Privacy Policy - Solco
Last updated: June 2026
Solco ("we", "our", "us") operates solco.farm and the associated crop advisory service. This policy explains what data we collect, why, and your rights under EU law including the General Data Protection Regulation (GDPR).
Data controller
Rocco Russo Ordona, Puglia, Italy Email: hello@solco.farm Phone: +39 379 263 0288
What data we collect
Account data When you register: your email address, name, and — if you sign in via Google — an OAuth token. We manage authentication sessions using better-auth and store session records in our database.
Farm and field data Field polygon geometries, bounding boxes, field names, crop type labels, and computed area values. This data is entered by you when you set up your fields.
Satellite and agronomic data NDVI (Normalised Difference Vegetation Index) statistics derived from Sentinel-2 satellite imagery via Sentinel Hub. These are numerical summaries about your fields, associated with your account.
Usage and log data Request timestamps, IP addresses processed by Cloudflare infrastructure, and error events. We do not log message content from the AI chat assistant — only identifiers, message length, and outcome codes.
Waiting list and contact data If you register for our waiting list or contact us directly, we store your email address and any fields you choose to submit.
Why we use your data
| Purpose | Legal basis |
|---|---|
| Providing the crop advisory service | Contract performance — Art. 6(1)(b) GDPR |
| Delivering morning reports and alerts | Contract performance |
| Account authentication and security | Legitimate interests — Art. 6(1)(f) GDPR |
| Debugging and service reliability | Legitimate interests |
| Waiting list and marketing emails | Consent — Art. 6(1)(a) GDPR; withdraw at any time |
Third-party processors
We share data with the following service providers under appropriate agreements. We do not sell your data.
Cloudflare (US, EU Standard Contractual Clauses in place) — edge infrastructure, database (D1), key-value storage, and vector search. Your data is processed on Cloudflare's infrastructure. Cloudflare's privacy policy: cloudflare.com/privacypolicy
Sentinel Hub / Planet Labs (EU) — satellite imagery. We send field geometries to retrieve NDVI statistics. No personal data is sent to Sentinel Hub.
Open-Meteo (Switzerland) — weather forecasts. We send field coordinates. No personal data is sent.
Resend (US, EU SCCs in place) — transactional email for authentication links and anomaly alert notifications.
EmailOctopus (UK) — waiting list email management. Used only for contacts who have registered interest before subscribing.
Google (US, EU SCCs in place) — optional OAuth sign-in. If you use Google login, Google processes your authentication. We receive only your email address and name.
We do not share farm geometries or NDVI data with insurers, cooperatives, or government bodies without your explicit consent.
How long we keep your data
| Data type | Retention |
|---|---|
| Account and field data | Duration of subscription + 30 days after closure |
| Notification records | 30 days |
| Authentication sessions | Deleted on expiry (7 days after session end) |
| NDVI readings | Duration of account (needed for trend analysis) |
| Request logs | Up to 90 days |
| Waiting list registrations | Until you unsubscribe or request deletion |
Your rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your data, subject to legal retention requirements
- Data portability — receive your field and NDVI data in a structured, machine-readable format (JSON)
- Object — object to processing based on our legitimate interests
- Withdraw consent — for marketing emails, at any time via the unsubscribe link or by emailing us
Email hello@solco.farm to exercise any right. We will respond within 30 days. If you believe we have mishandled your data, you may lodge a complaint with your national supervisory authority. In Italy: Garante per la Protezione dei Dati Personali — garanteprivacy.it.
Cookies and tracking
We do not use advertising cookies or build individual user profiles for marketing. If analytics measurement is enabled, it uses aggregated, anonymised data only.
Security
All data is transmitted over TLS 1.3. Database access is restricted to Cloudflare Workers running the Solco application. We do not store payment card data. Security concerns: security@solco.farm.
Changes to this policy
We will notify registered users by email at least 14 days before any material change takes effect.