Back to Plant Passport Ops

Privacy Notice

Last updated: 13 October 2026

This notice explains how Plant Passport Ops (“we”, “us”) handles personal data when you visit this website or use the Plant Passport Ops app. Questions or requests: hello@plantpassportops.app.

Early access requests (before launch)

Before the public launch, sellers could request early access through a form on this website. For those requests we collected:

• Email address
• Shop name
• Country
• Sales channel
• Monthly order estimate
• Your description of your current workflow
• Whether you are open to a short feedback call (optional)

Alongside your answers, the form automatically records:

• The referring page (the website you came from, as reported by your browser), if any
• The path of the page you submitted the form on (without query strings)
• Campaign tags in the link you followed, if present (utm_source, utm_medium, utm_campaign)
• The date and time of submission

Why we use it and our lawful basis

• To manage the early access list and contact you about early access and the launch. We rely on our legitimate interests in running a small early access programme, and on your consent when you ask us to contact you or agree to a feedback call.
• To understand which channels bring interested sellers (referrer, page path and campaign tags) and to shape the product around real workflows. We rely on our legitimate interests in planning the product.

You can withdraw consent or object at any time by emailing us. We do not use your details for unrelated marketing.

How long we keep it

We keep early access submissions until early access ends or you ask us to delete them, and for no longer than 24 months from submission.

The Plant Passport Ops app

If you create an account, we store your sign-in email and the workspace data you enter (such as plants, imported orders, traceability codes, generated labels and batch records) to provide the service. We rely on the performance of our contract with you. Account data is kept while your account is active; you can ask us to delete your account and workspace at any time.

If you connect a Shopify store or an Etsy shop, we read your orders through Shopify's or Etsy's API with read-only access (for Etsy, the transactions_r and shops_r permissions). We import order numbers, order dates and line items (product titles, variations, SKUs and quantities) so you can print plant passports for them, and your shop's name to show which shop is connected. We do not store your customers' names, email addresses, phone numbers or addresses, we never change anything in your shop and we never contact your buyers. The access tokens for your store are encrypted and are deleted when you disconnect the store or uninstall the app; imported orders stay in your workspace until you delete them or your account. The term 'Etsy' is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

If you send feedback from the app, we store your message and rating, linked to your account, so we can follow up and improve the product. We rely on our legitimate interests in improving the service.

Payments

Paid plans are sold and billed by Stripe as the merchant of record (Stripe Managed Payments). When you subscribe, Stripe collects and stores your payment details, billing name and address and handles VAT and invoicing under its own privacy policy; we never see or store your full card number. We keep your Stripe customer and subscription identifiers, your plan and its renewal date to provide the service, relying on the performance of our contract with you. Invoices and payment records are kept as long as tax law requires.

Analytics

We use Cloudflare Web Analytics, a cookieless service, to count page views, referring sites and page load times in aggregate. It does not set cookies, use local storage or fingerprint visitors, and it does not build profiles of individual visitors. We rely on our legitimate interests in understanding how the website is used. This website does not use advertising or tracking cookies.

Who processes data for us

• Netlify — hosts this website and received early access form submissions (Netlify Forms) before launch.
• Supabase — hosts app accounts and workspace data.
• Stripe — sells and bills paid plans as merchant of record, processes payments and issues invoices.
• Resend — sends account emails such as sign-up confirmations and password resets.
• Cloudflare — cookieless, aggregate website statistics (Cloudflare Web Analytics).

These providers process data on our behalf under their data processing terms. Some may process data outside the UK; where they do, they rely on recognised safeguards such as standard contractual clauses. We do not sell your data.

Your rights

You can ask to access, correct or delete your information, object to or restrict how we use it, or receive a copy of it, by emailing hello@plantpassportops.app. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk) or your local data protection authority.