Privacy Policy

Effective date: 17 October 2026

This Privacy Policy explains how Griffon Webstudios ("we", "us") collects, uses and protects personal data when you use the My Cardamom Estate mobile app and website (the "Service"). We follow India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

In short: we collect only what is needed to run your estate's records — your phone number, name, estate details, worker records and the photos you choose to scan. We do not sell your data and we do not show ads.

1. Who we are

Griffon Webstudios is the data fiduciary responsible for your data.
Address: [Registered business address]
Email: support@mycardamomestate.com

2. Data we collect

Data	Why we need it
Mobile number	To create your account and sign you in with a one-time code (OTP).
Your name	To personalise the app and identify your account.
Estate details — estate name, district, acreage, plots	To set up fertilizer schedules and quantities for your estate.
Worker records — names, optional phone numbers, joining dates, worker type, wage rates, attendance, hours and payments	To calculate weekly payroll, year-end settlement, bonuses and gratuity. You enter this data as the estate owner; please make sure your workers know you keep these records.
Fertilizer & inventory records — schedules, applications, stock, purchases and prices	To track your stock, reminders and spending.
Crop photos you choose to scan	To provide AI crop diagnosis and keep your scan history.
Subscription status	To unlock Pro features. Payments are handled by Apple or Google — we never see or store your card details.
Basic technical data — server logs such as request times and errors	To keep the Service secure and fix problems. Logs do not contain your phone number.

We do not collect your location, contacts, or any data for advertising.

3. How we use your data

To provide the Service: sign-in, attendance, payroll, fertilizer planning, inventory and AI diagnosis.
To send reminders you enable (for example, fertilizer due tomorrow or low stock). These are created on your phone.
To manage your free trial and subscription.
To answer your support requests.
To keep the Service secure and meet legal obligations.

We process your data on the basis of your consent, given when you create an account, and to provide the Service you request.

4. Service providers we use

We share data only with trusted providers who help us run the Service, and only what they need:

Provider	Purpose	Data shared
Twilio	Sending sign-in codes by SMS	Mobile number
Anthropic (Claude AI)	AI crop diagnosis	The crop photo you scan and your estate's acreage
MongoDB (cloud database) and Render (server hosting)	Storing and serving your estate records	Your account and estate data
Apple App Store / Google Play	Processing subscription payments	Purchase confirmation (handled by the store)

Some providers may process data outside India. When they do, we rely on their contractual and security commitments to protect it. We do not sell or rent your personal data to anyone.

5. Data on your phone

To work without signal, the app keeps a copy of your recent estate data and any changes made offline on your phone, in the app's private storage. This copy is removed when you sign out or delete your account.

6. How long we keep data

We keep your data while your account is active, so your payroll and estate history stay available.
If you delete your account, it is deactivated immediately and all your data is permanently deleted after 30 days. Signing in again within those 30 days restores it.
We may keep limited records longer if the law requires it.

7. Your rights

Under the DPDP Act you can:

Access a summary of your personal data and how it is processed.
Correct or update your data — most of it directly in the app.
Erase your data — use Profile → Delete account in the app, or see Delete your account.
Withdraw consent at any time by deleting your account.
Nominate another person to exercise these rights on your behalf.
Raise a grievance with us, and if unresolved, with the Data Protection Board of India.

To use any of these rights, email us from your registered details. We aim to respond within 30 days.

8. Security

Data travels over encrypted connections (HTTPS). Sign-in uses one-time codes, sessions use secure tokens stored in your phone's secure storage, and each estate's records can only be accessed by its owner's account.

9. Children

The Service is meant for estate owners and managers aged 18 or over. We do not knowingly collect data from children.

10. Changes to this policy

If we change this policy, we will update the date above and, for important changes, tell you in the app.

11. Grievance Officer

Name: [Grievance Officer name]
Email: support@mycardamomestate.com
Address: [Registered business address]