Privacy policy.

Prime Origins is responsible for the website at primeorigins.org and for account data on the Service (the Prime Origins software and its live demo). For the workspace data you enter about your own business, plants, products, stores and staff, you are the controller and we process it on your behalf.

Questions or requests: oliver@primeorigins.org.

Account details: your name, work email, company, role and the workspace you belong to. The Service does not currently use passwords.

Workspace data: whatever you and your team enter into the product, such as rooms, batches, harvests, inventory, stores, orders, invoices, tasks, compliance events and the names and roles of your users.

Demo form and contact form submissions: name, email, company, state, role, size and your message.

Technical logs: our hosting provider records standard request logs (such as IP address, page requested and browser type) to run and secure the site. We do not run analytics, advertising trackers or fingerprinting.

Demo copies: when you open the live demo we create a private copy of a fictional farm tied to a session cookie. It contains no real data unless you type some in, which you should not.

To run the Service for you: signing you in, showing your workspace and keeping its records and audit trail. This is necessary to perform our contract with you.

To reply to you when you book a demo or send a message. Each request is stored and a copy is emailed to our team so someone can respond. This is our legitimate interest in responding to people who ask us to.

To keep the Service secure, fix problems and understand which features are used, using aggregated data where we can. This is our legitimate interest in running a reliable product.

The website and the Service run on Vercel. Workspace data, demo copies and form submissions are stored with Upstash. Notification emails about demo and contact requests are sent through Resend. These providers may process data in the United States and the European Union, under their standard data-processing terms.

In this version the Service does not transmit data to any state track-and-trace system or to Greenback: state reporting and Greenback settlement are simulated inside Prime Origins. If that changes, we will update this policy before any data is sent. Links to other Prime Origins ecosystem sites are ordinary links; no account or personal data is shared with them.

Account and workspace data: for as long as your workspace is open. If you ask us to close it, we delete it unless the law requires us to keep it longer.

Demo copies: deleted automatically 7 days after they were last used.

Demo and contact form submissions: kept so we can follow up and remember what we discussed. Ask us and we will delete yours.

Depending on where you are, data-protection law (such as UK or EU GDPR) lets you ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to or restrict how we use it, and ask for it in a portable form. Email oliver@primeorigins.org and we will answer within one month.

If you are a user of a customer's workspace, your employer is the controller of the data in that workspace; we will pass your request to them and help them answer it.

If you are unhappy with how we handle your data you can complain to your local data-protection regulator; in the UK that is the Information Commissioner's Office at ico.org.uk.

We set one cookie: a session cookie that keeps you signed in to your workspace or your demo copy. It is essential, so no consent banner is needed. We set no advertising or cross-site tracking cookies.

Data is encrypted in transit (HTTPS). Access to production data is limited to the people who need it to run the Service. Every change in a workspace is written to an audit trail with who made it and when.

No system is perfectly secure. If we learn of a breach that affects your data we will tell you and, where required, the regulator, without undue delay.

If we change this policy in a way that matters, we will email workspace owners and note the new date at the top of this page. Continued use after that date means the new policy applies.