Privacy Policy

1. Scope of this Policy

This Privacy Policy applies to all services operated by Hardcastle Agrotech Solutions Inc, doing business as MapMyCrop and headquartered in New York, USA, and its affiliates (“MapMyCrop”, “we”, “us”), including mapmycrop.com, the MapMyCrop Platform API, the MapMyCrop mobile applications, and any related enterprise products.

It covers data we collect when you visit our website, request a demo, sign a contract, use our products, or interact with our support team. For customers processing personal data through our platform on behalf of their own users (e.g., farmer mobile apps), the customer’s privacy policy governs that data — and we act as their processor under the terms of our customer agreement.

2. Data We Collect

We collect three categories of data, depending on your interaction with MapMyCrop:

A. Data you provide directly

Account information — name, email, phone, role, organization
Demo requests and contact form submissions
Contract and billing information
Support correspondence and feedback

B. Data collected automatically

Device, browser, IP address, and session metadata
Pages visited, features used, and interaction timestamps
Cookies and similar tracking technologies (see Section 8)

C. Customer-provided geospatial & agricultural data

Field boundary polygons uploaded by enterprise customers
Farmer registry data (where customers opt to load it)
Yield history, soil samples, and management practice records

3. How We Use Data

We use the data we collect for the following purposes:

To operate, maintain, and improve the MapMyCrop Platform
To deliver satellite-derived analytics to authorized users
To process demo requests, contracts, and billing
To provide customer support and respond to inquiries
To detect, prevent, and address fraud, security, or policy violations
To send product updates and marketing communications (with consent)
To comply with legal obligations

We do not sell personal data. We do not use customer-uploaded field or farmer data to train advertising models. We do not share identifiable farmer data with third parties without explicit customer authorization.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process personal data on the following legal bases:

Contract — to deliver the services you’ve signed up for
Legitimate interest — to operate, secure, and improve our services
Consent — for marketing communications and non-essential cookies
Legal obligation — to comply with applicable laws and regulations

We share data only with the following categories of recipients:

Subprocessors that help us operate the platform (cloud hosting, email delivery, analytics)
Enterprise customers — for data they have uploaded to their account
Regulators and law enforcement — when legally required
Successor entities — in the event of a merger, acquisition, or asset sale

Our current subprocessor list is maintained at mapmycrop.com/legal/subprocessors and updated with 30 days’ notice before any change.

6. Satellite & Geospatial Data

Most satellite data we process is sourced from public constellations (Sentinel-2, Landsat) or licensed commercial providers (Planet, Maxar, Airbus). Where we process customer-provided geospatial data (e.g., uploaded field boundaries):

Data is stored in region-specific cloud infrastructure (EU customers → EU regions, APAC customers → APAC regions)
Access is logged and audited
Data is encrypted at rest and in transit
Data is deleted upon contract termination, per the retention schedule

7. Farmer & Smallholder Data

MapMyCrop customers may load farmer registry data (names, phone numbers, farm locations) into our platform. We treat this data as the customer’s data — and we process it strictly on their instructions.

Where MapMyCrop operates its own farmer-facing mobile applications, we collect data directly from farmers with their explicit consent, in local-language consent flows. Farmers can request access, correction, or deletion of their data at any time via the in-app settings or by contacting support@mapmycrop.com.

8. Cookies & Tracking

MapMyCrop uses cookies and similar technologies for the following purposes:

Essential — required for the site to function (always active)
Analytics — to understand how visitors use our site (optional)
Marketing — to measure the effectiveness of our campaigns (optional)

You can manage your cookie preferences via the banner shown on your first visit, or by clicking “Cookie Settings” in the site footer.

9. Data Retention

We retain personal data only as long as necessary to provide our services and comply with legal obligations. Specific retention windows:

Account data: lifetime of the account + 8 years (tax/audit)
Customer geospatial data: lifetime of contract + 90 days (for export)
Support correspondence: 3 years from last interaction
Marketing consent records: until consent is withdrawn + 3 years

10. Your Rights (GDPR / DPDP / CCPA)

Depending on your jurisdiction, you may have the following rights:

Access — request a copy of the personal data we hold about you
Correction — request that we correct inaccurate or incomplete data
Deletion — request that we delete your personal data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interest
Restriction — request that we limit how we process your data
Withdrawal of consent — at any time, where processing is based on consent

To exercise any of these rights, contact support@mapmycrop.com. We respond within 30 days.

11. Security Measures

MapMyCrop maintains enterprise-grade security controls, including:

Encryption at rest (AES-256) and in transit (TLS 1.3)
Role-based access control with mandatory MFA for all staff
Penetration testing by independent third parties annually
24/7 security operations center and incident response
Annual disaster recovery and business continuity testing

12. International Transfers

MapMyCrop is headquartered in New York, USA, with offices in India, the United Kingdom, the United Arab Emirates, Malaysia, and the Philippines. Where personal data is transferred across borders, we rely on:

EU Standard Contractual Clauses (SCCs) for transfers from the EEA
UK International Data Transfer Agreement (IDTA)

13. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will:

Post the updated policy on this page with a new “Last updated” date
Notify active account holders via email for material changes
Provide at least 30 days’ notice before material changes take effect

14. Contact Us

For any questions about this Privacy Policy or our data practices, please contact our privacy team: