Privacy notice

Last reviewed: September 2026. This notice describes what this website actually does; it was written from the website's source code and deployment configuration and is updated whenever they change.

1. Who is responsible

This website, plantguard.ai, and the customer portal on it are operated by PlantGuard (the operator of the PlantGuard.ai brand; the legal entity details are provided on request and will be published here once confirmed) — "we" in this notice. Contact for anything in this notice: sales@plantguard.ai.

2. The installed product sends us nothing

The PlantGuard.ai application is installed on a server inside your own network. It is designed to operate locally: it does not send telemetry, usage data, crash reports, license checks, update checks, device data, credentials or AI prompts to PlantGuard, and it makes no connection to plantguard.ai. The only optional integrations that reach the internet are ones an administrator deliberately configures (a cloud AI provider, Microsoft Defender for Endpoint), and those go to that provider, not to us. See the Trust Center for the complete list. The rest of this notice is about the website.

3. What the website collects

Visiting pages

Our web server writes a standard access log for each request: the requesting IP address, the time, the page requested, the response code and the browser's user-agent string. These logs are used for security monitoring and troubleshooting and are not combined with any other data about you. The website loads no third-party scripts, fonts, images or embeds, so no other party learns of your visit through this site.

Contact form and early-access sign-up

The name, work e-mail address, company or plant, topic and message you enter, together with the IP address the form was sent from. We keep them to answer you and to prevent abuse of the form (the IP address is used to limit repeated submissions).

Security vulnerability reports

What you write in the report and, if you choose to give them, your name and e-mail address, together with the sending IP address. Reports are read only by the people handling security and are kept for as long as the issue is being tracked and as a record of how it was resolved.

Customer portal

For invited users of a licensed or evaluating organization: your name, e-mail address, organization, a password hash (never the password), sign-in attempts (address, time, success or failure), active sessions (address and browser), which release files or license files you downloaded and when, and support requests you submit. These records support license entitlement, protect the account, and provide a security audit trail. Actions taken by staff and portal users are recorded in an audit log with the acting user and IP address.

4. Cookies

This website sets two cookies, both essential and both first-party: pgsite_session — the signed sign-in session for portal users, which is not set until you sign in and expires when you close the browser or after inactivity — and pgsite_flash, a two-minute cookie that carries a one-time confirmation message after you submit a form. Both are HttpOnly, SameSite=Lax and sent only over HTTPS. There are no analytics, advertising, preference or tracking cookies, and no cookie banner because none is needed.

5. Analytics and tracking

None. We do not use web analytics, tag managers, tracking pixels, session recording, A/B testing services or social-media plug-ins. We know how the site is used only from the server access log described above.

6. Who else processes the data

• Hosting. The website runs on a virtual server we rent from a cloud provider; the provider and region are stated on request and will be published here once confirmed. The hosting provider operates the physical infrastructure and does not have a business reason to access application data.
• Certificate authority. The site's HTTPS certificate is issued automatically by Let's Encrypt; that involves our server, not your data.
• E-mail. If you send us a form or a portal request, a notification containing what you submitted is sent to our own mailbox through our e-mail provider, and our reply to you travels by e-mail in the ordinary way. Portal invitations and password-reset links are sent the same way.

We do not sell, rent or share your data with anyone else, and we do not use it for advertising.

7. International processing

Data is stored where the website is hosted (see above). If you contact us from another country, your message is transferred to that location so that we can answer it.

8. How long we keep it

• Server access logs: rotated by the hosting platform; not kept beyond ordinary operational retention.
• Contact, early-access and security messages: until the enquiry is closed and for a reasonable period afterwards as a business record, unless you ask us to delete them earlier.
• Portal accounts and their download and sign-in history: for the life of the organization's license or evaluation agreement and a reasonable period afterwards, as entitlement and security records.
• Sessions: removed when you sign out or when they expire. Sign-in attempt records are kept with the account's security history.

9. Security of the website

All traffic is served over HTTPS with HSTS. Portal passwords are stored as salted hashes, sign-in is rate-limited and locked out after repeated failures, sessions expire when idle, and the site sends a restrictive Content-Security-Policy and related security headers. Release files and license files are stored outside the web root and served only to signed-in users of the entitled organization. If you find a weakness, please use the security disclosure page.

10. Your choices and requests

You can ask us what we hold about you, ask for it to be corrected or deleted, or object to how it is used, by writing to sales@plantguard.ai. We will act on a request from the address the data belongs to, or after a reasonable identity check. Portal users can also ask their organization's administrator or our support team to deactivate their account. Depending on where you live you may have statutory rights beyond these and the right to complain to a supervisory authority; nothing here limits them.

11. Children

This website is for businesses and is not directed at children; we do not knowingly collect information from anyone under 18.

12. Changes

When the website's behaviour changes, this notice changes with it and the review date at the top is updated. Material changes affecting portal users are announced in the portal.