Legal document

Privacy policy and GDPR information

Last updated: April 12, 2026

This policy describes what personal data is collected on agroswarm.com and related sub-pages (the Service), for what purpose it is processed, with whom it may be shared, and what rights data subjects have, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Personal Data Protection Act of 10 May 2018.

1. Data controller

The controller of personal data collected through the Service is:

Inn4U Przemysław Sekalski
sole proprietorship (Polish JDG)
Tax ID (NIP): 7272362028
Registered address: as listed in the Polish Business Registry (CEIDG), available at prod.ceidg.gov.pl by tax ID lookup
Contact for data protection matters: office@agroswarm.com

The controller has not appointed a Data Protection Officer, as they are not required to do so under Article 37 GDPR. Please direct all data protection enquiries to the email address above.

2. What data we collect

The scope of processed data depends on how you use the Service.

2.1. Waitlist form data

If you voluntarily complete the “Join the waitlist” form, we process the following data (some fields are required, others optional):

• Email address(required) — for follow-up contact
• Country(required) — to prioritize launch regions
• Phone number (optional)
• Role (farmer or drone operator)
• Business profile fields depending on the selected role:
  • Farmer: total field area (ha), planned first spray date
  • Drone operator: number of pilots, number of drones, operating region (free-text description), availability date
• Geographic location(optional) — latitude and longitude, accuracy in meters (when obtained via GPS), service radius in kilometers (operators), and the data source (“GPS” or “map click”). Location data is transmitted only if you actively use the “Use my location” button or place a pin on the map. We do not collect location data without your explicit action.
• Technical metadata: interface language code you used (e.g. “en”), the referring page URL, and the User-Agent string of your browser

2.2. Server logs (hosting)

The Service is hosted on Firebase Hosting (Google LLC). Like any web server, Firebase Hosting writes technical logs containing: IP address, request timestamp, request path (URL), HTTP response code, and browser identifier (User-Agent). The controller does not have active access to these logs — they are stored according to Google Cloud's retention policy.

2.3. Browser storage (localStorage)

The Service stores one value in your browser's local storage: the key agroswarm_consent_v1 which holds your choice from the cookie banner (value all or essential). This value is used solely to prevent the banner from re-appearing on subsequent visits.

3. Purpose of processing and legal basis

Pursuant to Article 6(1) GDPR, we process your data for the following purposes and on the following legal bases:

• Waitlist form— Article 6(1)(a) GDPR (voluntary consent expressed by submitting the form). Purpose: to contact you about the launch of the AgroSwarm platform in your region and to tailor our launch communications to your profile.
• Server logs and technical metadata — Article 6(1)(f) GDPR (legitimate interest of the controller in ensuring the security, availability and proper operation of the Service, including abuse prevention).
• Consent marker in localStorage — Article 6(1)(f) GDPR (legitimate interest in remembering your decision so we do not repeatedly ask for it).

Providing data in the waitlist form is voluntary, but necessary to achieve the purpose for which the form was created. Without an email address we cannot add you to the waitlist.

4. Recipients (data processors)

To operate the Service we use third-party providers who process data on behalf of the controller under data processing agreements or service terms compatible with the requirements of Article 28 GDPR:

• Google LLC (Firebase Hosting)— hosting of the Service's static files. Google sees standard HTTP logs (IP, User-Agent, request path) as part of the normal operation of the hosting service.
• Google LLC (Google Sheets and Google Apps Script) — data submitted through the waitlist form is written to a Google spreadsheet via a Google Apps Script web app. Google acts as a data processor.
• OpenStreetMap Foundation (tile.openstreetmap.org) — when you open the interactive map in the form, your browser fetches map tiles directly from OSM servers. OSM then records only standard HTTP logs (IP, User-Agent). The controller does not send any form data to OSM — the connection is a direct browser-to-OSM request.

We do not sell, rent, or disclose your personal data to any other parties for marketing purposes.

5. International transfers outside the EEA

Some of our providers are located outside the European Economic Area, in particular Google LLC (United States). Such transfers take place only under mechanisms required by GDPR:

• Standard Contractual Clauses (SCC) approved by the European Commission (Implementing Decision (EU) 2021/914 of 4 June 2021),
• EU-US Data Privacy Framework(the transfer framework approved by the European Commission's decision of 10 July 2023) — Google LLC is a certified participant in DPF.

For details about how Google processes your data, see the Google Privacy Policy and the Google Cloud Data Processing Addendum.

6. Retention periods

We keep data no longer than necessary for the purposes for which it was collected:

• Waitlist form data— from the moment of submission until the AgroSwarm platform launches in your country of residence, plus 12 months (for launch-related communication). After that period the data is deleted or irreversibly anonymized. If you exercise your right to erasure (Article 17 GDPR) earlier, we will remove the data promptly, within 30 days at most.
• Firebase Hosting server logs— according to Google Cloud retention policy (typically 30–90 days).
• LocalStorage consent marker— until you clear your browser's local storage or change your decision.

7. Your rights

Under GDPR you have the following rights:

• Right of access(Article 15 GDPR) — you may request information about what data we process and obtain a copy of it.
• Right to rectification(Article 16 GDPR) — if your data is inaccurate or incomplete, you may request correction or completion.
• Right to erasure (“right to be forgotten”) (Article 17 GDPR) — you may request deletion of your data when it is no longer needed for the purposes for which it was collected, or when you withdraw your consent.
• Right to restriction of processing (Article 18 GDPR).
• Right to data portability(Article 20 GDPR) — you may receive your data in a structured, commonly used format (e.g. CSV, JSON) and transmit it to another controller.
• Right to object(Article 21 GDPR) — to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, send an email to office@agroswarm.com with the subject “GDPR — [request name]” (e.g. “GDPR — data erasure”). We respond within 30 days of receiving the request.

Right to lodge a complaint: you also have the right to lodge a complaint with a supervisory authority. The Polish authority is: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. Website: uodo.gov.pl. If you reside in another EU/EEA Member State, you may lodge a complaint with the data protection authority of that Member State.

8. Cookies and similar technologies

The Service uses two categories of technologies that store information on your device:

8.1. Essential (always active)

The agroswarm_consent_v1 key in localStorage stores your choice from the cookie banner (values all or essential). Legal basis: legitimate interest (Article 6(1)(f) GDPR). Retention: until you clear your browser's local storage or change your decision.

8.2. Analytics (optional — only with your consent)

The Service uses Google Analytics 4 (GA4) provided by Google LLC to measure traffic on the Service, understand which content resonates with visitors, and improve how the site performs. GA4 loads only after your explicit consent expressed via the “Accept all” button in the cookie banner. If you choose “Essential only”, GA4 will not be loaded and no analytics cookies will be set.

GA4 uses the following cookies:

• _ga — unique user identifier used to distinguish sessions. Lifetime: 2 years.
• _ga_FSDDR8QBTB — a cookie used by GA4 to maintain session state for the specific property. Lifetime: 2 years.

Legal basis for processing: consent (Article 6(1)(a) GDPR). We have enabled IP anonymisation (anonymize_ip: true) in GA4 — Google truncates your IP address before storing it, so you are not uniquely identified. Google processes the data in the US — see section 5 above for details about international data transfers.

You may withdraw consent at any time by clearing your browser's local storage (which removes the stored consent value) or by using the GA4 browser opt-out at tools.google.com/dlpage/gaoptout.

9. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or unauthorised modification, including:

• All connections to the Service are made exclusively over the encrypted HTTPS (TLS 1.2+) protocol.
• Access to the Google Sheets spreadsheet containing waitlist data is limited to the controller (Google account with two-factor authentication).
• Form data is transmitted directly from the user's browser to Google Sheets via Google Apps Script — it is not buffered or stored on intermediate servers.
• The controller regularly updates the Service's software components, including frontend libraries, to eliminate security vulnerabilities.

10. Changes to this policy

This policy may be updated from time to time — for example due to changes in law, the addition of new features to the Service, or changes in providers. We will signal any material change by updating the “Last updated” date in the header of the document. By continuing to use the Service after changes are published you accept the updated policy.

11. Contact

For any matter concerning the processing of your personal data, please contact the controller:

Inn4U Przemysław Sekalski
NIP: 7272362028
E-mail: office@agroswarm.com

This document is also available in Polish: Wersja polska. In case of any discrepancy between language versions, the Polish version is binding, as the data controller is a Polish sole proprietor.