Privacy & Data Policy

Sporeline operates a multi-tenant cloud platform for commercial mushroom cultivation management. With respect to the data we handle, we act in two distinct capacities:

• Data Controller — for account and contact information collected during registration and platform use.
• Data Processor — for Customer Data submitted by customers in the course of using the Service.

Privacy inquiries: chase@sporeline.com

EU Representative: [To be appointed]

Data Protection Officer: chase@sporeline.com

2.1 Account and Registration Data

When you register or manage your account, we collect:

• Full name, email address, phone number, and job title
• Organization name, address, and billing information
• Account credentials (passwords are salted and hashed; we never store plaintext passwords)
• Communication and notification preferences

2.2 Operational and Customer Data

The core function of the platform involves storing your cultivation records:

• Cultivation records: species, strain, substrate composition, inoculation dates, environmental conditions, and harvest data
• Environmental sensor readings and monitoring logs
• Yield data, contamination events, and quality grades
• Cost inputs, inventory records, and supplier data
• Workflow metadata: stage transitions, timestamps, operator IDs, and QR/barcode scans

2.3 Usage and Technical Data

We collect the following technical data automatically:

• Device information (browser type, operating system, device identifiers)
• Log data: IP addresses, timestamps, pages accessed, and API call records
• Performance and error data for platform reliability monitoring
• Cookies and session tracking identifiers (see Section 10)
• In-app product analytics and session replays, as described in Section 10A (a condition of using the Service on every plan)

2.4 Third-Party Integration Data

If you connect third-party services (such as QuickBooks or Shopify), we receive data from those services as necessary to provide the integration. The scope of data received is determined by the permissions you grant within each third-party platform.

We use collected data for the following purposes:

• Service delivery — Providing, operating, and maintaining all platform features and functionality.
• Analytics and reporting — Generating dashboards, KPIs, and reports within your account.
• Platform improvement — Refining algorithms, developing new features, and optimizing recommendations using anonymized patterns.
• Communications — Sending transactional messages (account, billing, security) and optional communications described in Section 9 of the Terms of Service.
• Security — Detecting threats, monitoring for unauthorized access, and protecting platform integrity.
• Legal compliance — Meeting our obligations under applicable law and responding to lawful requests.

4.1 What We Aggregate

We derive anonymized, aggregated datasets from Customer Data across our customer base. Examples include:

• Yield averages by mushroom species, region, and season
• Substrate effectiveness benchmarks
• Environmental condition correlations
• Cost efficiency metrics and industry trends
• Contamination rate patterns by substrate and technique

4.2 Anonymization Process

Before any Aggregated Data is used or shared externally, we apply:

• Removal or cryptographic hashing of all direct identifiers
• Suppression or generalization of indirect identifiers
• k-anonymity (k≥5) and l-diversity protections
• Differential privacy techniques where appropriate
• A Data Protection Impact Assessment (DPIA) prior to each new aggregated data sharing category
• Independent re-identification risk testing

4.3 Recipients of Aggregated Data

Anonymized, aggregated datasets may be licensed to third parties including substrate and equipment suppliers, research institutions, agricultural technology companies, financial analysts, and government agencies. All recipients are contractually prohibited from attempting to re-identify individuals or organizations from the data.

4.4 What We Never Share

• We never sell identifiable Customer Data to any third party
• We never share raw, un-anonymized data with third parties
• We never share data for advertising or individual profiling purposes
• We never permit third parties to combine our data with other sources to re-identify customers

4.5 Opt-Out

You may opt out of third-party Aggregated Data licensing by toggling "Data Sharing" to Off in your account dashboard, or by emailing chase@sporeline.com. Opt-out takes effect within 30 days and does not affect your access to or pricing for the Service. Data already incorporated into anonymized, aggregated datasets prior to the opt-out effective date cannot be recalled.

Beyond the Aggregated Data licensing described in Section 4, we share data only in the following circumstances:

• Service providers — We engage third-party vendors (such as AWS, Stripe, and email delivery providers) who process data on our behalf under contractual data processing obligations. See Section 13 for the sub-processor list.
• Third-party integrations — When you connect external services, data flows to those services as required to deliver the integration. You control which integrations are active.
• Legal requirements — We may disclose data if required by law, regulation, court order, or to protect the rights, property, or safety of the Company or its users.
• Business transfers — In the event of a merger, acquisition, or sale of substantially all assets, Customer Data may be transferred to the successor entity. Affected customers will receive advance notice.

6.1 Primary Location

The Service is hosted in AWS infrastructure located in the United States (us-east-1 region). By using the Service, you acknowledge that your data will be processed in the United States.

6.2 EEA, UK, and Switzerland Transfers

For transfers of personal data from the EEA, United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, and the UK International Data Transfer Addendum (IDTA) where applicable.

6.3 Data Processing Agreement

A Data Processing Agreement (DPA) incorporating SCCs is available to customers upon request. Contact chase@sporeline.com.

6.4 Transfer Impact Assessments

Transfer impact assessments are conducted for cross-border data flows and are available to customers upon request.

7.1 Customer Data

Customer Data stays in your account while the account is open. When a paid subscription ends, the account stays open on the free plan with its data.

Activity records (who in your account did what, when, and the reason they gave) are part of Customer Data, are kept for the life of the account, and are anonymized when a person's data is erased.

7.2 Closing or Deleting Your Account

When an account is closed, its Customer Data can be exported for 30 days and is deleted from primary systems within 90 days of closing.

The farm's Owner can also delete the account at any time (see Delete Your Account). Deletion starts 14 days after the request, and backup copies expire within 12 months.

7.3 Aggregated Data

Anonymized, aggregated data is retained indefinitely as it does not contain identifiable information.

7.4 Account Data

Account-level records (billing history, legal notices) are kept for at least six years after the account closes, to meet financial and legal record-keeping obligations.

7.5 Usage Data

Server and request logs, which include IP addresses, are kept for 30 days. Records of consents and acknowledgements, which include the IP address and browser used, are kept with Account Data under Section 7.4.

7.6 Product Analytics Data

Session replays are retained for 30 days and product analytics events for 12 months from capture, after which they are deleted by our analytics processor. Records of each acknowledgement of this processing are retained with Account Data under Section 7.4.

If you are located in the EEA, UK, or Switzerland, you have the following rights with respect to your personal data:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate or incomplete personal data.
• Erasure — Request deletion of your personal data, subject to legal retention obligations.
• Restriction — Request that we limit processing of your data in certain circumstances.
• Portability — Receive your personal data in a structured, machine-readable format.
• Objection — Object to processing based on legitimate interests or for direct marketing.
• Automated Decision-Making — Not be subject to solely automated decisions that produce significant legal effects.

To exercise any of these rights, contact us at chase@sporeline.com or use the GDPR Rights Center within the platform. We respond within 30 days (extendable by 60 days for complex requests). We may require identity verification before processing certain requests. We do not charge a fee unless a request is manifestly unfounded or excessive.

To delete your account, see Delete Your Account, which explains who can request it, how, what is deleted and what is kept.

We implement the following security controls to protect Customer Data:

• AES-256 encryption at rest for all stored data
• TLS 1.2 or higher for all data in transit
• Role-based access control (RBAC) with least-privilege enforcement
• Multi-factor authentication (MFA) for account access
• Strict tenant data isolation — no customer can ever access another customer's data. The only exception is read-only, logged access by Sporeline staff for support, described below.
• Continuous monitoring and intrusion detection
• 72-hour security incident response procedures
• Third-party vendor security assessments
• Regular employee security training

Sporeline staff may view your account data, read-only, when you ask for help or when we need to troubleshoot a problem with your account. Every such access is logged.

No security system is absolutely impenetrable. In the event of a confirmed data breach, we will notify affected customers within 72 hours of becoming aware of the incident.

We use the following categories of cookies and tracking technologies:

• Strictly Necessary — Session management, authentication tokens, and security protections. These are required for the platform to function and cannot be disabled.
• Functional — User preferences and language settings to personalize your experience.
• Analytics — Product analytics and session replay within the signed-in application, described in Section 10A.

We do not use advertising cookies or cross-site tracking technologies. In the signed-in application a cookie preference banner is displayed on first visit; product analytics there is a condition of using the Service under Section 10A and is not turned off by the analytics cookie choice.

10A.1 What we collect

When you use the signed-in application we collect the pages you view, the elements you click, errors and performance timings, and session replays. A session replay is a reconstruction of what was displayed on your screen inside the application, including on-screen text such as block identifiers, names and quantities. None of this is collected on public pages (marketing, sign-in, sign-up, documentation); the only data from those pages is the steps under Public pages in Section 10, which are connected to your account once you acknowledge usage recording if you signed up in a browser with the analytics cookie.

10A.2 What we exclude

Text you type into any field is masked before it leaves your browser. API keys, webhook secrets, two-step sign-in setup codes and QR codes, and the Analytics workspace are excluded from capture. Query strings and fragments are removed from page addresses. Request and response bodies, headers and browser console output are not collected.

10A.3 Identity

Analytics data is associated with a pseudonymous sign-in identifier, your organization identifier and name, your role and your plan. It is never associated with your email address or name within the analytics service.

10A.4 Processor and basis

This data is processed by PostHog, Inc. in the United States, acting as our sub-processor (Section 13). This processing is a condition of using the Service on every plan: each Authorized User acknowledges it before first use, and again when the wording of that acknowledgement changes, and we record each acknowledgement (Section 10A.6). A written enterprise agreement may set its own terms.

10A.5 Purpose

We use this data to detect and diagnose defects, to understand where the application is difficult to use, and to decide what to improve. We do not use it for advertising, do not sell it, and do not share it with anyone other than the processor named above.

10A.6 Records

Each acknowledgement is written to our Consent Ledger with the time, the text version shown, the IP address and browser, and the person who acknowledged. You may request a copy through the Rights Center or by contacting us.

10A.7 Deletion

Data already collected is deleted on the schedule in Section 7.6, or sooner on request under Section 8. If you do not wish to be recorded you may stop using the Service; your account and data remain as they are until the account is closed.

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that a minor has registered for an account, we will promptly delete the account and associated data. If you believe a minor has created an account, contact us at chase@sporeline.com.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know — Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete — Request deletion of personal information we have collected, subject to exceptions.
• Right to Correct — Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing — Our Aggregated Data licensing program may constitute a "sale" or "sharing" of personal information under California law. You may opt out as described in Section 4.5 or by using the "Do Not Sell or Share My Personal Information" link on our website.
• Right to Non-Discrimination — We will not discriminate against you for exercising any CCPA/CPRA rights.

To exercise California privacy rights, contact us at chase@sporeline.com.

We engage the following categories of sub-processors to operate the Service:

• AWS — Cloud hosting, storage, authentication, and email delivery infrastructure
• Stripe — Payment processing and subscription billing
• AWS SES — Transactional email delivery
• Support tooling — Customer support ticket management
• Linear — Issue tracking for in-app feedback you send (the text, farm name, pseudonymous user ID and role, page addresses and trimmed browser errors; never your email address or name)
• PostHog — Product analytics and session replay of the signed-in app (typed input masked; on-screen text visible)
• Anthropic (Claude), including through Amazon Bedrock — Diagnosing errors and writing the ops triage summaries that file our issues. Redacted error details, alarm text and log excerpts (email addresses and access tokens removed) and Sporeline's own code; never your farm records
• Checkly — Automated checks on a synthetic test farm; no customer data
• Microsoft Azure — Hosting, only for customers who run Sporeline in their own Azure
• QuickBooks Online (Intuit) and Shopify — Only if you connect them

A current list of sub-processors is maintained at sporeline.com/sub-processors. We provide at least 30 days' notice before adding new sub-processors. Customers have a 15-day window to object to a new sub-processor, with the right to terminate if a reasonable objection cannot be resolved.

The Company conducts Data Protection Impact Assessments (DPIAs) in the following circumstances:

• Before introducing new categories of Aggregated Data sharing with third parties
• When making significant changes to existing processing activities
• Before adopting new high-risk technologies that process personal data

DPIAs are reviewed on an annual basis. Summaries of completed DPIAs are available to customers upon request by contacting chase@sporeline.com.

We may update this Privacy & Data Policy as our practices evolve. For material changes, we will provide at least 30 days' advance notice via email and in-app notification. The updated policy will be posted on this page with a revised "Last updated" date.

Continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes. If you disagree with the revised policy, you may terminate your subscription before the effective date.