Privacy policy

Segesio ERP is a farm management platform operated from the Eastern Republic of Uruguay. We are the controller of the personal data described here.

For any privacy question, or to exercise your rights: privacy@segesio.com.

We process only the data needed to provide the service:

• Identity and contact: name, email address, phone, organisation and role.
• Account and access: hashed password, sign-in timestamps, language and preferences. If you sign in with Google or Facebook, we receive your name, email address and profile photo as authorised at that moment — never the password for those accounts.
• Operational data: farms, plots, crops, activities, inputs, machinery, harvests, expenses and income entered by you or your team.
• Location data: plot boundaries and the coordinates of scouting walks and soil samples, when you use those features. In Field Station and when logging a scouting walk, the web app may ask your browser for permission to use the device's location (GPS) while you record a task in the field; you grant that permission from the browser itself and can withdraw it at any time.
• Documents and images: receipts, field photos and files you upload.
• Technical data: IP address, device and browser type, and error logs.
• Billing: the plan you subscribe to and the status of the subscription. We do not store your full card details: the payment gateway processes them.

We do not ask for special-category data (health, ethnic origin, political or religious views). Please do not enter it in free-text fields.

We use the data for the following purposes:

• Providing the service — showing your information, computing indicators, producing reports and operational alerts. Basis: performance of the contract.
• Charging the subscription and keeping accounts. Basis: performance of the contract and legal obligation.
• Providing support and answering your questions. Basis: performance of the contract.
• Keeping the service secure, preventing abuse and diagnosing errors. Basis: legitimate interest.
• Improving the platform using aggregated, anonymised information. Basis: legitimate interest.
• Meeting legal obligations and requests from competent authorities.

We do not sell personal data and we do not share it with third parties for advertising.

Some features — receipt reading, action plans and assisted queries — send the content needed to an AI provider to process it and return a result.

Only what that particular query requires is sent. These results are indicative and do not replace your team's technical judgement.

We work with providers that process data on our behalf and under our instructions, solely to operate the service:

• Infrastructure and database: hosting for the application and the database.
• File storage: receipts, photos and reports, in S3-compatible storage.
• Payments: Stripe and MercadoPago.
• Transactional email: account verification, invitations, alerts and reports.
• Third-party sign-in: if you choose to sign in with Google or Facebook, those providers confirm your identity; we receive only the basic profile data you authorise.
• Artificial intelligence: receipt processing and recommendation generation.
• Text recognition (OCR): receipt reading, depending on the provider configured for your organisation (local Tesseract, AWS Textract or Google Vision).
• Satellite and weather data: vegetation index imagery (Agromonitoring, with Copernicus/Sentinel Hub as a fallback) and weather forecasts (Open-Meteo, Agromonitoring).
• Error monitoring: diagnosing application failures.

We may also share data with authorities where a law or court order requires it.

Some of these providers operate outside Uruguay, mainly in the United States and the European Union. In those cases we require appropriate contractual safeguards for the protection of the data and limit the transfer to what is needed to run the service.

• Account and operational data: while the account is active.
• After closure: up to 12 months, to allow account recovery and to resolve claims; after that it is deleted or anonymised.
• Records with tax or accounting effect: for the periods required by applicable law.
• Backups: rotated periodically, so deleted data may persist in a backup for a limited time before leaving the cycle.

You may exercise, at any time and free of charge, your rights of access, rectification, updating, erasure and objection over your personal data, and withdraw consent where the processing relies on it. To request deletion of your account or data, including data linked to a Google or Facebook sign-in, follow the steps on the Delete my data page (linked in the footer).

Write to privacy@segesio.com. We respond within the periods set by applicable law and may ask you to verify your identity before acting on the request.

In Uruguay the supervisory authority is the Personal Data Regulation and Control Unit (URCDP), where you can lodge a complaint if you believe we did not handle your request properly (Law No. 18.331 and related rules).

If your organisation entered your data as a user of its account, we may need to refer the request to whoever administers it, as they decide about that information.

We apply reasonable technical and organisational measures: encryption in transit (HTTPS), passwords stored with a key-derivation function, separation of data by organisation, role-based access control, secure session cookies and error monitoring.

No system is infallible. Should an incident significantly affect your personal data, we will notify those affected and the competent authority as required by applicable law.

The service is intended for adults acting in a professional capacity. It is not aimed at children and we do not knowingly collect their data.

If we change this policy we update the date in the header and, where the change is material, we announce it by email or inside the platform before it takes effect.