Grower Data SovereigntyGrower Data Sovereignty

Our position in plain terms

You own your orchard records. Harvora is building a data layer from grower data, and that layer is what lets Harvora's predictions get better for every grower. This statement says exactly what we may do with your data, what we will not do, and what you keep. In short:

• (a) You own the identifiable records you give us, and you can export them at any time.
• (b) We use your data to serve you, to improve Harvora, and to create de-identified aggregate data that we may license to others.
• (c) We do not sell or share your identifiable data without your authorisation, except where the law requires it, with our service providers, or in a sale or restructure of Harvora (see below).
• (d) If you do authorise sharing with a named organisation, we may be paid by it.
• (e) Data we receive from Xero is used only to serve you (see below).

This statement forms part of the Harvora Terms of Service. The Privacy Policy explains how we handle personal information. If they conflict on how data rights work, this statement applies.

What belongs to whom

Aggregate Data means data and statistics derived from many growers' records, combined and processed so that it does not reasonably identify you, your orchard, or any individual, whether on its own or in combination with other information.

How we use your data

1. To serve you

Your records power the predictions, financial projections, alerts and Ask Harvora answers you see. This is the core purpose of the platform.

2. To improve Harvora

You give us a licence to use Your Data to train, calibrate, test and improve our models and software, and to build the data layer behind them. This includes:

• (a) calibrating predictions against the outcomes growers confirm;
• (b) the grower learning loop, which proposes facts about your operation from your recent actions and chat statements for you to confirm. Xero records and the finance incidents you record are never used in the learning loop. Costs you enter in Harvora may be used to suggest your own cost rates for you to confirm; and
• (c) keeping an evidence archive and lineage records so that every prediction can be traced to the data it used.

3. To create and license Aggregate Data

You also give us a licence to create Aggregate Data from Your Data, to keep it permanently, and to use, license and commercialise it. That can include benchmarks, indices, reports, APIs and datasets licensed to third parties such as insurers, lenders, input suppliers, industry bodies, researchers, and technology and artificial intelligence companies. A licence to an artificial intelligence company can permit it to evaluate, fine-tune or train its models on Aggregate Data.

Before we release Aggregate Data, we apply controls such as the following, and we may change them as methods improve:

• (a) minimum cohort sizes, so a result never describes only a few orchards;
• (b) suppression of rare combinations of crop, variety, region and time that could point to one operation;
• (c) no ranking or naming of individual growers;
• (d) a contractual ban on the recipient re-identifying anyone or attempting to; and
• (e) revocable access for sensitive products, with usage records.

Data we receive from Xero is excluded from all of this. It is used only to provide the service to you, as the Xero section below explains.

No royalty or fee is payable to you for our use of Aggregate Data. We may offer growers other benefits, such as product capability, discounts or hardware subsidies, but these do not transfer ownership of Aggregate Data, our models or our products.

We are still building this layer. We will describe specific aggregate products in the Privacy Policy when they launch.

4. Xero data

If you connect Xero, the data we receive through Xero is used only to provide the service to you. We do not use it to train, fine-tune or improve AI models, include it in Aggregate Data, or sell, share or supply it to anyone else. Xero's developer terms do not allow us to, even in de-identified form.

When we share identifiable data

We share identifiable Your Data only:

• (a) with your authorisation, given for a named organisation, or through a specific organisation relationship that you establish and confirm in the platform. Before you decide, we will tell you who would receive the data, what data it is and why. Authorisations are recorded, appear in your data export, and can be withdrawn for each organisation separately. Withdrawal stops future sharing but cannot recall data already shared;
• (b) with service providers that process data for us under contract, such as our hosting, messaging and AI providers listed in the Privacy Policy, and, for block locations only, the public weather, satellite and map data services listed there;
• (c) when the law requires it; and
• (d) in a sale or restructure of Harvora, where the new owner must honour this statement.

If you authorise us to share your identifiable data with a named organisation, that organisation may pay us for the product or service. Without your authorisation, we do not sell or share your identifiable data, and we do not share it with insurers, banks, industry bodies, competitors or government agencies, unless the law requires it. We do not use Your Data for advertising. We do not restrict how you export your data or what format it comes in.

What you can do

Export at any time

Your account includes a data export. It downloads your orchard profile, blocks, management actions, predictions, observations, outcome confirmations, alert preferences, financial records and the record of any partner consents, as a JSON file. You do not need a reason or our permission.

Some third-party data licensed to us cannot be passed on to anyone, including you. It is used only inside our models, is not shown to you, and is not in your export. This does not limit your right to ask us for access to personal information about you under the Privacy Act 2020.

Correct

You can update your records in your account settings, or ask us at privacy@harvora.co.nz.

Leave and delete

You may ask us to delete your account at any time. Once we verify the request:

• (a) account, orchard, prediction and financial data are deleted within 30 days. Minimal alert-delivery and contact metadata may be retained for up to 24 months for audit and debugging. We may also keep records we must keep for legal, security or dispute purposes;
• (b) we recommend exporting your data first; and
• (c) Aggregate Data and model improvements that already include the effect of your data stay with us. A trained model cannot be reversed, and Aggregate Data no longer identifies you.

If you want a fact the learning loop has recorded about your operation removed, contact us and we will use reasonable efforts to remove it.

Third-party data we bring to your orchard

We combine your records with weather, satellite, terrain and soil data from public and licensed sources. This data describes land and conditions, not other growers. Source licences differ, and some limit what we may pass on, which is why parts of it stay out of exports and aggregate products. The Terms of Service list the attributions we owe, and the sources are listed at harvora.co.nz/sources.

Māori data sovereignty

Harvora recognises the principles of Te Mana Raraunga, the Māori Data Sovereignty Network. If you operate or represent a Māori-owned business, trust, collective or iwi entity and want different governance for your data, such as collective consent or restrictions on aggregate use, contact us. We will discuss it in good faith and record anything we agree on in writing. Our standard terms apply until we agree otherwise.

Changes

If we change how we may use Your Data, we will give at least 30 days' notice by email. We will not expand identifiable sharing without your consent. If you do not accept a change, you can export your data and close your account.

Contact

Email: privacy@harvora.co.nz

Mail: Harvora Limited, 368 Blockhouse Bay Rd, Auckland 0600

Export your data: Account settings, "Export orchard data"

Delete your account: email support@harvora.co.nz