Encampo Privacy Policy
Last updated: 2026-07-21
This policy was originally drafted in Spanish. In case of discrepancy with a translation, the Spanish version prevails.
1. Identity of the Operator
The mobile application Encampo ("the App") is operated by Encampo, with address at Colonia Centro, CP 60300, Los Reyes, Michoacán, Mexico ("we", "us", "the Operator"). For any questions related to this Privacy Policy, write to support@encampo.pro.
2. Data We Collect
Account data (required to use the App):
- User name (displayed within the App and in check-in records).
- Email address (used as login identifier and for password recovery).
Data generated by use (required for agricultural functionality):
- Employee check-in / check-out records: date, time, NFC tag read, device.
- Production: quantities, product type, waste, associated employee, date and time.
- Tool and vehicle assignments: loan and return records, responsible employee.
- Project and task assignments: project, recipe, fumigation, irrigation, user notes.
- Automatically generated technical metadata: App version, platform (iOS/Android), device time zone, last sync timestamp.
Data NOT collected:
- We do not collect GPS location.
- We do not collect photos or access the camera.
- We do not collect device contacts or address book.
- We do not collect biometric data (Face ID, fingerprint).
- We do not collect browsing history or advertising identifiers (IDFA).
- We do not perform tracking between apps or third-party websites (NSPrivacyTracking = false).
3. How We Use Your Data
| Data | Purpose |
|---|---|
| Name + Email | Account creation and management (AccountManagement per Apple Privacy Questionnaire) |
| Name | Display the responsible user in check-in and production records (AppFunctionality) |
| Check-in/out, production, tools, projects | Core App functionality: agricultural field management (AppFunctionality) |
| Technical metadata | Error diagnostics, cloud synchronization, duplicate prevention |
| Notification of important account changes (e.g., key rotation, account closure) |
We do NOT use your data for:
- Third-party advertising.
- Commercial profiling.
- Selling or renting data to third parties.
4. Legal Basis for Processing (GDPR)
We process your personal data under the following legal bases of Art. 6 of the General Data Protection Regulation (GDPR/EU 2016/679):
- Contract performance (Art. 6.1.b): to provide the agricultural management service you requested when creating your account.
- Legitimate interest (Art. 6.1.f): for technical diagnostics and account security.
- Consent (Art. 6.1.a): for non-essential email notifications; you may withdraw it at any time.
5. Who We Share Data With
Processing providers (sub-processors):
| Provider | Function | Country | Safeguards |
|---|---|---|---|
| Supabase Inc. | PostgreSQL database, Auth, cloud storage | USA (DPA available on request) | DPA signable on demand; TLS 1.2+ in transit, AES-256 at rest; Row Level Security (RLS) enabled |
| Stripe Inc. | Payment processing for Pro Plan (web only) | USA | PCI DSS Level 1 certified; TLS 1.2+; Stripe Privacy Policy |
| Vercel Inc. | Web platform hosting and deployment | USA | SOC 2 Type II compliant; TLS 1.2+; Vercel Privacy Policy |
| Apple Inc. | App distribution via App Store / TestFlight | USA | Apple Privacy Policy; iOS App Sandbox |
| Google LLC | App distribution via Google Play Store | USA | Google API Privacy Policy |
We do NOT share data with:
- Advertising networks.
- Data brokers.
- Third-party analytics services.
- Social media platforms.
Compulsory disclosure: We may disclose personal data if required by court order or competent authority with jurisdiction, strictly to the extent required by law.
6. International Transfers
Your data may be processed on servers located outside your country of residence (primarily the United States, where Supabase operates). This transfer is made under the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), which guarantee an adequate level of protection.
7. Data Retention
- Active accounts: while the account exists and is used.
- After account closure: we delete personal data associated with the account within a maximum of 90 days from the closure request.
- Backups: Supabase backups may retain residual copies for up to 35 days before being fully purged.
- Agricultural records (check-in, production, etc.): belong to the account holder; if the account is closed and the holder has not requested prior export, records are deleted with the account.
- Legal/fiscal obligations: if applicable law requires retaining documents for a longer period, we will maintain exclusively the necessary records for that period, without processing them for other purposes.
8. Your Rights
You may exercise the following rights by writing to support@encampo.pro:
| Right | What it does |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Correct inaccurate or incomplete data |
| Erasure ("Right to be Forgotten") | Request that we delete your personal data |
| Objection | Object to processing based on legitimate interest |
| Portability | Receive your data in a structured format (CSV, provided by the App itself) |
| Restriction | Request that we temporarily suspend processing |
| Withdraw consent | For processing based on consent, without affecting the lawfulness of past processing |
Response time: maximum 30 days from receipt of the request (GDPR); 15 days (LFPDPPP Mexico); 45 days extendable (CCPA/USA).
Exercise of rights of consent withdrawal does not affect the provision of the contractual service.
California Residents (CCPA/CPRA):
If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know: You may request disclosure of the specific pieces of personal information we have collected about you in the past 12 months.
- Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights. You will not receive a different level of service or be charged differently.
We do not sell or share your personal information as defined under the CCPA/CPRA. We do not use or disclose personal information for cross-context behavioral advertising. No "Do Not Sell or Share My Personal Information" link is required because no sale or sharing occurs.
Categories of personal information collected (mapped to CCPA statutory categories): (1) Identifiers — name, email; (2) Commercial information — Pro Plan purchase history; (3) Internet or network activity — app version, platform, sync metadata. No other CCPA categories apply.
To submit a CCPA request, email support@encampo.pro with subject "CCPA Request." We will verify your identity using the email associated with your account.
9. Security
- Encryption in transit: all App ↔ Supabase connections use HTTPS/TLS 1.2+.
- Encryption at rest: Supabase applies AES-256 to the database.
- Row Level Security (RLS): Supabase RLS policies ensure a user can only read/write records belonging to their client/tenant.
- Offline-first: the App stores data on the device using ObjectBox (embedded local NoSQL databases). Only authentication credentials are encrypted; all other data (check-ins, production records, project data) is stored in plain text on the device, protected by the operating system's app sandbox. Note that on rooted or jailbroken devices, this protection may be circumvented.
- Public anon key: the App includes a public anonymous key (anon JWT) that is designed to work with Supabase Row Level Security (RLS) policies to restrict data access. The security of this model depends on correct RLS policy configuration. The service_role key, which bypasses RLS, is never included in the App binary.
- Service role not included: the App never includes the Supabase service_role key (which would bypass RLS) in its binary.
- Synchronization: cloud sync uses HTTPS and only activates when connected; offline mode never sends data without the user's implicit consent.
Payment Card Security (PCI DSS)
Encampo does not directly store, process, or transmit cardholder payment data. All payment transactions are processed by Stripe, Inc. (PCI DSS Level 1 certified). Your card information never passes through Encampo's servers.
Data Breach Notification
In the event of a confirmed security breach affecting your personal data, we will notify you within 72 hours of confirmation via email to your registered address. The notification will describe: (a) the nature of the breach; (b) the categories and approximate number of data records affected; (c) the likely consequences; (d) the measures we have taken or propose to take.
10. Minors
The App is not directed at persons under 13 years of age. In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal data from children under 13. If you believe a minor has provided us with personal data, write to support@encampo.pro and we will delete it immediately.
11. Changes to This Policy
We may update this Privacy Policy when the App changes functionality or due to legal requirements. The "Last updated" date at the top will be adjusted and we will notify you of material changes by email to the affected account or by in-app notice. Continued use of the App after the changes take effect constitutes acceptance.
We reserve the right to modify this policy at any time. Material changes will be notified as described above. It is your responsibility to review this policy periodically.
12. Contact
Operator: Encampo
Email: support@encampo.pro
Address: Colonia Centro, CP 60300, Los Reyes, Michoacán, Mexico