Last updated 23 August 2026

Privacy Policy

This policy explains in plain English how MyGarden Assistant handles information when you create an account, save garden records, ask gardening questions, upload plant photos, or manage a subscription.

Information we collect

• Account information: your email address, authentication details managed by Supabase, and identifiers needed to keep your account secure.
• Garden information: gardens, locations, planting records, varieties, dates, quantities, notes, activities, and harvest information you choose to save.
• Questions and messages: the gardening questions and conversation context you submit so the assistant can respond.
• Plant photos: images you upload for identification, diagnosis, or other gardening help.
• Subscription information: Stripe customer and subscription identifiers, subscription status, and billing-event information. MyGarden Assistant does not receive or store your full card details.
• Security information: limited technical information such as request identifiers, IP-derived rate-limit identifiers, security events, and usage metadata used to prevent abuse and operate the service.

How we use information

We use this information to provide gardening responses and photo analysis, maintain your saved garden records, authenticate your account, manage paid access, protect the service from misuse, troubleshoot problems, and improve reliability.

Plant photos and gardening requests

Uploaded photos are processed for the current request. MyGarden Assistant does not intentionally save uploaded garden photos in its own database or storage. Compact botanical observations may be retained in the current conversation so you can ask follow-up questions without resending the image. Processing by an external service provider is subject to that provider's handling and retention arrangements.

Questions, conversation context, and relevant saved garden records may be sent to service providers that generate the requested response. Do not upload sensitive personal information in messages, garden notes, or photos.

Cookies, guest sessions, and QR links

MyGarden Assistant uses an essential first-party signed anonymous session cookie to maintain guest usage and session continuity and to help protect the service from abuse. It may remain on your device for approximately one year.

Some first-party QR links may record a simple source label, such as a market, shop, or nursery label, so NZ Veggie Plants can understand generally where visitors came from. The label may be stored in a first-party cookie for up to approximately 90 days. It is not used as your identity and is not supplied to gardening-assistant prompts.

For security, abuse prevention, and service limits, we may process technical information such as IP-derived identifiers, anonymous session identifiers, and usage counters. These controls do not require us to intentionally retain raw chat messages or uploaded photos as quota records.

Service providers

We use trusted service providers to operate MyGarden Assistant:

• Supabase for authentication and the database that stores account-linked garden records and subscription status.
• Stripe for Checkout, recurring payments, billing events, and subscription management.
• OpenAI to process gardening conversations and prepare responses.
• Google Gemini to analyse newly uploaded gardening photos.
• Upstash for rate limiting, concurrency protection, and abuse prevention.
• Vercel for application hosting and delivery.

These providers process information under their own terms and privacy practices and may process data outside New Zealand.

Security and retention

We use reasonable technical and organisational safeguards, including authenticated sessions, access controls, database row-level security, request validation, rate limiting, and encrypted HTTPS connections. No online service can guarantee absolute security.

We may retain account and My Garden information while your account remains active and as reasonably necessary to provide the service, protect its security, prevent abuse, maintain billing records, and meet legal obligations. Cancelling a paid subscription does not itself delete your free My Garden records. Provider logs and billing records may follow the providers’ own retention requirements.

Your choices and rights

You may ask to access, correct, or delete personal information we hold about you by using the contact email below, subject to legal or operational retention requirements. A deletion request may require relevant records held across our service providers to be handled as appropriate. You can also cancel your subscription through subscription management. Deleting an account does not automatically remove records that must be retained for legal, fraud-prevention, or payment purposes.

Contact

For privacy, personal-information, or account-data enquiries, email NZ Veggie Plants at nzveggieplants@gmail.com.