Privacy Policy

Harvie ("we", "us", "our") is a service that helps people discover local farmers markets and producers. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Data controller

Harvie is operated as a solo trader by Elizabeth Vargas, based in Vallentuna, Sweden, acting as the data controller for the personal data described in this policy. For any privacy question, data request or complaint, contact us at p.elizabeth.vargas@gmail.com.

2. What we collect

• Account data: email address and account details, plus optional profile details you choose to add.
• Usage data: favourites, saved markets and producers, and basic preferences.
• Communication data: messages you send us (e.g. support, feedback, removal requests).
• Technical data: IP address, device and browser information, needed to operate and secure the service.
• Analytics data (only with your consent): if you accept analytics in our cookie banner, Google Analytics collects aggregate usage data (pages visited, approximate location, device type) using a randomly assigned identifier. We enable IP anonymisation. You can decline or withdraw consent at any time.

3. Why we use it (legal basis)

• To provide the service and your account — performance of a contract.
• To keep the service secure, prevent abuse, and improve it — legitimate interest.
• To send service emails (e.g. password reset, account notifications) — performance of a contract.
• To send optional updates or newsletters — your consent, which you can withdraw at any time.
• To comply with legal obligations — legal obligation.

4. How long we keep it

We keep your personal data for as long as your account is active. When you delete your account, we keep a minimal copy for 30 to 90 days to handle backups, security, fraud prevention and any legal obligations. After that, your personal data is permanently erased or fully anonymised.

Inactive accounts: if you don't use Harvie for 12 to 24 months, we will email you to ask whether you still want to keep your account. If we don't receive a response within 30 days, the account will be deleted, followed by the same 30–90 day cleanup period described above.

Access and activity logs: technical logs of sign-ins and key actions are retained for 90 days to 12 months. You can request a copy of the logs related to your account at any time.

5. Sharing your data

We do not sell your personal data. We share it only with trusted service providers (such as our hosting and database provider) that process data on our behalf under a data processing agreement, and only to the extent needed to run Harvie. Where data leaves the EU/EEA, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses.

6. Your GDPR rights

You have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your account and data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time;
• lodge a complaint with your national data protection authority — in Sweden, this is IMY (Integritetsskyddsmyndigheten), imy.se.

To exercise any of these rights — including account deletion or a data request — email us at p.elizabeth.vargas@gmail.com. We respond within one month. For complex requests, we may extend this by up to two additional months and will notify you of the extension.

7. Security

We use modern security practices — encrypted connections (HTTPS), securely stored credentials, role-based access, and a managed cloud database — to protect your data. No system is perfectly secure, but we work hard to keep yours safe.

8. Cookies and similar storage

Strictly necessary — always active, no consent required. We use local and session storage to keep you signed in (Supabase auth session), remember your language preference, preserve your map view between pages, and remember whether you've seen the onboarding tour. We do not use any third-party advertising cookies.

Analytics (optional, consent-based) — only loaded if you click "Accept" in our cookie banner. We use Google Analytics 4 (cookies _ga, _ga_*) to understand aggregate usage of the site. IP addresses are anonymised. We do not use Google Analytics for advertising or cross-site profiling. If you decline, no analytics cookies are set.

Open cookie settings to change your choice at any time.

9. Children

Harvie is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy as the service evolves. When we make meaningful changes, we will update the date at the top and, if appropriate, notify you by email.

11. Contact

Questions, requests, or concerns? Write to p.elizabeth.vargas@gmail.com.