Skip to main content

Privacy policy

Last updated: September 2026

1. Data controller

The controller of your personal data is the site publisher, as identified in the legal notice.

Contact: contact@spraia.app

2. Data collected

When you use the SPRAIA app and the spraia.app website, we collect the following data:

Account data

  • Email address
  • Password (encrypted, never stored in plain text)
  • Usage preferences
  • Declared city and its approximate coordinates, if you fill in that field (used for local weather)

Plant data

  • Plant photos
  • Names and descriptions
  • Growing conditions (location, exposure)
  • Care history

Connected sensor data (upcoming feature)

  • Soil humidity
  • Ambient light
  • Temperature

Usage data

  • Visited pages and used features (anonymised)
  • Device type and operating system
  • App crash reports: device model, OS version, app version and the technical error trace
  • Your device's push notification token, if you enable reminders

Community moderation data

  • Reports you submit: the reported content or user, the chosen reason and an optional comment
  • Reports made about your posts, comments or account
  • The list of users you have blocked

3. Processing purposes

Your data is used to:

  • Provide the service: plant identification, diagnosis, watering reminders, personalised advice
  • Improve the service: aggregated usage statistics to prioritise features and refine our care rules. We do not train any artificial intelligence model on your photos or your personal data
  • Communicate: service notifications, important updates
  • Measure audience: anonymised traffic statistics (with your consent)

4. Legal basis

Processing of your data is based on:

  • Contract performance (GDPR article 6.1.b): providing the SPRAIA service
  • Your consent (GDPR article 6.1.a): analytics cookies, marketing notifications
  • Legitimate interest (GDPR article 6.1.f): service improvement, security

5. Retention period

  • Active account: your data is kept as long as your account is active
  • Account deletion: your request opens a 30-day grace period during which it can still be cancelled; once it expires, your account, plants, photos, conversations and posts are permanently deleted (see the dedicated account deletion page)
  • Audit log: the deletion leaves a technical record (internal identifier and former email address) kept for our security and evidential obligations, then purged as soon as it is no longer necessary for those purposes
  • Billing data: kept 10 years (legal obligation)
  • Analytics cookies: 13 months maximum (CNIL recommendation)

6. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

  • Right of access: obtain a copy of your personal data
  • Right of rectification: correct inaccurate data
  • Right of erasure: request deletion of your data
  • Right of portability: receive your data in a structured format
  • Right of objection: object to the processing of your data
  • Right of restriction: request suspension of processing

To exercise your rights, you can:

We commit to answer your request within 30 days. In case of difficulty, you can lodge a complaint with the French CNIL or your local data protection authority: European DPA list.

7. Data security

We implement the following technical and organisational measures to protect your data:

  • At-rest encryption: AES-256
  • In-transit encryption: HTTPS / TLS 1.3
  • Restricted access: strict access controls to data
  • Passwords: irreversible hashing (bcrypt)

8. Cookies and trackers

What is a cookie?

A cookie is a small text file placed on your device (computer, smartphone, tablet) when you visit a website. It allows the site to remember information about your visit.

Cookies used on spraia.app

Name Provider Purpose Duration Type
spraia_cookie_consent SPRAIA Stores your cookie consent preferences 13 months Essential (localStorage)
spraia_locale SPRAIA Stores your language choice Permanent Essential (localStorage)
_ga Google Analytics Anonymised unique identifier to distinguish users 2 years Analytics
_ga_<ID> Google Analytics Maintains session state 2 years Analytics

Consent mechanism

On your first visit, a banner offers three choices:

  • Accept all — enables analytics cookies
  • Reject — no analytics cookie is set
  • Customise — you choose category by category

You can change your preferences at any time via the "Manage cookies" link in the site footer.

Google Analytics 4 and Consent Mode v2

We use Google Analytics 4 (GA4) for anonymised audience measurement. GA4 is configured with Google's Consent Mode v2:

  • When you reject analytics cookies, GA4 loads but writes no cookie (_ga, _ga_* are not created). Only anonymous pings are sent for statistical modelling.
  • When you accept, GA4 cookies are enabled for more accurate audience measurement.

IP anonymisation is enabled by default. No personally identifiable data is transmitted to Google.

You can also opt out of Google Analytics on all sites via the Google Analytics opt-out add-on.

9. Subprocessors and recipients

We neither sell nor rent your personal data, and we never share it for advertising purposes. The providers below act as processors within the meaning of GDPR article 28: they access your data only for the stated purpose, on our instructions and under a data processing agreement.

Provider Purpose Data transmitted Location
Anthropic PBC (Claude models) Plant identification, health scan, SOS diagnosis and conversational assistant The plant photo, its growing context (species, room, substrate, watering history) and the text of your questions United States
Hetzner Online GmbH Hosting of the application server, the database and your photos All of your account data Germany (EU)
Sendinblue SAS (Brevo) Service emails: address verification, password reset, email notifications Email address, first name France (EU)
OpenWeather Ltd Local weather forecasts (frost and heatwave alerts, watering reminder adjustments) and city lookup The city declared in your profile or its approximate coordinates — never your device's GPS position United Kingdom
650 Industries, Inc. (Expo), then Google (FCM) or Apple (APNs) Delivery of push notifications: watering reminders, weather alerts Your device's notification token, the notification content United States
RevenueCat, Inc. Subscription and in-app purchase management Subscriber identifier, purchase history, store platform United States
Functional Software, Inc. (Sentry) Detection and diagnosis of app crashes Numeric account identifier, device model, OS and app versions, technical error trace United States
Google LLC, Apple Inc., Meta Platforms, Inc. Sign-in with a Google, Apple or Facebook account — only if you choose that sign-up method Verification of the identity token issued by the provider; in return we receive your email address and name United States
Cloudflare, Inc. Hosting and delivery of the spraia.app website IP address, request headers, technical logs Global network
Google Ireland Ltd (Google Analytics 4) Website audience measurement, only after your consent Pseudonymised GA identifier, page views, anonymised IP address Ireland / United States

Notes on artificial intelligence processing

Plant identification, the health scan, the SOS diagnosis and the conversational assistant rely on Anthropic's API. When you trigger one of these features, the photo concerned and the plant's growing context are sent to Anthropic for analysis, and the result is returned to you.

  • No direct identifier is transmitted: neither your email address, nor your name, nor your account identifier accompanies the photo.
  • Your data is not used to train Anthropic's models, in accordance with its API commercial terms.
  • Nothing is sent without your action: these analyses only run when you start them from the app.

This list is kept up to date: if we change or add a provider, this page is amended and the update date at the top of the document is adjusted.

10. Data transfers

Your account data, your photos and the database are hosted in the European Union (Germany).

Some of the processors listed in section 9 are, however, established outside the European Union: Anthropic, RevenueCat, Sentry, Expo, Google, Apple and Meta in the United States, OpenWeather in the United Kingdom. These transfers rely on the safeguards set out in chapter V of the GDPR, depending on the provider: the European Commission's standard contractual clauses (article 46), an adequacy decision where one exists for the destination country — which is the case for the United Kingdom, whose adequacy decision was renewed by the European Commission in December 2025 — or participation in the EU–US Data Privacy Framework.

11. Contact

For any question regarding the protection of your personal data:

You can also lodge a complaint with the French Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr, or your local data protection authority.