Privacy Policy

Farmlink Core ("we", "our", "the app") is a business tool used by supply-chain teams — growers, packers, transporters, and coordination-center staff — to track produce crates, manage supplier orders, and coordinate dispatch. This policy explains what information the app collects, why, and how you can control it.

Farmlink Core is provided to your organization on an invitation basis. You will not have an account unless your organization has provisioned one for you.

1. Who runs the app

Farmlink Core is operated by FARMLINK (PRIVATE) LIMITED, registered at 293/E/1, Mandavilla Road, Kesbawa, Piliyandala, Sri Lanka. For any privacy question or data-deletion request, contact support@farmlink.lk.

2. Information we collect

We only collect information needed to operate the app and support your organization's supply-chain workflow.

2.1 Account information

• Email address — used to sign you in.
• Display name and organizational role — provisioned by your organization's administrator.
• Region and permission assignments — determine which parts of the app you can access.

We do not collect your phone number, physical address, date of birth, or government identifiers.

2.2 Operational data

When you use the app in the course of your work, the following business records are stored on our servers:

• Crate records (identifiers, quantities, weights, batch and lot references, timestamps)
• Supplier orders and supplier records
• Dispatch and handover records
• Refrigeration entry, exit, and inventory readings
• Grade conversions and rejection records (including photos, see below)
• Audit logs of who performed which action

This data belongs to your organization and is used to operate the app on your organization's behalf.

2.3 Photos

The app can take photos of rejected produce so an incident is documented. These photos are captured with your device's camera only when you tap "Add photo" in the Record Rejection screen. They are uploaded to secured cloud storage and attached to the rejection record. The app does not access your photo library.

2.4 Camera and Bluetooth

• Camera is used to scan QR codes on crates during sorting, receiving, dispatch, and handover, and to capture rejection photos as described above.
• Bluetooth is used only if you choose to pair an external barcode scanner. If you do not use an external scanner, no Bluetooth data is collected.

The system will prompt you for permission before either is used. You can revoke these permissions at any time in iOS Settings → Farmlink Core.

2.5 Diagnostic and crash data

To diagnose and fix crashes, the app sends anonymous crash reports to Firebase Crashlytics (a Google service). Crash reports include the device model, iOS version, and the sequence of internal events that led to the crash. They do not include your email, name, photos, or business records.

Crash reporting is disabled in development builds and only active in production releases.

2.6 Information we do NOT collect

Farmlink Core does not collect or track:

• Your location, GPS coordinates, or movement
• Contacts, calendar entries, or health data
• Advertising identifiers (IDFA)
• Behavioral analytics or usage tracking

The app does not display advertising and is not funded by advertising.

3. How we use the information

We use the information described above to:

• Authenticate you and enforce your organization's role-based access permissions
• Provide the crate-tracking, order-management, and dispatch features of the app
• Preserve an audit trail of operational actions for your organization's records
• Diagnose crashes and improve the reliability of the app

We do not sell your data, share it with advertisers, or use it to build a marketing profile of you.

4. Where the data is stored

Farmlink Core stores account, operational, and photo data using Google Firebase (Authentication, Cloud Firestore, Cloud Storage, and Cloud Functions), operated by Google LLC. Data is transmitted between the app and Firebase over encrypted HTTPS connections and stored in Firebase's secured infrastructure at asia-southeast1 (Singapore).

Crash reports are stored by Firebase Crashlytics (also Google LLC).

5. Who else can see your data

Access to your data is limited to:

• You — via the app, according to your role's permissions
• Other authorized users in your organization — for example, your regional manager can see supplier orders they placed
• FARMLINK (PRIVATE) LIMITED's support and engineering staff — only when necessary to resolve a support issue or fix a bug, and only under a non-disclosure obligation
• Google Firebase / Google Cloud — as our data processor, subject to Google's own data processing terms

We do not share your data with any other third parties.

6. How long we keep your data

• Account records are kept for as long as your organization keeps you provisioned.
• Operational records (crates, orders, dispatches, rejections) are retained for 7 years to support your organization's audit and traceability obligations.
• Crash reports are retained by Firebase Crashlytics for up to 90 days, then deleted.

When you request account deletion: your access to Farmlink Core is revoked immediately. Your personal profile (email, display name, role, region assignments) is deleted within 30 days of your request. Operational records that your organization is legally required to retain (crate, order, dispatch, and rejection actions) are anonymized rather than deleted, so that they can no longer be tied back to you personally but the underlying audit trail is preserved.

If your organization ceases to use Farmlink Core, we will delete or return your organization's data within 90 days of contract termination.

7. Your rights and choices

You have the right to:

• Access the personal information we hold about you
• Correct any inaccurate information
• Request deletion of your account and personal information
• Object to or restrict certain uses of your information
• Withdraw consent to camera or Bluetooth access at any time in iOS Settings

To exercise any of these rights, tap Settings → Request Account Deletion inside the app. Tapping the button will:

1. Revoke your access to Farmlink Core immediately and sign you out,
2. Notify your organization's administrator to process the request, and
3. Delete your personal profile within 30 days.

For any other request (access, correction, objection, or restriction), email us at support@farmlink.lk. We will respond within 30 days.

Because Farmlink Core is a work tool provided by your organization, some requests (for example, deleting an operational record that your organization is legally required to keep) may need to be routed through your organization's administrator.

8. Children

Farmlink Core is a business tool intended for professional use only. It is not directed at children under 13, and we do not knowingly collect information from children.

9. Changes to this policy

If we make material changes to this policy, we will notify you inside the app before the changes take effect. Minor clarifications may be made without notice; the "Last updated" date at the top of this page will always reflect the most recent revision.

10. Contact

If you have questions about this policy or want to exercise any of your rights, contact us at:

FARMLINK (PRIVATE) LIMITED
293/E/1, Mandavilla Road, Kesbawa, Piliyandala, Sri Lanka
support@farmlink.lk