name, your mobile number and email address, and how you sign in;
• security, fraud prevention, abuse defence and our audit trails;
• support you ask us for;
• running and improving AgriVale;
• billing, if and when we start charging.

We act for you — you are the controller and we are a processor working on your instructions — for the personal data of other people that you keep in your AgriVale account. For a farmer, that is things like an employee or family member named in a task, or a supplier or customer named on a receipt or a bank line. For an advisor, it is the client book: the farmers, their contact details and the advisor's own notes about them.

Where we act for you, the Data Processing Agreement sets out the terms. It applies only to that role. For everything in the first list we are the controller, and this policy — not the Data Processing Agreement — governs it.

Your advisor is separate again. An agricultural advisor who uses AgriVale is an independent third party and is the controller of their own client records. We do not employ them, appoint them or endorse them. Section 8 explains what that means for you.

3. Where your information comes from

• From you — what you type, upload, photograph, dictate or send us.
• From your phone or browser — technical information needed to deliver the service and keep it secure.
• From the Department of Agriculture, Food and the Marine, when you use AgriVale's Department (AIM) features and we read your herd on your instruction.
• From your advisor, if you are connected to one, for the work they do with you.
• From a calendar provider, if you are an advisor and you connect your own work calendar.

4. What we collect, why, and how long we keep it

The tables below are grouped by what you are doing. "Lawful basis" is the Article 6 GDPR ground we rely on; where we rely on legitimate interests, the interest is named.

4.1 Your account and signing in

4.2 Your farm

4.3 Herd and animal records

AgriVale is not the statutory herd register. The duty to keep those records — 7 years for the bovine herd register, at least 5 years for veterinary medicine records — is yours, not ours. If you close your account we delete our copy, so export what you need first.

4.4 Documents, receipts and finance

Bank statements and receipts are among the most sensitive information we hold. We have no reason to keep them a day past the closing of your account, and we do not.

4.5 Production

4.6 Advisors, and the connection between you

4.7 Messages and notifications

4.8 Support, security and how the service runs

4.9 Subscription and payment information

We collect none. Paid billing is not switched on: there is no payment provider, no card details are taken and nobody is charged. We hold your plan, which is a setting on your farm, not payment information.

If and when charging starts, we will tell you in advance what will be collected, by whom and on what basis, and this policy will be updated first.

4.10 Marketing

We do none. We do not collect marketing consent, we do not keep a marketing list, and we do not sell, rent or share your information for anyone else's marketing.

The messages we send — codes, alerts, reminders, the morning digest, advisor messages, and service, security or legal notices — are operational. Section 4.7 covers them. You can turn the optional ones off in the app's notification settings: switch WhatsApp off entirely, limit it to critical alerts, choose rule by rule, or set quiet hours.

5. Artificial intelligence

AgriVale uses one AI provider: OpenAI, through its API. There is no other.

What we send

The de-identified farm summaries are built deliberately: the farm name, the herd number, people's names, contact details and the precise location are excluded before anything is sent.

Automatic classification of bank transactions

Where the suggested classification of a bank transaction is a confident one, AgriVale applies it automatically. It only labels what a payment was for. It never changes an amount, a date or a balance, and you can change the label at any time.

This is not a decision based solely on automated processing that produces legal effects for you or similarly significantly affects you. We do not carry out that kind of decision-making, and we do not profile you.

What OpenAI may do with it, and for how long

• OpenAI does not use content submitted through its API to train its models, under the terms and the settings that apply to our account. Data sharing for training is disabled on AgriVale's OpenAI organisation.
• Content sent to OpenAI may be retained by OpenAI for up to 30 days for abuse and misuse monitoring, after which it is deleted.
• We do not use your data to train any model of our own.

Where it is processed

For customers in the EEA, the contracting entity under OpenAI's terms is OpenAI Ireland Limited. Processing may take place outside the EEA, including in the United States. Those transfers rely on Standard Contractual Clauses approved by the European Commission.

What it means for you

AI output can be wrong, and can be confidently wrong. Check anything that matters — a figure, a date, a tag number, a withdrawal period — before you rely on it.

6. Farm information sent to the Department of Agriculture, Food and the Marine

Where you use AgriVale's Department (AIM) features, we send — on your instruction — your herd number, tag numbers, animal details and movements. No personal names are sent.

The Department is an independent controller of what it receives. It processes under its own legal obligations and its own privacy notice, not ours, and it is not our processor. Its notice for animal identification and registration is published at gov.ie.

7. Weather and maps

• Google. To place your farm for weather, we send Google's Geocoding API only the first three characters of your Eircode — the routing key, which identifies a postal district, not a dwelling — with the country. The rest of your Eircode is stored by us and is never sent to Google. Google acts as an independent controller for this, under its own terms, and geocoding requests may be processed outside the EEA.
• Met Éireann. Forecasts come from Met Éireann's open data service. Only a coordinate pair leaves our servers; no farmer identifier is sent, and there is no account or contract. Copyright Met Éireann. Source: met.ie. This data is published under a Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Met Éireann does not accept any liability whatsoever for any error or omission in the data, their availability, or for any loss or damage arising from their use.
• Open-Meteo. Supplementary weather figures come from Open-Meteo in Switzerland. Only farm coordinates are sent. Open-Meteo logs IP addresses and states its logs may contain coordinates, and deletes those logs after 90 days. Weather data by Open-Meteo.com.
• Mapbox. Map tiles are requested by your own device or browser, so Mapbox receives your IP address, our access token, the map view you are looking at, and your device or browser information. We have switched off Mapbox's optional usage telemetry. Mapbox's own required usage counting still happens, because it is how Mapbox meters the service. The Cookie and Storage Policy describes exactly what that stores in your browser. Mapbox describes itself as both our processor and, for end-user data it collects under its own product privacy policy, an independent controller — so we disclose it in both capacities.

8. Advisors, and what they can see

Your advisor is an independent controller of the records they keep about you in their own advisor account — their client book entry for you, their notes, tasks, invoices, key dates and the documents they hold.

While a connection is live, your advisor sees only what the farm owner chose to share: herd, tasks, documents, and — on Pro — compliance and finance. Your farm records are read-only to them. They cannot open the receipt, bank statement or compliance files you upload, and they cannot see your bank transactions. Finance sharing shows budgets and forecasts.

Revoking the connection ends their access immediately. But it does not erase their records, because those are theirs, not ours. If you want them deleted, ask your advisor. Email us at info@agrivale.ie and we will pass the request on and tell you we have.

We keep the record of who authorised the access, when, to what, and when it ended, for up to 6 years, so that we can show the access was lawful if it is ever questioned.

9. Who we share information with

We do not sell your information and we do not share it for anyone else's marketing.

Service providers who process on our instructions — Supabase (hosting, database, files), Vercel (application hosting), OpenAI (the AI features), Bird (WhatsApp and SMS, with the WhatsApp network behind it), Resend (email in and out), Nylas (the optional advisor calendar), Mapbox (maps) and Open-Meteo (weather). Each is named, with what it receives and where it is, on the Subprocessors page.

Others who are not our processors — the Department of Agriculture, Food and the Marine; Google (the Eircode routing key, as an independent controller); Met Éireann; the push service an advisor's browser chooses; YouTube, if you tap play on a help video; and the Irish Cattle Breeding Federation, if you follow a link to it.

Others, where we must or may — a professional adviser, an auditor, an insurer, a regulator, a court, An Garda Síochána or another public authority, where the law requires it or where we need to establish, exercise or defend a legal claim; and a buyer or successor of our business, if AgriVale is ever sold or transferred, in which case we will tell you.

10. Sending information outside Europe

Your AgriVale database and the files you upload are hosted with Supabase on Amazon Web Services infrastructure in Ireland (AWS region eu-west-1), inside the European Union. The Subprocessors page lists each provider's location.

Hosting in Ireland does not mean that nothing ever leaves the EEA. Supabase contracts through a Singapore company, and its support, administration and its own sub-processors may access data from outside the EEA; some of our other providers process in the United States. Where that happens, the transfer relies on Standard Contractual Clauses approved by the European Commission, together with the additional measures those clauses require, unless the country has an adequacy decision — Switzerland does.

In particular:

• Email in and out is stored in the United States by Resend. That includes the emails you send to your farm's AgriVale address and their attachments. Transfers rely on Standard Contractual Clauses.
• AI processing is contracted with OpenAI Ireland Limited but may take place outside the EEA, including the United States, under Standard Contractual Clauses.
• Map tiles come from Mapbox in the United States, under Standard Contractual Clauses.
• WhatsApp and SMS are handled by Bird B.V. in the Netherlands, on its EU region — an intra-EEA relationship. Bird's own onward transfers are covered by its Standard Contractual Clauses. WhatsApp messages are delivered over the WhatsApp network operated by WhatsApp Ireland Limited, under its own terms with the person receiving them.
• The advisor calendar, where an advisor connects one, is handled by Nylas on its European service, which Nylas documents as hosted in the United Kingdom. The UK has an adequacy decision.

You can ask us for a copy of the safeguards that apply to a particular transfer.

11. How long we keep information

The tables in section 4 give the period for each kind of information. These are the periods we keep information for no longer than, and we reduce or delete sooner where we no longer need it.

Where an audit record needs to be kept, we reduce it rather than keep it whole: we strip the personal details and keep the event and the time.

Our routine encrypted database backups are not edited account by account. Deleted data leaves them as they are overwritten, within 7 days. The files you upload are not held in those database backups at all — they are deleted from storage when you close your account.

12. Security

We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access controls that keep each farm's data to that farm, separate storage for uploaded files with access only through authenticated, time-limited links, one-time codes rather than passwords for farmer sign-in, an additional verification step before Department submissions, and logging of sensitive actions.

No online service can be made perfectly secure, and we do not claim that ours is. If a breach of your personal data is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, and we will notify the Data Protection Commission where we are required to.

13. Your rights

Under the GDPR you have the right to:

• be told what we hold and why — this policy;
• get a copy of your personal data (access);
• correct it if it is wrong (rectification);
• have it deleted (erasure), where one of the grounds in the GDPR applies;
• restrict what we do with it while something is being sorted out;
• receive it in a portable form, and have it sent to another provider where that is technically feasible;
• object to processing we base on legitimate interests, on grounds relating to your situation;
• withdraw consent, where we relied on consent — an advisor's web-push opt-in, an advisor's calendar connection, camera or microphone permissions on your device, and tapping play on a help video. Withdrawing it does not undo what was done before;
• complain to the Data Protection Commission.

How to exercise them. Email info@agrivale.ie. We handle these requests by email — there is no automated process. We respond within one month, and can extend that by up to two further months for a complex request, in which case we will tell you inside the first month and say why. We may ask you to confirm your identity before we act.

What the app can already do for you. You can edit most of your information in the app. You can download exports — a receipts-and-documents ZIP, a money-out CSV, farm accounts as a PDF, a printable compliance report, a milk and weights CSV, and a Bord Bia audit report from the phone. Each covers what it says and no more; none of them is a complete copy of everything we hold. You can delete your farm account yourself from settings, on the web or on the phone.

Requests about what your advisor holds go to your advisor, because they are the controller of those records. Tell us and we will pass the request on and confirm that we have.

Complaints. We would like the chance to put something right first, so please tell us. You can also complain at any time to:

Data Protection Commission 6 Pembroke Row, Dublin 2, D02 X963, Ireland www.dataprotection.ie

14. Children

AgriVale is for farmers, farm businesses and agricultural advisors. It is not directed at children and you must be 18 or older to hold an account. We do not knowingly collect information about children. If you believe a child's information is in AgriVale, tell us at info@agrivale.ie and we will remove it.

Be careful about recording another person's details — including a family member's — in a task, note or document, and only do so where you have a proper reason.

15. Changes to this policy

We may update this policy. When we do, we publish the new version here with a new version number and a new effective date.

Where a change materially affects how we use your personal data, we will tell you in advance and ask you to accept the updated policy. We will not treat continued use as agreement to a material change. Where we ever want to do something that needs your consent, we will ask for it first.

16. Contact

AGRIVALE LIMITED Venture Hub, 136 Capel Street, Dublin, D01 T2C9, Ireland Company number 824192 info@agrivale.ie