Privacy Policy

1. Who we are and how to reach us

The controller responsible for the processing of your personal data within the meaning of Article 4(7) GDPR is:

Full provider details are set out in our Legal Notice (Impressum).

Data protection officer

We have assessed our processing activities against § 38 of the German Federal Data Protection Act (BDSG) and Article 37 GDPR and are not currently required to appoint a data protection officer. All data protection enquiries are handled directly by our management at hello@livestockfarm.co. If this assessment changes, we will appoint an officer and publish their contact details here.

2. Scope of this policy

This policy applies to:

• the Livestock Manager mobile applications for iOS and Android;
• the web application at https://app.livestockfarm.co;
• our marketing website at https://livestockfarm.co, including public order-tracking and farm shop pages; and
• our email, push notification and customer support communications

(together, the “Services”). It does not apply to third-party websites or services we link to, each of which operates under its own privacy policy.

3. What personal data we process

Data you give us directly

• Account data: email address, password (stored only as a salted hash, never in readable form), first and last name, username, profile photo, preferred language and time zone.
• Sign-in provider data: where you choose to sign in with Google or Apple, the identifier, name and email address that provider releases to us. With Sign in with Apple this may be a private relay address rather than your real one.
• Farm and operational data: farm name, country, currency, units of measurement, and the records you create — flocks, animals, breeding projects, health and medical records, feed and inventory, tasks, harvests, notes and attachments.
• Financial records: transactions, invoices, sales and orders you record in the app. This is your own business data; we do not use it for any purpose other than providing the Services to you.
• Contacts and customers: names, email addresses, phone numbers and delivery details of the customers, suppliers and team members you add. See section 8 — you are the controller for this data.
• Team and membership data: invitations you send, and the roles and permissions assigned to people you invite to your farm.
• User-generated content: community posts, comments, reactions, feedback, support messages and any files or images you upload.
• Purchase data: subscription tier, plan, purchase and renewal history, and store receipts. We never receive or store your full payment card number.

Data collected automatically

• Device and connection data: IP address, device model, operating system and version, app version, browser type and version, screen characteristics, language settings and network carrier.
• Usage data: screens and pages viewed, features used, buttons and elements interacted with, timestamps, referring page, and session duration.
• Approximate location: a coarse city- or country-level location derived from your IP address, used for currency defaults, regional pricing and analytics. We do not collect precise GPS location.
• Diagnostic data: crash reports, stack traces, performance traces and server logs.
• Identifiers: cookies and comparable technologies on the web, push notification tokens, and mobile advertising identifiers where you have consented to their use.

Special categories of data

We do not ask for, and the Services are not designed to hold, special categories of personal data within the meaning of Article 9 GDPR (such as health, biometric, religious or political data about individuals). Please do not enter such data into free-text fields. If you do, you are responsible for having a lawful basis under Article 9 for doing so.

4. Why we process it and on what legal basis

We only process personal data where the GDPR gives us a legal basis to do so. The table below sets out each purpose and the basis we rely on.

Where we rely on legitimate interests, we have carried out a balancing test weighing our interest against your rights and freedoms. You may request a summary of that assessment at hello@livestockfarm.co.

5. Cookies, tracking and session replay

On our website and web application, cookies and comparable technologies that are not strictly necessary are only set after you have given consent through our cookie banner, in accordance with § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6(1)(a) GDPR. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of every page.

A full breakdown of every cookie and tracking technology we use, its purpose, its provider and its storage duration is set out in our Cookie & Tracking Policy.

In the mobile apps, analytics and advertising identifiers are used only where you have granted the corresponding permission. On iOS this is requested through Apple’s App Tracking Transparency prompt. You can change your decision at any time in your device settings.

6. Who receives your data

We do not sell personal data, and we never have. We share it only in the following circumstances:

• Service providers (processors): specialist companies that process data strictly on our documented instructions under a data processing agreement meeting Article 28 GDPR. They are listed in full below.
• People you share with: where you invite team members to your farm, publish a community post, or operate a public farm shop, the data you choose to share becomes visible to those recipients.
• Professional advisers: our accountants, auditors and lawyers, bound by professional confidentiality.
• Authorities: courts, regulators and law enforcement, where we are legally obliged to disclose or where disclosure is necessary to establish, exercise or defend legal claims. We assess every request for validity and disclose no more than is required.
• In a corporate transaction: if our business or its assets are merged, acquired or reorganised, data may transfer to the acquirer, which will remain bound by this policy. We will notify you before your data becomes subject to a materially different policy.

Our service providers

We keep this list current. If you would like to be notified of additions before they take effect, write to hello@livestockfarm.co.

7. International data transfers

Our own infrastructure — our application servers, our database and the files you upload — is hosted within the European Union.

Some of the service providers listed above process data in the United States or other countries outside the European Economic Area. Those countries may not offer a level of data protection equivalent to the GDPR, and in particular may permit access by public authorities in circumstances broader than EU law allows. Where such a transfer takes place, we rely on one or more of the following safeguards under Chapter V GDPR:

• an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it (Art. 45 GDPR);
• the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures following a transfer impact assessment (Art. 46(2)(c) GDPR); or
• your explicit consent to the specific transfer, having been informed of the risks (Art. 49(1)(a) GDPR).

You may request a copy of the relevant safeguards from hello@livestockfarm.co.

8. Data you upload about other people

As controller, it is your responsibility to:

• have a lawful basis under Article 6 GDPR for entering that data;
• provide those individuals with the information required by Articles 13 and 14 GDPR, including that you use Livestock Manager as a processor;
• respond to their requests to exercise their rights — we will assist you, and will forward to you any request we receive directly; and
• keep that data accurate and delete it when you no longer need it.

Our processing on your behalf is governed by the data processing terms in section 17 of our Terms & Conditions, which form a data processing agreement meeting the requirements of Article 28(3) GDPR. If you need a separately signed agreement, contact hello@livestockfarm.co.

9. Artificial intelligence features

Some features use large language models to answer questions, summarise records and suggest actions. When you use them, the content of your prompt and the farm records needed to answer it are transmitted to our AI provider (currently OpenAI) for the sole purpose of generating a response.

• Our AI provider processes this data as our processor under an agreement that prohibits using it to train their models.
• AI-generated output can be inaccurate or incomplete. It is informational only and is never a substitute for veterinary, financial, legal or other professional advice. See section 10 of our Terms.
• You control what you put into a prompt. Please do not include sensitive personal data about identifiable individuals.

10. Automated decision-making and profiling

We do not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22(1) GDPR.

We do perform limited profiling in the ordinary sense: we group users by behaviour to decide which features to build, which experiment variant to show, and which onboarding tips or offers to surface. These decisions do not affect your legal position, your pricing, or your access to the Services. You can object to profiling for direct marketing purposes at any time, as described below.

11. How long we keep your data

We keep personal data only as long as necessary for the purpose it was collected for, or as long as the law requires us to.

Where data must be retained for a statutory period, we restrict its processing under Article 18 GDPR rather than continuing to use it.

You can delete your account at any time from within the app, or via our account deletion page.

12. How we protect your data

We maintain technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. These include:

• encryption of all data in transit using TLS, and encryption of data at rest on our database and file storage;
• passwords stored only as salted one-way hashes — we cannot read your password, and neither can anyone who obtains our database;
• role-based access control, with staff access limited to what each person needs to do their job;
• rate limiting, bot detection and abuse prevention on our public endpoints;
• regular backups, and logging and monitoring of access; and
• contractual confidentiality obligations on everyone with access.

No system connected to the internet can be made perfectly secure, and we do not claim otherwise. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours under Article 33 GDPR and, where the risk is high, notify you without undue delay under Article 34 GDPR.

13. Your rights

Under the GDPR you have the following rights in relation to your personal data. Exercising them is free of charge and we will respond within one month, extendable by two further months for complex requests.

1. Access (Art. 15): to be told whether we process your data and, if so, to receive a copy of it together with information about how it is used.
2. Rectification (Art. 16): to have inaccurate data corrected and incomplete data completed. Most of this you can do yourself in your account settings.
3. Erasure (Art. 17): to have your data deleted where it is no longer needed, where you withdraw consent, or where you successfully object — subject to our statutory retention duties.
4. Restriction (Art. 18): to have processing limited to storage only, for example while a dispute about accuracy is resolved.
5. Data portability (Art. 20): to receive the data you provided in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible. The app’s export features provide this directly.
6. Objection (Art. 21): see the separate section below.
7. Withdrawal of consent (Art. 7(3)): to withdraw any consent you have given, at any time, with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.
8. Not to be subject to automated decisions (Art. 22): as explained in section 10, we do not make such decisions.

To exercise any of these rights, write to hello@livestockfarm.co. We may ask you for information to confirm your identity — this is to protect you against someone else obtaining your data.

14. Your right to object

15. Your right to lodge a complaint

Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority — in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

The authority competent for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

We would ask you to raise the matter with us first at hello@livestockfarm.co — but that is a request, not a condition, and your right to complain is entirely unaffected by whether you do.

16. Children

The Services are intended for use by adults in a farming or business context and are not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact hello@livestockfarm.co and we will delete it promptly.

17. Changes to this policy

We may update this policy to reflect changes in our Services, our service providers, or the law. The version number and effective date at the top of this page always identify the current version.

Where a change is material — for example, a new purpose of processing or a new category of recipient — we will notify you in advance by email or through a prominent in-app notice, and, where the change requires it, ask for your consent. Immaterial changes take effect on publication.

18. Contacting us about privacy

For any question, request or concern about how we handle your personal data, write to hello@livestockfarm.co . Our postal address is provided on request and is recorded in the commercial register (Amtsgericht Charlottenburg, HRB 289822 B). We aim to reply to every privacy enquiry within five working days.

Authoritative language

This policy is published in English, which is the authoritative version. Any translation is provided for convenience only; in the event of a discrepancy, the English text prevails, save where mandatory law provides otherwise.