Privacy
Last updated 22 August 2026
Cropiris photographs crops and turns the pictures into measurements: how much water is left in the root zone, what disease the leaf is showing, what to do about it. This page says what that means for the data involved — what we hold, where it physically sits, and who else receives it.
Two things worth knowing before the detail.
Every photograph you submit for identification is sent to Kindwise, a third-party classifier, because that is how the disease answer is produced. It leaves our systems.
Your data is processed in Türkiye and the imagery is stored in the European Union. Those are different places and both apply.
Who we are
Cropiris is operated by Infinity Curve. For questions about anything on this page, including a request to see or delete your data, write to [email protected].
What we collect
| Data | Why |
|---|---|
| Photographs and video of crops | The measurement itself. Vegetation indices and canopy cover are computed from the pixels; disease identification requires sending the image to a classifier. |
| Precise location | Placing a photograph in the right field, and fetching the local weather the irrigation model integrates. Without it a capture cannot be attributed to a field and the water balance cannot run. |
| Device and capture metadata | Tilt, exposure, focus and time. Used to reject captures that are not comparable with earlier ones, which is what makes a season's readings mean anything. |
| Farm and field records | Boundaries, soil type, crop and planting date. Inputs to the agronomic model. |
| Account details | Email address, name, organisation, and the role you hold on each farm. |
| Notification token | An identifier the phone’s operating system issues, so an urgent irrigation advisory can reach you without opening the app. Only if you allow notifications; declining changes nothing else, and signing out deletes it. |
| Purchase records | What credits were bought and when. Card details never reach us — see Payments. |
We do not use your imagery to advertise to you, and we do not sell it. Where we use it to improve the product, that is described under Improving the models.
Where it is processed and stored
This is not one place, and the notice would be wrong if it said “our servers”.
| What | Where | Held by |
|---|---|---|
| Application, database, advisories | Türkiye | Us, on a hosted server |
| Photographs and video | European Union | Backblaze B2 |
| Photographs sent for identification | Vendor infrastructure | Kindwise |
| Field coordinates for weather | Vendor infrastructure | Open-Meteo |
| Payment details | Vendor infrastructure | Stripe |
| Notification delivery | Vendor infrastructure | Google (Firebase Cloud Messaging) |
| Email delivery | Vendor infrastructure | Resend |
Because processing takes place in Türkiye, Turkish data protection law (KVKK) applies to it regardless of where you are. Where you are in the EEA or the UK, the GDPR applies to us as well, and the two are read together rather than one instead of the other.
Who else receives your data
These are processors acting on our instructions, not parties we sell to. Each receives only what its job requires.
| Recipient | Receives | For |
|---|---|---|
| Kindwise | The photograph itself, plus the coordinates and time it was taken | Identifying the disease. There is no way to produce that answer without it. |
| Backblaze | Photographs and video, encrypted at rest | Storage |
| Open-Meteo | Field coordinates, rounded to four decimal places | Historical and forecast weather. No account identifier is sent, so the request cannot be tied back to you by them. |
| The notification token, the field’s name and the advisory’s first line | Delivering push notifications. That text passes through Google in the clear, which is why a notification never carries a measurement or a diagnosis — only that a field needs attention. | |
| Resend | Your email address and the message | Sending verification links and account mail. We send no marketing, so this is only mail you caused. |
| Stripe | Payment details and email | Taking payment. Card numbers never touch our systems. |
Contractors and shared access
An agricultural contractor or agronomist can be granted access to a farm that is not theirs. While that grant is live they can see that farm’s captures, measurements and advisories, and depending on the role they hold they may add captures of their own.
Two consequences worth stating plainly. A capture taken by a contractor belongs to the farm it documents, so it stays with the farm when the contract ends. And revoking a grant is immediate — access ends the moment it is revoked, not at the end of a session.
Improving the models
When our classifier is unsure about a photograph, or a farmer disputes an answer, the case is reviewed by an agronomist. Their correction is kept alongside the original machine answer and used to improve future identification.
This means a small proportion of your imagery is looked at by a person, and is retained as a labelled example. If you would rather your captures were never used this way, tell us at [email protected] and we will exclude your account; it does not affect the service you receive.
How long we keep it
- Photographs and measurements — for as long as the account exists. They are a season-by-season record and their value is precisely that they go back.
- Account details — for as long as the account exists.
- Backups — encrypted, kept 30 days on the server and in offsite storage. A deleted account may persist in a backup until it ages out.
- Payment records — held by Stripe under their own retention obligations, which are independent of ours.
Your rights
You can ask us to show you what we hold, correct it, export it, restrict what we do with it, or delete it. Under KVKK you may also ask us to explain how an automated result was reached and to object to it.
Deleting your account can be done yourself, in the app or on the web, without asking us — see Delete your data, which also says exactly what is destroyed.
For anything else, write to [email protected]. We answer within 30 days. If you are not satisfied you can complain to your local supervisory authority, or in Türkiye to the Personal Data Protection Authority (KVKK).
Automated decisions
The irrigation figure and the disease identification are produced by models, not by a person. They are advice about a crop rather than decisions about you, and they carry no legal effect — but you are entitled to know how they were reached, and the app shows the working: which measurements a figure came from, how confident the classifier was, and whether a human has reviewed it.
Security
- Everything travels over HTTPS.
- Imagery is encrypted at rest by the storage provider.
- Backups are encrypted before they leave our server, with a key the storage provider does not hold.
- Passwords are stored hashed and are never recoverable, by us or anyone else.
Children
Cropiris is a tool for agricultural businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, write to us and it will be deleted.
Changes
If we change how we use your data in a way that matters, we will say so in the app rather than quietly updating this page. The date at the top always reflects the current version.