Privacy notice

This notice explains what personal data the Peato app, its backend service and this website handle, and what you can do about it. It is written in plain language on purpose.

Who is responsible

The controller is Peato (“Peato”, “we”). Contact: hello@peato.farm.

What we collect, and why

Data	Why
Account: email address, display name, job title, language, a hashed password, whether your email is verified, and which version of the terms you accepted and when.	To create and secure your account, send verification and password-reset emails, and show the app in your language.
Profile picture (optional).	To show your avatar. Stored with our file-storage provider.
What you create in the app: workspace or organisation name, fields and their boundaries, notes, alerts and their status, inspections, interventions, activity, reports, devices, and your preferences.	To provide the service: this is the content you ask Peato to keep.
Sign-in sessions: a hashed refresh token, device label, browser or app identifier (user agent), IP address and timestamps.	To keep you signed in, let you sign out other devices, and detect misuse.
Server logs: IP address and request details.	To run, secure and debug the service, and to limit abuse.
Location, only if you allow it on your phone.	To centre the map on where you are. It is used for that screen and is not stored by Peato.

We do not sell personal data, show ads, or use advertising or analytics trackers in the app or on this website.

Why we are allowed to

• Contract: providing the account and the features you use.
• Legitimate interests: keeping the service secure, preventing abuse, and fixing faults.
• Consent: optional things such as location access and a profile picture. You can withdraw consent in your phone settings or by removing the picture.

Who else handles data

We use a small number of providers, only to run the service:

• Application hosting and database: Northflank.
• File storage for profile pictures: Bunny.net.
• Map imagery: your device requests map tiles directly from the provider, currently MapTiler and the Estonian Land and Spatial Development Board (Maa- ja Ruumiamet). They necessarily see your IP address and the area you view.
• Email delivery for verification and password-reset messages, through an SMTP provider.
• Error reporting, if switched on, to find bugs. Sentry.

Where a provider is outside the European Economic Area we rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

• Account and workspace data: until you delete your account.
• Sign-in sessions: refresh tokens expire after 30 days and are removed after expiry.
• Logs: kept only as long as needed for security and debugging.
• Backups: deleted data can remain in backups for a limited time before they are overwritten.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and move it to another service. To delete your account and its data, or to use any other right, write to hello@peato.farm. We will answer within one month.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the authority in your own country.

Security

Traffic is encrypted with HTTPS. Passwords are stored only as salted hashes. Access tokens are short-lived and refresh tokens are rotated. No system is perfectly secure, and if a breach affects you we will tell you and the authorities as the law requires.

Children

Peato is for people who manage or study land professionally. It is not meant for children under 16 and we do not knowingly collect their data.

This website

This website sets no cookies, uses no analytics, and loads its fonts and images from its own server. Your hosting provider's standard server logs apply. If you send a message through a form, we receive what you write and use it only to reply.

Changes

If we change this notice in a way that matters, we will update the date above and, for account holders, tell you in the app or by email.