Draft for closed beta. Legal counsel must review before public launch.
Privacy Notice
Version 2026-10-17
This notice factually describes how Deep Garden processes personal data during the closed beta. It is not a certification of LGPD or GDPR compliance.
Who controls the data
Deep Garden is the controller for user accounts, scientific community identity, and product telemetry. Cultivation operations run in the context of the member’s organization.
Privacy contact (placeholder until counsel confirms): privacy@deepgarden.ai.
Data we process
Account and authentication (email, name, username, session).
Community profiles, cultivation journals, experiments, posts and comments, according to the audience you choose.
Sensor readings and cycles linked to your organization.
Support tickets, billing data (via Stripe), and if you use Copilot, prompts and selected context sent to the configured AI provider.
Product analytics (console) and, on the public site, marketing analytics only with your consent.
Purposes and bases
Providing the grow and community service: contract.
Security, abuse prevention, and essential product diagnostics: legitimate interest.
Non-essential cookies and scripts on the public site: consent.
Optional Copilot use: sending a message authorizes processing that content with the AI provider.
We do not use a single blanket consent for cultivation records.
Publishing and privacy by default
New journals, entries, experiments, and posts start private. Making content public requires an explicit action and a preview of what will be exposed.
Internal organization, space, and cycle identifiers must not appear on public surfaces.
Licensed protocols and AKB documents follow marketplace rules, not only community audience.
Your rights
You may request access, correction, deletion, portability, objection, and withdrawal of consent, as applicable, from the account privacy area (authenticated) or privacy@deepgarden.ai.
Default response window: 15 days. Deletion is not immediate or unconditional when legal, security, billing, or public scientific-record retention applies.
Transfers and processors
We may use cloud hosting, object storage, Stripe, PostHog, Google Analytics (site, with consent), and OpenAI-compatible AI APIs. Internal processor inventory holds operational detail.
We do not assert that GDPR applies to every user; territorial scope is for counsel to decide.
Retention and account closure
Sensor series follow technical policies (e.g. raw ~90 days). Copilot threads can be deleted by you or during account anonymization.
On closure, after a confirmation window, we anonymize identity; public posts may remain as a scientific record authored as “Removed member”, unless you request removal and no mandatory hold applies.