At a glance
Your farm records and conversations can contain personal information. AI advice, WhatsApp messaging, optional analytics and advice improvement have distinct purposes and choices. Contact us to ask about your information or exercise your rights.
Scope and responsibility
Openfarms Lab (“we”, “us”) operates this website and provides agricultural information and assistance services, starting in Nigeria. SmartFarmer is our app for farmers. We also provide WhatsApp interactions and business-facing services. This notice covers website enquiries, accounts, farm records, communications, support and AI processing where those services are enabled. Contact: hello@openfarmslab.com.
We determine how information is used for our website, business enquiries, service security and our own administration. When a cooperative, employer, extension organisation or other customer manages farmer records and determines why they are used, that organisation may be the data controller and Openfarms Lab acts as its processor under the applicable agreement. Some activities involve separate responsibilities. Your organisation’s notice and agreement should explain its role; this policy does not replace them.
Information we process
| Category | Examples and source |
|---|---|
| Contact and account information | Names, phone numbers, email addresses, language, account identifiers, organisation membership, roles, verification status and account-recovery requests or attestations; supplied by you or an authorised representative. |
| Farm and season records | Farm and plot descriptions, boundaries and exact coordinates, area, operating relationships, crops, varieties, planting dates, activities, observations, inputs and harvest outcomes; entered by you or authorised people acting for your organisation. |
| Messages and media | Questions, replies, conversation summaries, support cases, ratings, photographs, voice notes or documents you provide through enabled channels, together with timestamps and delivery information. |
| Consent and access records | The notice version shown, your choice, who recorded it, permissions, sharing agreements, privacy requests and records of authorised actions. |
| Technical and security information | IP addresses and request information processed by hosting services, sign-in and verification attempts, sessions, recognised-device records, abuse-prevention identifiers, error records and audit events. Enabled browser notifications also require a push subscription and delivery information. |
| Website enquiries | Name, email, selected role and contact permission; optional phone and message. Depending on your role, the page and chat forms also collect farm location, crops and support needs; institution and research interests; organisation and partnership details; or sponsorship preferences. Farm size and regional preferences are optional. The forms identify required fields. |
We may receive your details from an organisation onboarding you, a field agent assisting you, or a messaging provider carrying your communications. Please provide only information needed for the service. Do not send passwords, login codes, payment card details, identity documents or unrelated sensitive information in farm conversations.
Purposes and lawful bases
| Purpose | Information used | Basis, as applicable |
|---|---|---|
| Provide and administer the service | Account, membership, farm and support records | Performance of a contract with you, or our customer’s documented instructions and lawful basis for its records. |
| Produce AI-assisted agricultural responses | Your question, relevant season history, conversation context and supported attachments | Your recorded, purpose-specific consent for AI advice; customer instructions where we act as processor. |
| Deliver messages and verify access | Phone or email, verification text, service messages and delivery status | Contract or legitimate interests in secure access; consent where required for the channel or message. |
| Optional analytics and advice improvement | Aggregate website events; eligible advice text shared for optional improvement | Consent. Advice-improvement content additionally requires the organisation’s training opt-in. |
| Respond to enquiries | Contact details and enquiry content | Steps at your request before a contract, or legitimate interests in answering business enquiries; consent for optional follow-up where required. |
| Protect the service and meet obligations | Security, permission, consent and privacy-request records | Legitimate interests in preventing abuse, protecting information and evaluating service quality, or a specific legal obligation. |
Where we rely on legitimate interests, we consider the purpose, necessity and effects on your rights. You may object. Where consent is required, it may be refused or withdrawn; the feature that depends on it may then be unavailable. Accepting service terms does not by itself grant optional consents.
WhatsApp messaging
Where enabled, we use the WhatsApp Business Platform operated by Meta to receive questions and send replies and service messages. We process your WhatsApp number or channel identifier, message content and supported media, message identifiers, timestamps, verification or linking responses, and delivery or failure status. An authorised organisation may first register your contact details; the linking flow identifies the organisation before connecting your messages to its records.
Messages associated with a farming season can form part of the same conversation as your in-app messages. Relevant content may be sent to our AI service and reviewed by authorised staff or your organisation’s advisers. WhatsApp conversations are therefore retained service records; they are not limited to the copy on your phone.
Business messaging requires the relevant opt-in. Reply STOP to withdraw WhatsApp messaging permission, or contact us or your organisation. START can be used to request reactivation for a linked number, subject to the channel’s checks. Stopping messages does not delete existing records or withdraw every other consent. See Data rights & deletion for those requests.
Meta processes information to operate WhatsApp under its applicable terms and privacy notices, including for its own purposes where applicable. WhatsApp’s transport protections do not prevent Openfarms Lab, authorised advisers or providers involved in answering you from processing messages once received. Read the WhatsApp Privacy Policy.
SMS, verification and email
Termii is an SMS delivery provider supported for phone verification. When used, it receives the destination phone number, sender identity and SMS text, which may contain a one-time code. Delivery information and a provider message reference may be returned. Openfarms Lab checks the code; Termii delivers the text. Mobile network operators also process information necessary to carry SMS.
Other configured messaging providers may deliver verification or transactional messages as described in our provider overview. The purpose of a verification code is secure access. Providing a number for verification does not subscribe you to marketing. Website enquiry confirmations and enabled account emails use the address and content needed for delivery.
AI processing and human review
For consented AI assistance, the platform selects relevant crops, season activities and observations, administrative area, language, conversation history and summaries. The standard season context uses an administrative area rather than exact plot coordinates. Information you put into free text or attachments can still reveal a precise location or someone’s identity.
Our AI service processes messages and supported images or audio through configured model providers. It maintains working conversation sessions and processing traces that can include prompts, responses, tool activity and diagnostic information. Search tools may send generated agricultural queries to a search provider, and weather tools may send a place name. Contact details are filtered from search queries, but filtering cannot guarantee removal of every identifying detail.
Authorised reviewers may see questions, AI drafts, supporting context and feedback to provide advice, assess safety or investigate a problem. The default pilot policy holds recommendations for review. Automatic recommendation approval requires staff eligibility, the organisation’s settings and the draft’s checks to permit it. General clarifications without detected risk can pass automatically under separate checks. A response is therefore not necessarily reviewed before delivery, and review staffing depends on the organisation’s service arrangement. See AI transparency for limitations and choices.
Making eligible question, recommendation or correction text available for optional improvement is separate from using AI to answer a question. This content sharing requires both the person’s advice-improvement consent and the organisation’s training opt-in; no organisation opt-in means no permission. These choices do not start a training job or mean that a conversation automatically trains a model. Operational sessions, processing traces and feedback identifiers, categories or decision codes are handled separately and may still contain or relate to personal information. Withdrawal stops further consent-dependent content sharing; deleting existing records requires a separate request. A provider’s own retention and use depend on the applicable service terms and contract; we do not make a blanket promise that every provider retains no information.
International processing
Providers may process information outside Nigeria, including in Europe, the United States and other locations used to deliver their services. Our platform database architecture includes hosting in Frankfurt, Germany; that does not mean every service or copy is located there.
Transfers must meet applicable Nigerian data protection requirements, using an applicable adequacy basis, contractual safeguards or another lawful transfer condition. Your organisation’s processing agreement should identify the relevant arrangements. Contact us for information about the safeguards applicable to your service; this notice is not itself a transfer agreement.
Retention
We retain information for its purpose, the applicable service arrangement and legal obligations. The following standard schedules distinguish conversation content from advice, media and supporting evidence. A legal hold may suspend deletion for the records it covers; an approved deletion request may shorten ordinary retention.
| Record | Period or criterion |
|---|---|
| Season conversation content | While the conversation is open, then 24 months after closure, unless an applicable legal hold or earlier approved erasure changes this. |
| AI input snapshots held by the platform | 90 days, subject to applicable legal holds. |
| AI working sessions and traces | Working sessions last 24 hours. Associated state is removed after expiry once pending processing has ended, or through conversation invalidation and deletion. This is separate from the platform conversation record. |
| Privacy export packages | Seven days after delivery, followed by scheduled removal. |
| Advice, consent evidence, farm records and uploaded media | According to the record category and organisation’s applicable schedule. Advice and consent evidence may need to outlast the conversation to which they relate. Contact us or your organisation for the schedule covering your records. |
| Website enquiries | While needed to handle the enquiry and any continuing relationship, with review for deletion when that purpose ends. |
| Optional website analytics | Daily aggregate counters older than 13 months are removed when new analytics activity is processed. |
Deletion can involve removing records, removing identifying content or destroying the keys needed to read encrypted personal content. Limited audit, consent, security and legal records may remain where necessary and lawful. Backup copies are addressed through backup retention and restoration controls; deletion is not a promise of immediate physical removal from every backup or independent recipient.
Website chat, cookies and analytics
The public website chat answers company questions using reviewed answers or Cloudflare Workers AI. It receives the question and limited recent conversation context for a response. We do not store its transcripts in the interest database. Hashed technical identifiers support rate limiting; hosting services separately process request information for delivery and security.
Optional analytics remain off until you allow them. They record daily counts of page views, navigation, chat and form interactions, without storing names, email addresses, message text, IP addresses or visitor identifiers in the analytics table. Counts by the audience selected on submitted forms do not link browsing history to a person. These aggregate counts cannot be used to find and remove one person’s activity.
Read our Cookie Policy for the preference cookie, accessibility storage and browser privacy signals. You can change your choice using Cookie settings in the footer.
Security
Safeguards include HTTPS, access controls, organisation separation, purpose and permission checks, encrypted personal content in designated platform records, and audit trails. Protection differs by record and service; no online service can guarantee absolute security. Report suspected unauthorised access to our contact address without sending passwords, codes or sensitive records. Where a personal data breach requires notification, the responsible organisation must inform the regulator and affected people as required by applicable law.
Your choices and rights
Subject to applicable law, you may ask for confirmation and access, correction, deletion, a portable copy, restriction, or information about relevant disclosures; withdraw consent; object to applicable processing and direct marketing; and challenge decisions based solely on automated processing where they have legal or similarly significant effects. Rights can have conditions and exceptions.
Send requests to hello@openfarmslab.com, or to the organisation responsible for your records. Our data rights guide explains what to include and how we verify requests. We aim to respond within 30 days, or any shorter applicable period, and will explain any lawful extension or refusal. You may complain to the Nigeria Data Protection Commission without first contacting us.
Children and assisted use
The service is intended for adults and authorised organisation representatives. It is not directed to children under 18. If you believe a child has provided personal information, contact us so we can assess and address it. People assisting a farmer must explain the relevant notice and record the farmer’s own choice; assistance does not authorise blanket consent or use of someone else’s account.
Changes and contact
We update this policy when the service or our practices change. The revision date identifies this version. Material changes may require additional notice or a new consent before a new use begins. Questions about the responsible entity, your organisation’s role or any part of this policy can be sent to hello@openfarmslab.com.