Privacy policy

Controller

The party responsible for processing personal data within the meaning of the revDSG is:

«Name», «Address», «contact@oxheart.ai»

What data we process

Using oxheart.ai involves processing:

• Account data: email address, password (stored only as a cryptographic hash), and an optional display name.
• Garden data: your gardens, beds, plants, care plans, harvest entries and notes.
• Photos: plant images you upload.
• Location data: optional, used solely to display weather information.
• Server log files: IP address, timestamp and requested resource, used to secure the service.

Why we process it

We process this data to provide the application, manage your account and keep the service secure. We do not analyse it for advertising purposes, and we use no analytics or tracking services.

Disclosure and processing abroad

The application and database run at Hetzner Online GmbH in Germany. Some features rely on additional providers:

• Anthropic PBC (USA) — AI features such as plant identification, diagnosis and care plans. Your text input and uploaded photos are transmitted to the USA for this purpose.
• Resend (email delivery via Amazon Web Services, Ireland region) — confirmation and notification emails.
• Cloudflare, Inc. (USA) — DNS and email forwarding.
• Open-Meteo — weather data for the coordinates you provide.

Cross-border disclosure

Under Art. 16 f. revDSG, personal data is disclosed abroad only where adequate protection exists or appropriate safeguards are in place.

«To verify and add: for transfers to the USA, state whether the provider concerned is certified under the Swiss-U.S. Data Privacy Framework, or whether the FDPIC standard contractual clauses apply.»

Retention

We retain your data for as long as your account exists. If you delete your account, your account data, garden data and photos are removed. Backups are kept for 14 days and then expire.

Your rights

You have the right to information about the personal data we process (Art. 25 revDSG), and to rectification, deletion and data portability (Art. 28 revDSG).

An informal message to «contact@oxheart.ai» is sufficient. You may also pursue legal remedies; the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), Bern.

Cookies and encryption

We use only technically necessary cookies for your sign-in session. The application is reachable exclusively over a TLS-encrypted connection (HTTPS).

Changes

We update this policy when the application or the providers we use change. The version published on this page applies.