AGRO-AI Data Governance Standard

How AGRO-AI classifies, authorizes, processes, shares, retains, exports and deletes customer and operational data across its products.

Published September 15, 2026 · Applies across AGRO-AI services subject to applicable contracts and law.

1. Scope

This standard covers data processed through the AGRO-AI Enterprise Portal, Field Intelligence, Platform API, connected systems, customer uploads, support operations and related enterprise services. It applies to personal information and to commercially sensitive agricultural data that may not meet a statutory definition of personal information.

2. Data classes

• Public data: information intentionally made public or lawfully obtained from public sources.
• Internal data: operational information intended for AGRO-AI personnel and approved service providers.
• Customer Data: information submitted by or for a customer, or retrieved from a customer-authorized system.
• Restricted Operational Data: field geometry, precise location, yield, crop plans, irrigation, controller data, machine telemetry, imagery, agronomic observations, financial/operational records and similar commercially sensitive material.
• Personal information: information relating to an identified or reasonably identifiable person, as defined by applicable law.
• Credentials and secrets: passwords, tokens, API keys, connector credentials, signing keys and comparable authentication material.
• Derived intelligence: recommendations, forecasts, classifications, summaries, alerts, confidence signals, verification results and other outputs derived from source data.

3. Collection and purpose limitation

AGRO-AI seeks to collect, receive or access data only for an identified service, security, support, compliance or customer-authorized purpose. Product teams should document the purpose, source, data class, owner and expected lifecycle of material new data flows before production use.

4. Authorization and tenant boundaries

Customer and integration access is expected to be scoped to the authenticated organization, project, user, service account or connector authorization. Authorization is enforced by application and infrastructure controls rather than delegated to a language model. Data retrieval for intelligent workflows should occur only after organization and permission boundaries are applied.

5. Connected systems

AGRO-AI may connect to systems selected or authorized by a customer. Connector access should use the minimum practical permissions for the intended workflow. Revoking a connector should prevent future authorized retrieval through that connector, subject to data already retained under applicable product, security, backup or contractual rules.

6. Data use and sharing

AGRO-AI may use Customer Data to provide, maintain, secure, support and improve the services where such use is permitted by contract and law. Materially different uses require an appropriate legal or contractual basis. Disclosures may occur to approved service providers, at a customer's direction, to protect the service and legal rights, to comply with lawful process, or in connection with a corporate transaction subject to appropriate safeguards.

7. Agricultural data governance

Operational farm data is treated as sensitive when disclosure could materially expose a customer's operations, economics, field conditions, production strategy, infrastructure or competitive position. This sensitivity applies whether or not a privacy statute classifies the data as personal information.

8. AI and model processing

Model inference, retrieval, evaluation, product analytics and model training are distinct activities. Customer Data is not automatically designated for shared-model training. Any training or generalized model-improvement use involving Customer Data must have an approved purpose, an appropriate legal/contractual basis, compatible provider controls and an evidence-backed customer statement. See the AI & Model Data Use Standard.

9. De-identification and aggregation

Where AGRO-AI uses de-identified or aggregated information, the method should be appropriate to the sensitivity and context of the source data. De-identification must not be represented as irreversible unless the technical method and surrounding controls support that claim. Re-identification attempts inconsistent with authorized purposes are prohibited.

10. Retention

Retention is tied to service delivery, security, auditability, billing, support, legal obligations, dispute handling and legitimate operational needs. AGRO-AI does not publish a universal retention duration where production systems apply different rules. Product-specific periods should be published only after they are verified against active stores, logs, derived indexes, backups and deletion jobs.

11. Export, portability and return

Where supported by the relevant product and agreement, customers may export or request return of Customer Data in a practical format. Portability does not require AGRO-AI to disclose proprietary software, security-sensitive information, third-party confidential information or derived materials that are not contractually included.

12. Deletion

Deletion requests are evaluated against contractual obligations, legal holds, security needs, backup architecture and technical dependencies. Production deletion representations must match actual behavior across primary stores and relevant derived systems. Backup copies may persist for a bounded period where immediate selective deletion is technically impractical, with access restricted and copies expiring under normal backup lifecycle controls.

13. Provenance and verification

Where applicable, AGRO-AI seeks to preserve source references, timestamps, evidence, recommendation state and workflow status so customers can distinguish what was observed, inferred, recommended, scheduled, applied or verified.

14. Personnel and service-provider access

Access should be limited to personnel and service providers with a legitimate operational need and appropriate confidentiality obligations. Privileged access should be separately controlled and auditable where technically supported.

15. Incidents and lawful requests

Potential security incidents are assessed under AGRO-AI's incident-response procedures. Confirmed incidents involving covered data are handled and communicated according to applicable law and contract. Government or legal requests are reviewed for validity and scope, and customers are notified where legally permitted and appropriate.

16. Governance of public claims

AGRO-AI maintains a principle that trust claims should be evidence-backed. Statements about certifications, encryption, residency, retention, deletion, subprocessors or model-training behavior should not be published more broadly than the controls and evidence support.

17. Questions

Data-governance questions may be sent to contact@agroai-pilot.com.