Privacy policy

Farm40 is operated by Sourdough AI LLC (“we,” “us”), which also operates other software products. This policy covers the Farm40 website and the Farm40 application. We are the data controller for the information described below.

Questions about this policy or your data: support@farm40.com. To report a security issue: security@farm40.com.

Account details — your name and email address. We never receive or store your password. Sign-in is handled by Amazon Cognito; our records hold only the opaque identifier Cognito gives us so we can recognise you. Where Google sign-in is offered and you use it, we receive your email address and name from Google, and no password exists at all.

Farm records — everything you enter into the product: farms, fields, crop plans, plantings, scouting observations, input applications, harvest lots, livestock groups, animal events and treatments, breeding, weight and feed records, employees, labor logs, inventory, equipment, calendar events, financial transactions, and sales. This data is yours. We hold it to provide the service to you.

Documents you upload — files you attach to your farm are stored in Amazon S3, encrypted at rest by the storage service, and are served back to you through short-lived links that expire.

Assistant conversations — if you use the AI assistant, we store your questions, the assistant’s answers, and the names of the read-only tools it used to answer, so you can revisit a thread and so we can count your monthly questions. We also keep an append-only access log recording that a question was asked against your account.

Billing details — if you subscribe, Stripe processes your card. We never see or store the card number. We keep the subscription status Stripe reports back to us.

Basic technical data — ordinary server logs (IP address, browser type, timestamps) needed to keep the service secure and running.

Requested-resource email. If you request the printable record pack or organic inspection readiness checklist and consent to the two short follow-up emails, we pass your address to SendGrid for that purpose. Every message includes an unsubscribe link, and you can withdraw consent at any time.

We use your account details and farm records to provide the service you asked for — that is, to perform our contract with you. We use technical logs and security records for our legitimate interest in keeping the service available and safe. We use your billing details to take payment you have agreed to. We send you marketing email only where you have asked us to, and you may withdraw that at any time.

We do not use your farm records to build advertising profiles, and we do not sell them. We have never sold personal information, and we do not share it for cross-context behavioural advertising.

This section matters, so it is separate. The assistant is optional, and 10 questions a month are included on every account.

What leaves our systems. When you ask the assistant a question, your question and the specific records it reads to answer are sent to Anthropic, which operates the underlying language model. The assistant is given a read-only database connection bound to your account, so it can only read records belonging to you. Anthropic processes this material to generate the answer and returns it to us. Under our agreement with Anthropic, your inputs and the model’s outputs are not used to train their models.

What stays inside. Another farm’s records are never sent, because the assistant cannot address them: the account filter is applied at the database, not requested in the prompt. Every row returned is re-checked for ownership before it is used.

What the assistant is not. It is read-only. It cannot create, change, or delete a record, and it performs no arithmetic of its own — it reports figures the application has already calculated. It tells you which tools it consulted, not which individual records. Do not rely on it for a regulatory decision; see our terms.

If you never use the assistant, none of your farm records are sent to Anthropic.

We use first-party cookies to keep you signed in. Your light or dark theme preference is kept in your browser’s local storage and never sent to us. We do not use cookies to track you across other websites.

For usage measurement we rely on cookieless, privacy-preserving analytics that does not follow you around the web and does not build an advertising profile. We run no third-party advertising trackers on this site or in the application.

We keep the list short on purpose. Each of these processes data only to provide its service to us, under its own security and confidentiality commitments.

Amazon Web Services — hosting, the database, document storage (S3), sign-in (Cognito), and transactional email (SES). Anthropic — the language model behind the AI assistant, and only when you use it (see section 4). Stripe — subscription payments and card processing. Cloudflare — serving this website and protecting it from abuse. SendGrid — the newsletter, if you subscribe to it.

We may also disclose information if the law requires it, or to protect the rights and safety of our users. If we are ever compelled to hand over your records, we will tell you unless we are legally prohibited from doing so.

If Farm40 is ever sold or merged, your records would transfer with it, and we would tell you before that happened so that you could export and leave.

Your data is encrypted in transit and at rest. Access to your records is scoped to your account at the database layer rather than enforced only in the application, which is what allows us to make the promise in section 4. Access by our own staff is limited to what is needed to operate and support the service.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant regulators as required by law and without undue delay. Please report anything you find to security@farm40.com.

We keep your farm records for as long as your account is active, so the history stays intact — which is the entire point of a record that has to survive an audit years later. We keep billing records for as long as tax and accounting law requires.

If you delete your account, we remove your records from active systems promptly and purge routine backups on their normal rotation. Deleting your account deletes your assistant conversations with it.

We operate in the United States, and your data is processed there. If you use Farm40 from outside the United States, you are sending your information to a country whose data-protection law may differ from your own. Where we transfer personal data out of the UK or the European Economic Area, we rely on the appropriate safeguards permitted by law, including standard contractual clauses with our processors.

You can access and correct your data directly in the product at any time, and export any record as a CSV file whenever you want — including on the way out. You can ask us to delete your account and its data by emailing support@farm40.com.

Depending on where you live, you may have additional rights: to a copy of your data in a portable format, to correction or erasure, to restrict or object to processing, to withdraw consent, and to complain to your data-protection authority. Under United States state privacy laws you may have the right to know what we collect, to delete it, and to opt out of sale or sharing — we do neither, so there is nothing to opt out of. We will not treat you differently for exercising any of these rights.

We answer these requests within the time the applicable law allows, and we do not charge for them.

Farm40 is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to support@farm40.com and we will delete it.

If we make a material change to this policy — adding a processor who sees your farm records, for instance — we will update the effective date above and, where appropriate, notify you by email. Continuing to use Farm40 after a change means you accept the updated policy.