Last updated 13 October 2026
ADOPOTATO LLC, a computer integrated systems design studio, respects the privacy of every grower, shipper, inspector, agronomist and visitor who interacts with our websites, platforms and field systems. This Privacy Policy explains what information we collect, how we use it, whom we share it with and the choices you hold. The developer AdoPotato and the team at ADOPOTATO LLC built this policy to describe our practices in plain, direct language so that any reader can understand the commitments we make.
We operate from 248 E Hubbard Ave, Salt Lake City - 84111-4616, United States (US), and we serve seed potato clients across the intermountain west and beyond. Our business depends on trust, and trust begins with a clear account of how records are handled. We encourage you to read this policy in full and to contact us with any question at hello@adopotato.buzz or by telephone at +16814621367.
A seed potato business runs on evidence. A grower wants proof that certified stock was stored honestly. A shipper wants proof that a pallet left the dock in good condition. An inspector wants proof that every test was recorded and signed. ADOPOTATO LLC holds a great deal of that evidence inside the platforms we build, and the way we protect it matters as much as the way we display it. This policy is our public account of that responsibility, and we have written it so that a farmer, a cooperative manager or a compliance officer can follow it without legal training.
This policy applies to personal information and operational information that ADOPOTATO LLC collects through our public website, our client portals, our certification platforms, our dashboards and any service we deliver under a written agreement. It also applies to information gathered during sales discussions, support calls and training sessions.
This policy does not apply to a client own internal systems beyond the interfaces we operate, nor does it apply to third party websites that a user may reach through an external link. Where a client processes data inside a platform we host, the client generally acts as the controller of that data and ADOPOTATO LLC acts as a processor that follows the client written instructions.
We separate the two roles clearly so that every party knows where responsibility sits. When you browse our public website, we are the controller of the technical information that our servers record. When your organisation sends seed lot records into a platform we operate, your organisation decides why the records exist and how long they should be kept, while we decide only how to process them safely on your behalf. This distinction shapes the rights described later in this policy, and it explains why some requests are answered directly by us while others are forwarded to the organisation that controls the record.
Our services span several different environments, and this policy is written to cover all of them at once. It reaches our marketing pages, our demonstration environments, our production platforms, our support desk and the training sessions we hold on site. It applies whether you reach us from a desktop in an office, a tablet in a grading shed or a phone in a field, and it applies regardless of the country from which you connect. Where a region grants a right that is stronger than the general standard described here, we honour the stronger right for the people of that region.
The categories of information we collect depend on how you interact with us. We group these categories as follows.
We collect names, job titles, employer names, email addresses, postal addresses and telephone numbers when you request a demonstration, submit a contact form, sign an agreement or attend a training session.
For visitors who receive access to a portal or dashboard, we collect a username, a hashed authentication credential, assigned role permissions and a log of sign in events. We never store a plain text password.
When a client uses our certification or traceability systems, the platform stores lot identities, inspection results, grade sheets, treatment records, transfer events and related evidence. These records may reference a farm, a field block, a store chamber or a member of staff.
Our cold storage integrations collect temperature, humidity, door and equipment readings together with timestamps and device identifiers. These readings usually describe conditions rather than people, but they may be linked to the staff who record actions in the system.
Our web servers record an internet protocol address, a browser type, a device category, a referring page and a request time for security, diagnostics and aggregate reporting purposes.
We retain the content of emails, support tickets and meeting notes so that we can answer questions accurately and keep a consistent account of a project over time.
When you choose to receive a product update or a seasonal notice, we store your email address, the topic you selected and the date you gave consent. We store this separately from operational records so that a marketing preference can never be confused with a certification record.
We may hold de-identified measurements about platform performance, such as page load times or the frequency of a particular feature. We strip identifying elements before this information is used for analysis, and we do not attempt to re-identify it.
We never ask for information that we do not need. If a form requests a detail that seems unrelated to the task at hand, that is a signal worth questioning, and we invite you to ask us why a field exists so that we can either explain it or remove it.
We obtain information directly from you when you complete a form, send an email, call our studio or use a platform. We obtain operational information from the systems a client connects to our platform, which may include field software, store controllers, grading equipment and freight records. We obtain technical information automatically as our servers respond to requests. In some cases we receive information from a colleague at your organisation who introduces you to a project, or from a certification agency that names you as a contact for a seed lot.
We do not purchase personal data from data brokers, and we do not combine the information you provide with profiles assembled elsewhere for advertising purposes.
When information arrives from a client system, we treat the client as the source of truth for that record and we do not enrich it with outside data. When technical information arrives automatically, we use it only for the purposes described in this policy and we discard what we do not need. If a future feature would require a new category of information, we will update this policy and, where the law requires, ask for consent before the feature is enabled for you.
We use information to deliver, operate and improve our services. Specific purposes include responding to enquiries, preparing proposals, onboarding clients, configuring a platform, integrating equipment, training users, providing support, issuing invoices, maintaining security, detecting misuse and meeting our legal and accounting obligations.
We also use aggregated and de-identified information to understand how features are used, so that we can improve the interface and reliability of our products. Aggregated information cannot reasonably be used to identify a person, and we remove identifying details before any such analysis.
We do not sell personal information. We do not use client operational records for our own marketing. We do not send marketing messages to a person who has asked us to stop.
We keep the use of information narrow by design. A support engineer can see the records that a support case requires, and nothing more. A trainer can see the account structure of the client being trained, and no other client. Our own leadership sees aggregated service health rather than the contents of a grower lot. This restraint is a deliberate engineering choice, and we review the permission model each time we release a new feature.
Where the law requires a legal basis, we rely on one or more of the following. We process information to perform a contract when we deliver a service a client has engaged. We process information based on our legitimate interests when we secure our systems, improve our products or communicate about an existing project, provided those interests do not override your rights. We process information based on consent when you ask to receive updates and when the law requires an affirmative choice. We process information to comply with a legal obligation when we keep accounting records, respond to a lawful request or honour a court order.
When we rely on a legitimate interest, we first weigh that interest against the impact on the people whose information we hold. We consider the sensitivity of the data, the expectations of the person, and the availability of a less intrusive method. If the balance does not favour processing, we do not proceed. When we rely on consent, you may withdraw it at any time by writing to hello@adopotato.buzz, and a withdrawal will not affect the lawfulness of processing that occurred before the withdrawal.
Our cold storage and field integrations generate a continuous stream of readings. These readings are the evidence base for a certified lot, so we treat them as operational records rather than mere device noise. We link each reading to a chamber, a lot or a trial plot, and we keep the full time series for the retention period agreed with the client.
Because a store reading may coincide with a staff action, a sensor record can indirectly indicate that a particular person performed a particular task at a particular time. We limit access to these records to the people who need them for certification, support or an audit, and we log every access so that the chain remains accountable.
Sensor calibration records deserve a special note. A calibration entry may name the technician who adjusted a probe, the reference instrument used and the result of the check. We treat this entry as both a quality record and a personal record, which means it follows the retention schedule of the lot as well as the access limits that apply to personnel information. If a technician asks us to correct a calibration note that contains their name, we will forward the request to the client that controls the record and will support the correction without altering the underlying measurement.
We keep personal information only for as long as it serves the purpose for which it was collected. Contact details tied to an active client relationship are kept for the life of that relationship and then for a reasonable period afterwards so that we can answer a follow up question. Operational records that support a certified seed lot are kept for the retention period agreed in the client contract, which is often several seasons because certification evidence must remain available for a later audit. Accounting records are kept for the period the tax law requires. Technical logs are kept for a short rolling window unless a security investigation requires a longer hold. When a retention period ends, we delete the information or render it anonymous in a manner we cannot reverse.
We protect information with administrative, technical and physical controls that suit the sensitivity of the data. These controls include encryption in transit, encryption at rest for sensitive stores, role based access, strong authentication for administrative accounts, network segmentation, regular patching, protected backups and monitoring that raises an alert on unusual activity.
Our staff receive privacy and security training, and access to client records is granted on a least privilege basis and reviewed at intervals. No method of transmission or storage is perfectly secure, so we cannot promise absolute security. We do promise that we will act quickly and transparently if a security event ever puts your information at risk.
Depending on where you live, you may hold the right to access the personal information we keep about you, to correct information that is inaccurate, to request deletion, to restrict or object to certain processing, to receive a portable copy and to withdraw a consent you previously gave. You may also hold the right to lodge a complaint with a supervisory authority.
To exercise a right, write to hello@adopotato.buzz or call +16814621367. We will verify your identity before we act, and we will respond within the period the applicable law allows. We will not discriminate against you for exercising a privacy right. Where a request concerns operational records controlled by a client, we will forward the request to that client and support the client response.
We do not charge a fee for a reasonable request. If a request is manifestly unfounded or excessive, we may decline it or charge a reasonable cost, and we will explain the reason in writing. If we decline a request in whole or in part, we will tell you why and we will describe the route you may take to challenge our decision. We keep a record of each request and our response so that we can demonstrate that we have honoured the law.
Because our services are often used by an organisation rather than an individual, the fastest route for a staff member is usually to approach the organisation first. That organisation controls the record, and it can often answer a request about a certification entry far more quickly than we can as a processor. We remain ready to assist either way.
Our services are designed for agricultural businesses and professional users. We do not knowingly collect personal information from a child under the age of sixteen. If we learn that we have collected information from a child, we will delete it without undue delay. A parent or guardian who believes a child has provided information to us should contact us at hello@adopotato.buzz so that we can act.
A farm office is sometimes a family office, and a young person may occasionally sit beside a parent who is entering a scouting note. We treat such an incidental entry as the entry of the account holder, and we keep the same protection around it. We do not build features that invite a child to create an account, and we do not direct any part of our website at a child audience.
ADOPOTATO LLC is based in the United States, and our primary systems operate there. If a client is located in another country, information may be transferred to and processed in the United States. When we transfer personal information across a border, we use appropriate safeguards such as standard contractual terms or an equivalent mechanism, and we take steps to ensure that the receiving environment offers a level of protection consistent with this policy and with applicable law.
We rely on a small number of established providers for hosting, email delivery, monitoring and payment processing. Each provider is selected for its security posture, is bound by a written data processing agreement and is permitted to use information only to deliver its service to us. Our public website may contain a link to an external resource that we believe is useful for a grower or an inspector. Once you follow such a link, the privacy practices of that external site apply, and we encourage you to read the policy of any site before you submit information to it.
Some platform features produce automated suggestions, such as a flag on an unusual storage reading or a ranking of trial plots by yield. These features support a human decision and do not by themselves create a legal effect for any person. We do not use personal information to make an automated decision that denies a service, sets a price or otherwise produces a significant effect without human review. A client may ask us to explain how a particular platform feature reaches its output, and we will provide that explanation in clear terms.
We maintain a documented process for detecting, containing, assessing and reporting a security incident. If an incident creates a risk to the rights of a person, we will notify the affected client without undue delay and will provide the information needed to understand the event and to protect against it. Where the law requires a notification to a supervisory authority or to an individual, we will make that notification within the required period and will cooperate fully with any investigation. After an incident we review the cause and strengthen the controls that failed so that the same event is unlikely to repeat.
We test our response through an exercise at least once a year, and we keep the lessons on file. We also review our key suppliers for a security event that could affect our clients, because a threat to a shared provider is a threat to the whole chain that holds a certified record.
We may update this Privacy Policy to reflect a change in our practices, our services or the law. When we make a material change, we will revise the date at the top of this page and, where appropriate, notify an active client by email. We encourage you to review this page at intervals so that you remain informed about how we protect information. A continued use of our services after an update means that you accept the revised policy.
We keep a dated history of prior versions so that a regulator or a client can see how the policy has evolved. If a change narrows a right you previously held, we will give clear notice before the change takes effect wherever the law or fairness requires it.
If you have a question about this Privacy Policy, a request about your information or a concern about how we have handled a record, please contact us through any of the channels below. We take every privacy enquiry seriously and we will reply within one working day.
ADOPOTATO LLC
248 E Hubbard Ave
Salt Lake City - 84111-4616
United States (US)
Email hello@adopotato.buzz
Telephone +16814621367