Privacy policy

Data controller

Kaskal, Calle de la Huerta 27, 46001 Valencia, España, NIF B47385216. Privacy contact: [email protected].

What data we process

Account data: email, name, password (stored only as a bcrypt hash), language, date and version of your acceptance of these documents.

Profile data you choose to add: public name, bio, location, country, profile photo, preferences (units, consent to geographic data).

Project data: the land's location (required to create a project; you can keep it private or make it public and, if public, exact or approximate), designs, plants, harvests, diary, reminders.

Content you publish: posts, comments, reactions, market listings, reviews, courses, private messages, plant-wiki contributions.

Expert or organisation data (if you apply): skills, years of experience, credential documents, organisation details.

Professional account data (if you choose it): company name, tax id, country, sector, size and land managed, the owner's or legal representative's first and last name, and the list of people who belong to it. Only the company's people and Kaskal's administration see them.

Learning data: enrolments, progress, assessment answers, certificates, questions asked in live classes.

Field logbook: parcels (including the SIGPAC land reference), farming operations and, for plant-protection treatments, the applicator's name and licence number, because the law requires them.

Field mode: the phone's position guides you on the land and stays on the device; it is stored only when you mark a plant as planted and the GPS is precise within 3 metres. Without signal, actions and photos stay on the phone until they are sent, and are wiped when you log out.

Technical and security data: IP address (used in memory to limit abuse, not stored in a profile), technical error logs that do not identify the user.

Payment data: once payments are enabled they are handled by Stripe; we never see or store card details.

Purposes and legal bases

Providing the service you asked for (account, projects, community, market, academy): performance of a contract, Art. 6(1)(b) GDPR.

Morning reminders email (if switched on by the platform): performance of the contract, with a link to turn it off in every email and in the app.

Security, abuse and fraud prevention, service integrity: legitimate interest, Art. 6(1)(f).

Publishing your project on the community map and using geographic data: your consent, Art. 6(1)(a), which you can withdraw at any time in settings.

Automated emails from creators you follow: legitimate interest/consent, with an unsubscribe link in every email.

Tax and accounting obligations on transactions: legal obligation, Art. 6(1)(c).

Providers (processors)

Cloudflare (private storage for files and attachments, R2 in the EU jurisdiction).

Artificial intelligence services: none is active today, and no text is sent to any AI provider. If we enable one in the future (for semantic search and plant suggestions), we will first update this policy to name it and let you know.

Resend (email delivery), Bunny.net (lesson videos), Mux (live classes), Stripe (payments, once enabled).

Phone notifications (only if you turn them on): your browser's push service (Google, Apple or Mozilla) receives a technical device address and an empty signal; the phone asks Kaskal for the reminder text directly, so it doesn't pass through them. You can turn them off at any time.

In your browser: OpenStreetMap Nominatim (address search in the project wizard) and map providers (OpenStreetMap, Esri, the national mapping agencies of Spain (IGN), France (IGN) and the Netherlands (Kadaster/PDOK) for aerial photos in those countries) receive your IP when a map loads.

The server hosting provider: Railway Corporation (USA), with servers in Amsterdam (Netherlands, EU); transfers covered by the EU Standard Contractual Clauses.

Some providers are based in the US: transfers rely on the European Commission's Standard Contractual Clauses and/or the Data Privacy Framework.

Who sees your data

People you invite to collaborate on a project see the design (not your notes or reminders) and can only propose changes.

Kaskal has no public content: everything is visible to registered users only. What you publish in the community, market or academy is visible to other users; private projects, your diary and messages are not.

We do not sell your data and we use no advertising or analytics trackers.

How long we keep it

As long as your account exists. If you delete it, the data is erased immediately; backups are overwritten within 14 days.

Password reset links expire after 1 hour. Technical logs rotate automatically.

Accounting records of transactions are kept for as long as the law requires.

Your edits to the shared plant catalogue remain, without your name.

Your rights

Access, rectification, erasure, restriction, objection, portability and withdrawal of consent (Arts. 15–22 GDPR).

In Settings → Privacy & data you can download all your data and permanently delete your account yourself.

For anything else write to [email protected]. You may also lodge a complaint with a supervisory authority (e.g. the Italian Garante or the Spanish AEPD).

Minimum age and automated decisions

The service is for people aged 14 or over.

We make no automated decisions with legal effects on you. AI suggestions are guidance only.