Privacy policy
- What we collect
- How we use it
- When we share data
- Service providers
- Cookies
- How long we keep it
- Your rights
- How we protect it
- Contact us
This policy explains what personal data Growmine Organics collects when you use our website and services, how we use it, and the choices you have. We keep it plain and only collect what we need to run your plot, market orders and deliveries.
What we collect
For account and guest orders, we collect the name, email, phone, address and delivery pincode you provide, plus basket, order, subscription and plot information. If you enable app notifications, we store a device push token and delivery status. The apps may also send limited crash and diagnostic information, such as app version, device platform and an account identifier when signed in. Payment is handled by our processor; Growmine does not store full card numbers.
How we use it
To set up and run your plot subscription, process market orders, arrange delivery, and send you order and harvest updates. We use aggregate, non-identifying data to improve the service.
Service providers
Supabase processes account authentication, session, basket, profile, order and subscription data. Cloudflare processes limited network, browser and challenge data for Turnstile bot protection. If you choose Google sign-in on a supported app or website, Google processes the account and authorization data needed to complete that sign-in. Razorpay processes payment details and payment or refund identifiers. Expo and Google Firebase Cloud Messaging process device push tokens and notification-delivery metadata. Sentry processes limited app crash and diagnostic data. When the relevant communication channel is used, Resend processes email addresses and email delivery data, Twilio processes phone numbers and SMS delivery data, and Meta's WhatsApp Cloud API processes phone numbers, message content and delivery data.
How long we keep it
Account and completed-order records are kept only as needed to provide the service and meet tax, accounting, payment, refund, fraud-prevention and other legal obligations. After a completed deletion review, direct profile and authentication contact data is removed or obfuscated; Supabase may retain a disabled, de-identified authentication row with an opaque internal identifier, and Growmine retains only commerce, security and audit evidence covered by a documented purpose and review or expiry date. Anonymous guest identities that never place an order are scheduled for deletion after 30 days. You can ask us about deletion of your personal data at any time.
Your rights
You can access, correct, export or request deletion of your personal data. We aim to complete a verified account-deletion review within 30 days, subject to open orders, payments, refunds and lawful retention duties. Request status is available on the deletion screen, and we will confirm completion using available account contact details where possible.
How we protect it
Data is encrypted in transit, access is limited to staff who need it, and our backend enforces row-level security so you only ever see your own records.
Contact us
For any privacy question or request, reach us via the contact page and we'll respond within a few working days.