AGRO-AI connects sensitive agricultural systems, field evidence, machine records, water data, files and enterprise workflows. We treat data governance as part of the product architecture: authorization, tenant boundaries, purpose limitation, provenance, human control and evidence-backed security practices.
These principles apply across AGRO-AI products and services, including the Enterprise Portal, Field Intelligence, Platform API and customer-authorized integrations. Contractual terms may add product- or customer-specific requirements.
Customers retain the rights they have in Customer Data. AGRO-AI receives only the rights needed to provide, secure, support and operate authorized services, plus any additional uses a customer expressly authorizes.
We seek to collect or access data because it serves an identified product, security, support, compliance or customer-authorized purpose—not because data might become useful later.
Connected systems and organization data should be accessed through authorized identities, scopes, roles and tenant boundaries. Connector credentials and secrets are not intended to become model context.
Field geometry, yield, irrigation, equipment telemetry, imagery, agronomic records and operational files can be commercially sensitive even when they are not personal information. Our governance model treats them accordingly.
We distinguish inference, retrieval, evaluation, product improvement and model training. Customer Data is not automatically treated as a general-purpose training asset merely because it passes through an intelligent workflow.
We do not intentionally publish certification, retention, residency, deletion, encryption or model-training claims unless the claim can be tied to actual controls, configuration or contractual evidence.
The exact data depends on the products, connectors and workflows a customer enables.
| Data class | Examples | Why it matters | Governance expectation |
|---|---|---|---|
| Account & identity data | Name, work email, organization, role, authentication and security metadata. | Can identify users and is subject to privacy and security requirements. | Access control, minimization, lawful processing, rights handling and retention controls. |
| Restricted operational farm data | Field boundaries, precise locations, crop plans, irrigation, controller records, yield, equipment telemetry, imagery, scouting, agronomic records and operational documents. | Can reveal commercial strategy, production conditions and operational weaknesses even where it is not personal data. | Tenant isolation, purpose limitation, least-privilege access, controlled sharing, portability and deletion governance. |
| Connected-system data | Data retrieved from customer-authorized equipment, farm platforms, storage providers, satellite/data partners and enterprise systems. | May remain subject to third-party terms and customer instructions. | Scope-aware connectors, documented authorization and revocation paths. |
| Field media & voice | Photos, video, audio, transcripts, geolocation and field observations. | May contain personal, biometric-adjacent, location or commercially sensitive information. | Purpose-specific handling, access restrictions and clear retention/deletion treatment. |
| Derived intelligence | Recommendations, classifications, alerts, forecasts, summaries, confidence signals and verification records. | Can affect operational decisions and may reveal information inferred from customer inputs. | Provenance, traceability, human review for consequential actions and controlled reuse. |
| Telemetry & security data | Request IDs, timestamps, API operations, latency, rate-limit events, audit events, IP/security signals and error logs. | Needed for service reliability, metering and defense. | Bounded logging, restricted access and retention tied to operational need. |
AGRO-AI processes customer-controlled operational data to provide authorized services and workflows. Additional materially different uses should require a valid legal basis or customer authorization.
AGRO-AI does not position customer farm data as a data-broker product. Any disclosure to service providers, integrations, legal authorities or transaction counterparties must have a defined basis and appropriate safeguards.
Inference is not the same as training. AGRO-AI's governance standard separates transient model inference and retrieval from model improvement or training uses. Any customer-data training use must be specifically authorized and technically supported before it is represented as enabled.
Where supported by the applicable product and contract, customers should be able to retrieve relevant customer-controlled data in a practical format and request deletion when the relationship ends, subject to lawful retention, backups, security records and technical constraints disclosed in the applicable terms.
Intelligence can recommend, summarize and prepare actions. Consequential operational actions should remain subject to authorization and product controls rather than being silently executed from untrusted model output.
Where the product supports it, AGRO-AI preserves source, timing, evidence and workflow context so teams can understand how an operational conclusion was produced and whether it was recommended, scheduled, applied or verified.
AGRO-AI uses intelligent systems to reason over agricultural context. The governing rule is that model access must not erase customer boundaries or turn sensitive operational data into an unrestricted asset.
Authorized data may be supplied to a model or reasoning system to answer a request, classify evidence or produce a recommendation. Provider configuration and contractual controls must be appropriate to the product context.
Organization authorization and tenant filtering should occur before evidence is selected for model context. A model is not the security boundary.
Customer Data is not automatically designated for shared-model training. Any such use requires an approved purpose, legal/contractual basis, provider controls and an evidence-backed public statement.
Role, organization and service-account boundaries are expected to determine what users and systems can access.
API keys, connector credentials and model-provider credentials should be held server-side or in appropriate secret-management systems, not exposed in browser code or model prompts.
Material access, configuration and workflow events should generate enough evidence to investigate incidents, support customers and validate controls.
Security-sensitive changes should be reviewed and tested proportionate to risk. Trust statements are maintained separately from marketing copy so unsupported claims can be blocked.
Confirmed security incidents are assessed, contained, investigated and communicated according to applicable law, contracts and incident-response procedures.
AGRO-AI does not claim certifications or audit results that have not been issued. Enterprise customers may request current security and contractual materials through the company contact channel.
Privacy law applies to personal information; AGRO-AI's broader data-governance program also covers sensitive agricultural and commercial data that may fall outside conventional privacy definitions.
Depending on jurisdiction and role, individuals may have rights relating to access, correction, deletion, portability, restriction, objection, consent withdrawal, sale/sharing or profiling. Requests are evaluated under applicable law and contractual roles.
Where AGRO-AI processes personal data on behalf of a customer, the customer may be the controller/business and AGRO-AI may act as processor/service provider. The applicable DPA and enterprise agreement govern those activities.
Cross-border processing is governed using mechanisms appropriate to the relevant jurisdiction and actual provider/data-flow configuration. We do not publish a blanket transfer-mechanism claim that is broader than the underlying implementation.
Retention should be tied to product delivery, security, auditability, legal obligations, dispute handling and legitimate operational requirements. Product-specific periods are published only when they are technically enforced and verified.