LINFA · in force from 4 October 2026
This is a translation. If it differs from the Italian version, the Italian version applies: Informativa privacy.
The controller is Federico Ragusa, Via Val Leventina 6, 20148 Milan (MI), Italy, VAT not applicable (individual). For any question or request: linfaplantcare@gmail.com.
| Data | Why | Legal basis |
|---|---|---|
| Your account: an email address and a password, a sign-in with Apple or Google, or an anonymous account created on first launch. We also keep your name when the sign-in provider supplies it, and the name you choose for your community profile | To let you in, and to find your plants again on another phone | Performance of the contract |
| Your plants, places, pots, waterings, feedings, observations and care plans | They are the service | Performance of the contract |
| Each place’s position: the phone reads it precisely when you make the place, and we keep it rounded to a cell of about 110 metres. Never an address, and others only ever see a distance, never below 200 metres | The neighbourhood’s weather, and the places near yours in the community | Performance of the contract |
| Photographs of plants | They are kept in your account, so you find them again on another phone or after reinstalling the app. Before keeping them the server removes everything the camera adds, the GPS position included. Only you can see them: nobody else, and no public link. When you remove a plant or a place, its photographs are deleted. When you ask to identify a plant, its photograph is sent to Pl@ntNet. With LINFA+, if Pl@ntNet cannot answer, the photograph and an approximate position (about 10 km) of one of your places are sent to Plant.id. For a diagnosis we send Anthropic the photograph, the symptom you report and relevant details of the plant, pot and recorded care. Fertilizer-label photographs are also sent to Anthropic when you ask to read them. If you use photographic pruning analysis, we send OpenAI the photographs and necessary botanical details. These services receive the content needed for the function you request, not your account password | Performance of the contract |
| Scans of your spaces: the video stays on the phone. Your account keeps only the map we draw from it: the place's size, where the pots stand, how much sky it sees and in which direction | To work out each pot's sun, and to bring the map back on another phone | Performance of the contract |
| In the community: the name you choose, the questions and answers you write, your place’s exposure and the approximate distance from others, your biography and chosen profile photographs. Approved profile information and published questions are visible to the community | To make neighbours’ questions work | Performance of the contract |
| Google Calendar, if connected: busy intervals and away periods derived from them. We do not read event titles, descriptions, attendees or locations | To suggest care when you are available. Intervals are kept on the server; the Google authorization is encrypted and removed when you disconnect the calendar | Performance of the contract |
| Notifications: your device’s token | To tell you when a plant needs something | Performance of the contract |
| Purchases: the receipt the App Store or Google Play hands us | To turn LINFA+ on for your account | Performance of the contract |
| Diagnostics and usage statistics: which screens are opened, which actions succeed or fail, errors and response times. Always as categories, never the content of what you write, never your photographs, never your position. Services use installation identifiers and a pseudonym to recognize sessions; we use no advertising identifiers | To find out where the app breaks and where people stop | Legitimate interest. It can be turned off in the app: Profile → Privacy and data → Help make LINFA better |
| The linfaplants.com website: when you open a page, the service hosting the site (Vercel) records the IP address, the browser and the page requested | To show you the pages and protect the site from abuse | Legitimate interest |
| The website’s statistics, only if you accept them: the pages viewed, the site or search you came from, the language, the approximate country and city, the kind of device and browser, and joining the waitlist. Google Analytics ties them to a random identifier stored in your browser’s cookies. | To understand how many people visit the site and which pages they read | Consent. You withdraw it from “Cookie settings”, at the foot of every page of the site |
| The website’s page views, counted on every visit with Vercel Web Analytics: the page, the site you came from, the country, the kind of device and browser. It uses no cookies and stores nothing in your browser; it recognises a visit for 24 hours at most, then no longer knows who you were | To know how many people visit the site and which pages they read | Legitimate interest |
| The website’s waitlist: the email address you leave, the page’s language and the date you signed up. To stop automated sign-ups the server counts the attempts that come from the same IP address | To write to you once, when LINFA arrives on iPhone and Android | Consent, which you can withdraw at any time. For counting attempts: legitimate interest |
Hetzner Online GmbH (the server and database, in Germany); Anthropic PBC (diagnosis photographs, symptoms and relevant plant and care details, and fertilizer-label photographs, in the United States); Pl@ntNet (a plant photograph, its photographed part and the requested language for identification, in France); Plant.id by FlowerChecker s.r.o. (with LINFA+, only when Pl@ntNet cannot answer: a plant photograph, the requested language and an approximate position of one of your places, about 10 km, in the Czech Republic); OpenAI (photographs and botanical details for pruning analysis when enabled, in the United States or the configured service region); Open-Meteo (a place’s rounded coordinates, in the EU); PostHog and Sentry (pseudonymous usage and error data, in the EU); Google Firebase (crashes, usage statistics and notification delivery; the website’s statistics through Google Analytics, if you accept them); Apple and Google (sign-in and subscription payment, and we never see your card); Google also supplies calendar busy intervals when you connect it; Vercel Inc. (the website’s pages, and in its logs the IP address and browser of whoever opens them, and the page views counted by Vercel Web Analytics, in the United States and a worldwide server network). None of them receives your data to sell it or for advertising. Transfers outside the EU rely on the Commission’s standard contractual clauses.
Everything about your plants stays while your account exists. Errors and performance traces: 90 days. Usage statistics: 12 months. Purchase receipts stay as long as tax obligations require. Calendar intervals and authorization are removed when you disconnect it or delete your account. A waitlist address stays until we have sent you the launch email, then we delete it; sooner if you withdraw consent or ask us. IP addresses used to count sign-up attempts: one day at most. The website’s statistics: 14 months from the last visit (2 months for the detail of each page viewed) for data tied to a single browser; Google Analytics cookies expire after 2 years, and we delete them at once if you withdraw consent. The website’s visit logs: as long as Vercel keeps them (Vercel’s privacy policy). Page views counted by Vercel Web Analytics: in aggregate, as long as Vercel keeps them; a visit is recognised for 24 hours at most.
A request’s duration on our server does not establish a provider’s retention time. Anthropic normally deletes API inputs and outputs within 30 days; OpenAI normally retains abuse-monitoring logs for up to 30 days. Security, legal requirements and specific agreements can create exceptions. See Anthropic’s retention policy, OpenAI’s data controls and Pl@ntNet’s API agreement. We do not promise that every provider deletes photographs immediately after answering.
You can delete your account from inside the app: Profile → Delete account. Everything your account holds goes, on the server and on this phone, and there is no way back. The questions and answers you wrote stay readable to your neighbours, without your name and with nothing pointing to you: other people’s answers under your questions are not yours to delete.
If you have uninstalled the app and can no longer sign in, write to linfaplantcare@gmail.com and we will delete the account for you.
You may ask to see your data, to correct it, to delete it, to restrict its use, to receive it in a machine-readable format, and you may object to processing based on legitimate interest. Write to linfaplantcare@gmail.com. You withdraw consent to the waitlist by writing to the same address: we delete the email. You withdraw consent to the website’s statistics from “Cookie settings”, at the foot of every page. You may also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the supervisory authority of the country you live in.
LINFA is not meant for anyone under 14, and does not knowingly collect their data.
The website uses cookies only if you accept them. On your first visit we ask whether we may count visits with Google Analytics (Google Ireland Limited). If you accept, your browser loads Google’s script and stores its cookies (_ga), which last up to 2 years. If you reject, the site sends no request to Google and stores no cookies. Page views are also counted by Vercel Web Analytics, which uses no cookies and stores nothing in your browser, so it runs on every visit, whatever you choose. Either way your browser remembers your choice in its local storage, not in a cookie, so we don’t ask on every page. You can change it at any time from “Cookie settings”, at the foot of every page: if you withdraw consent we delete the Google Analytics cookies. We don’t use these statistics for advertising. The site has no advertising and no social-network buttons, and its fonts are on our own server. If you join the waitlist your browser sends your email address to our server (api.linfaplants.com).
If something substantial changes we write it here, with a new date at the top, and in the app before the change takes effect.