GDPR Compliance

For every purpose we process personal data for, we rely on one of the following Article 6 bases:

• Performance of a contract — creating and running your account, storing and syncing your garden records, scheduling reminders, and verifying and managing your subscription.
• Consent — analysing a plant photo when you explicitly request a diagnosis. You give this consent by choosing to submit a photo, and can decline simply by not using the feature.
• Legitimate interest — keeping server logs to operate, secure and troubleshoot the service. We’ve weighed this against your privacy interests and limited it to what security and diagnostics require.
• Legal obligation — retaining subscription transaction records for as long as tax and accounting law requires.

As a data subject in the EEA or UK, you have the following rights over your personal data. Most are available directly in the app; for the rest, email us and we will respond within one month.

• Access (Art. 15) — view the personal data and garden records tied to your account directly in the app, or request a copy by email.
• Rectification (Art. 16) — correct inaccurate account or garden data directly in the app.
• Erasure (Art. 17) — delete your account and all linked garden data from Account in the app. This is immediate and permanent.
• Restriction (Art. 18) — ask us by email to limit processing of your data while a dispute about it is resolved.
• Portability (Art. 20) — export your garden data from the app at any time, in a structured format.
• Objection (Art. 21) — object to processing based on our legitimate interest by emailing us; we will stop unless we have a compelling legitimate ground that overrides your interests.
• Withdrawing consent (Art. 7(3)) — simply stop using the plant diagnosis feature. This doesn’t affect analyses already completed.

We and the providers we use — Apple, Google, OpenAI and our hosting provider — may process data outside the EEA and UK, including in the United States. Where that happens, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses (and, for the UK, the UK International Data Transfer Addendum) as the transfer safeguard.

We use the following sub-processors to run Siy. None of them are permitted to use your data for their own purposes.

• Apple — Sign in with Apple, and verification of App Store subscriptions.
• Google — Google Sign-In, and verification of Google Play subscriptions.
• OpenAI — plant photo analysis, only when you use the diagnosis feature.
• Our hosting provider — hosting of our servers and database.

Account and garden records are kept for as long as your account exists and are deleted when you delete it. Server logs and backups are retained for 90 days. Subscription transaction records are kept for as long as tax and accounting law requires. See Privacy Policy for the full breakdown.

The plant diagnosis feature uses an AI model, but it does not make an automated decision about you within the meaning of Article 22. It only returns informational suggestions in response to a photo you choose to submit; no decision with legal or similarly significant effect is made about you, and you decide what to do with the result.

Given our size and the nature of our processing, we are not required to appoint a Data Protection Officer under Article 37, and have not appointed one. Direct any GDPR-related question or request to privacy@siy-app.com.

If you believe our processing of your personal data infringes the GDPR, you can complain to the supervisory authority in the EU or UK member state where you live, work, or where the alleged infringement took place. We’d also appreciate the chance to address your concern directly first — email us at privacy@siy-app.com.

We may update this page as the app or our processing changes. When we do, we will revise the “last updated” date above.