Privacy Policy

Harvora Limited ("Harvora", "we", "us", "our") operates the Harvora platform at harvora.co.nz. This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the New Zealand Privacy Act 2020.

1. Information we collect

1.1 Account information

When you create a Harvora account, we collect:

• Full name
• Email address
• Phone number (optional, for SMS alerts)
• Password (managed by our authentication provider, Clerk)

1.2 Orchard and block data

When you set up your growing operation, we collect:

• Orchard name and address
• Block boundaries (geographic polygons drawn or confirmed by you)
• Crop type, variety, and planting year per block
• Protection action cost assumptions (e.g., wind machine cost, frost cloth cost)

1.3 Management action records

When you log management actions, we collect:

• Action type, date, cost, and block
• Decision records (which recommended action you chose)

1.4 Financial data (Xero integration)

If you connect your Xero account, we receive read-only access to:

• Revenue and expense records
• Account categories and transaction details
• Supplier invoices relevant to orchard operations

We do not store your Xero credentials. Authentication uses OAuth 2.0 tokens managed securely.

1.5 Usage data

We collect standard usage information:

• Pages visited and features used
• Device type and browser
• IP address and approximate location
• Session duration and interaction patterns

1.6 Data we derive

From your orchard data and public data sources, we derive:

• Elevation, slope, aspect, and soil type for your blocks (from LINZ and Smap)
• Satellite vegetation indices (NDVI from Sentinel-2 / Copernicus)
• Weather observations and forecasts attributed to your blocks (from NIWA, Open-Meteo, MetService)
• Probabilistic predictions (frost risk, disease pressure, yield trajectory, irrigation need)
• Financial projections (expected revenue, losses, cash flow)

1.7 Public website enquiries and measurement

When you first arrive on our public website, we may keep a short attribution record in your browser's session storage. It contains the landing page, a broad source category, permitted campaign labels, and the time you arrived. It does not use any visitor ID. It also excludes cookies, account or orchard IDs, full referrer URLs, and precise location, and it is ignored after 24 hours or when the browser tab closes.

If you send an enquiry, your name, email address, organisation, and message are used to deliver and respond to that enquiry. Contact details are not copied into analytics. We retain only a qualified enquiry event with the broad attribution described above. If you book through Cal.com, Cal.com processes the booking details and Harvora counts a booking only after receiving a verified completed-booking notification.

2. How we use your information

We use your information to:

• Provide the Harvora service: generate predictions, financial projections, and recommendations for your orchard
• Send alerts: SMS and email notifications when prediction thresholds are breached or decisions are recommended
• Improve our models: use de-identified, aggregated data across all users to improve prediction accuracy and calibration
• Communicate with you: service updates, onboarding guidance, and support
• Maintain security: detect and prevent unauthorised access or abuse

We do not sell your personal information. We do not use your data for advertising.

3. Legal basis for processing

Under the New Zealand Privacy Act 2020, we collect and process your information because:

• It is necessary to provide the Harvora service you requested (Information Privacy Principle 1)
• Collection is directly from you or with your knowledge (IPP 2 and 3)
• We use it only for the purposes described in this policy (IPP 10)

4. Who we share your information with

We share your information only with:

We do not share your orchard data, predictions, or financial information with any third party for their own purposes. We do not share data with insurers, banks, industry bodies, or government agencies unless you explicitly consent or we are required by law.

5. Data retention

• Account and orchard data is retained while your account is active. On account deletion, account, orchard, prediction, and financial data are deleted within 30 days
• Prediction history remains available while your account is active. Expired raw forecast inputs and Monte Carlo samples may be pruned under operational retention schedules after derived summaries are preserved
• Alert delivery records are limited to minimal alert-delivery and contact metadata; this metadata may be retained for up to 24 months for audit and debugging
• Qualified website conversions contain no contact details and are retained for up to 24 months; rejected enquiries are not retained in measurement records
• Search and citation snapshots contain authorised, aggregated performance measurements and are retained for up to 36 months. Versioned GEO benchmark results are retained for longitudinal comparison and do not contain the provider's full answer text
• De-identified aggregate data already incorporated into model calibration is retained after account deletion
• Xero data is deleted when you disconnect the integration or delete your account

6. Your rights

Under the Privacy Act 2020, you have the right to:

• Access your personal information: request a copy of all data we hold about you
• Correct inaccurate information: update your details at any time through the account settings or by contacting us
• Export your data: use the data export feature in your account to download your orchard profile, blocks, management actions, predictions, and financial data in JSON format
• Delete your account: contact us to request account deletion; account, orchard, prediction, and financial data are deleted within 30 days. Minimal alert-delivery and contact metadata may be retained for up to 24 months for audit and debugging

To exercise any of these rights, email privacy@harvora.co.nz.

7. Data security

We protect your information with:

• Encryption in transit (TLS/HTTPS on all connections)
• Encryption at rest (Neon database encryption)
• Role-based access control within orchards (Owner, Manager, Viewer)
• JWT-based authentication with secure session management
• No plaintext storage of passwords or API keys
• Admin access is logged and visibly indicated in the interface

8. Cookies

Harvora uses essential cookies for authentication and session management. Where enabled, Better Stack browser telemetry records errors, performance, and session interactions for security and service improvement; it is not used for advertising. We do not use third-party advertising cookies.

9. International data transfers

Your data is processed on servers in the United States (Railway, Vercel, Neon) and may transit through other jurisdictions. We ensure all service providers maintain appropriate security standards. New Zealand's Privacy Act 2020 requires that personal information transferred overseas receives comparable protection.

10. Children's privacy

Harvora is a professional agricultural tool and is not directed at children under 16. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the address on your account and noted on this page with an updated effective date. Continued use of the service after changes constitutes acceptance.

12. Contact us

If you have questions about this Privacy Policy or wish to exercise your rights:

• Email: privacy@harvora.co.nz
• Mail: Harvora Limited, 368 Blockhouse Bay Rd, Auckland 0600

If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.