Privacy Policy
We collect what we need to tell you useful things about your own garden — where it is, what grows in it, and what the weather is doing to it. We share it only with the suppliers that make those features work. We do not sell it. You can get a copy of it or have it deleted.
Privacy Policy
Effective date: 26th August 2026 Version: 2026-08-01
This policy explains what GrowMuir does with your personal data.
GrowMuir Limited is the data controller. We are registered in England and Wales with company number 17384929. For anything about this policy or your data, contact legal@growmuir.com.
The short version
We collect what we need to tell you useful things about your own garden — where it is, what grows in it, and what the weather is doing to it. We share it only with the suppliers that make those features work. We do not sell it. You can get a copy of it or have it deleted.
Everything below is the detail.
1. What we collect
When you create an account Your name, email address and password. Passwords are stored hashed by our authentication provider; we never see them.
About your property and gardens This is the heart of the service, and it is the most specific data we hold:
- the address of your property, including postcode
- its precise latitude and longitude, and a place identifier from Google Maps
- your garden's aspect, position, sun exposure, north orientation and dimensions
- soil information for your location — type, pH, texture, drainage and related measurements
- an outline of your garden, which may be detected from satellite imagery
- your notes about the garden
What you grow The plants, seeds and bulbs you record, tasks you complete, and photographs you upload of your plants and garden.
Photographs Images you upload for plant identification, for your plant records, or as garden photographs. Photographs can contain more than their subject — location data in the file, or people and property in the frame. Please bear that in mind when uploading.
Payment information If you subscribe, Stripe collects and processes your card details. We never receive or store your card number. We store your Stripe customer reference, your plan, its status and its renewal date.
Your use of the service Questions you ask, searches you run, pages you visit, and basic technical data such as IP address, browser and device type. We use Google Analytics; see section 8.
Communications Emails we send you and any correspondence with support.
2. Why we use it, and our lawful basis
| What for | Lawful basis |
|---|---|
| Providing your account and the features you use | Performance of our contract with you |
| Location, soil and weather-specific advice | Performance of our contract with you |
| Taking payment and managing your membership | Performance of our contract with you |
| Service emails — receipts, renewal reminders, security notices | Performance of our contract; legal obligation |
| Marketing emails and the newsletter | Your consent, which you can withdraw at any time |
| Keeping the service secure and preventing abuse | Our legitimate interests |
| Improving the service and fixing faults | Our legitimate interests |
| Analytics | Your consent, via the cookie banner |
| Meeting legal and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we have considered the effect on you and believe our use is proportionate. You may object — see section 9.
3. Automated processing and AI
Some features send your data to third-party systems:
- Plant identification sends the photograph you upload to PlantNet, which returns candidate species.
- AskMuir and generated content — questions you ask, and context about your garden such as its location, soil and the plants in it, are sent to Google (Gemini) to generate a reply. Care notes, task suggestions and planting suggestions are generated the same way.
- Garden outline detection sends your location to Google's mapping and solar services.
These are used to produce a result for you. We do not use your personal data to train AI models, and our agreements with these providers do not permit them to use it to train theirs.
None of this is automated decision-making producing legal or similarly significant effects. It is horticultural suggestion, and section 8 of our Terms of Service explains that it can be wrong.
4. Who we share it with
We share personal data with the suppliers who operate parts of the service on our behalf. Each is bound to protect it and to use it only for what we ask.
| Supplier | What they do | What they receive |
|---|---|---|
| Supabase | Database, authentication and file storage | All account and garden data |
| Stripe | Payments and subscriptions | Name, email, billing address, payment details |
| Google (Gemini) | AI-generated answers and content | Questions, and garden context |
| Google Maps / Places / Solar | Address lookup, mapping, garden detection | Address and coordinates |
| PlantNet | Plant identification from photographs | Uploaded photographs |
| Resend | Sending email | Name and email address |
| Open-Meteo | Weather and climate data | Coordinates only |
| ISRIC SoilGrids | Soil data | Coordinates only |
| Perenual, Trefle, Plantbook, FloraAPI | Plant reference data | No personal data |
| Awin | Retailer price feeds and affiliate links | No personal data; clicking a link shares standard web request data with the retailer |
| Google Analytics | Usage analytics | Usage and device data, if you consent |
| Our hosting provider | Running the site | Technical request data |
We also share data where the law requires it, to establish or defend legal claims, or to a buyer if the business is sold — in which case we would tell you.
We do not sell your personal data.
5. Where your data goes
Our database and file storage are hosted in the European Union. Some suppliers above are based outside the UK, including in the United States. Where data is transferred outside the UK we rely on UK adequacy regulations or on the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with additional safeguards where needed.
6. How long we keep it
- Your account data is kept while your account is open.
- When you close your account we schedule it for deletion. Your data is removed after 180 days, which gives you a window to change your mind.
- Payment and invoice records are kept for six years, as UK tax law requires.
- Support correspondence is kept for up to two years.
- Analytics data is kept for 2 months.
- Anti-abuse records — to protect GrowMuir's free question allowance from misuse, we use a one-way cryptographic representation of the requesting IP address together with a daily usage count. We keep these anti-abuse records for up to 30 days and then delete them.
- Data that has been aggregated or anonymised so it no longer identifies you may be kept indefinitely.
7. Security
Access to your data is restricted at the database level, so one account cannot read another's. Data is encrypted in transit and at rest by our infrastructure providers. Access by our staff is limited to those who need it.
No service can promise perfect security. If a breach affects your rights, we will tell you and the Information Commissioner's Office as the law requires.
8. Cookies and analytics
We use cookies that are strictly necessary to sign you in and keep the service working. These do not require consent.
We use Google Analytics only if you consent through the cookie banner, and you can withdraw consent at any time. Our Cookie Policy has the detail.
9. Your rights
Under UK data protection law you may:
- access the personal data we hold about you;
- correct it if it is wrong — most of it is editable in your account;
- delete it, by closing your account or asking us;
- restrict or object to our processing, including profiling based on legitimate interests;
- receive a copy in a portable format;
- withdraw consent at any time, where we rely on it — this does not affect what we did before you withdrew it.
Email legal@growmuir.com. We will respond within one month.
If you are unhappy with our answer you can complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — though we would rather you gave us the chance to put it right first.
10. Children
GrowMuir is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, contact legal@growmuir.com and we will delete it.
11. Changes to this policy
We may update this policy. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect. The version and effective date are at the top of this page.
GrowMuir Limited · Registered in England & Wales · Company number 17384929 · legal@growmuir.com