Leafra← Back to site

Privacy Policy

Last updated: 17 April 2026

Leafra Technology (\u201cLeafra\u201d, \u201cwe\u201d, \u201cus\u201d) respects your privacy. This policy explains what data we collect, why, how we process it, and the rights you have under GDPR (EU), KVKK (Türkiye) and Federal Law 152-FZ (Russia).

1. Data we collect

  • Account data: email address, display name, chosen language, optional city/climate zone.
  • Plant data: photos you take and keep in your garden, care notes, watering log.
  • Device data: app version, OS, anonymised crash reports (opt-in).
  • Usage data: aggregated and pseudonymised metrics (opt-in). No third-party ad tracking, ever.

2. How we use your data

  • Provide and improve the AI plant identification, diagnosis and care features.
  • Send you reminders about your plants (only for plants you added yourself).
  • Respond to support requests.
  • Comply with legal obligations.

3. AI processing

Photos you submit for identification or diagnosis are sent to our backend and processed by third-party AI models operated by Anthropic, Google and fal.ai. Photos are processed in stateless edge functions and discarded after inference. No training of third-party models on your photos. If you save a photo to your garden, it is stored encrypted at rest in our database.

4. Legal basis (GDPR Art. 6)

  • Contract (Art. 6(1)(b)) — to deliver the service you requested.
  • Consent (Art. 6(1)(a)) — for analytics and notifications, which you can withdraw any time.
  • Legitimate interests (Art. 6(1)(f)) — for fraud prevention and service integrity.

5. Data sharing

We share data only with processors necessary to run the service (hosting, AI inference, payments, email). Each processor is bound by a Data Processing Agreement. We never sell your data.

6. International transfers

Data may be transferred to the EU, USA, UK, Türkiye and Russia. For EU transfers outside the EEA we rely on Standard Contractual Clauses (SCCs) and, where applicable, Transfer Impact Assessments. For RU users, a copy of personal data is stored on servers located in the Russian Federation, in accordance with FZ-152.

7. Retention

Account and plant data are kept while your account is active. You can delete everything at once from in-app Settings → Delete account. Backups are purged within 30 days of deletion.

8. Your rights

You have the right to access, rectify, port, restrict, object, delete, and withdraw consent. To exercise any of these, contact privacy@leafra.app or visit /data-requests. For Turkish residents (KVKK) and Russian residents (FZ-152) the same rights apply under their local law.

9. Children

Leafra is not directed to children under 13. We do not knowingly collect data from them.

10. Contact

Data Protection Officer: privacy@leafra.app
Postal address: Leafra Technology, Levent, İstanbul, Türkiye.

You can also lodge a complaint with your local supervisory authority (in Türkiye: KVKK; in the EU: your national DPA; in Russia: Roskomnadzor).