Treetify Privacy Policy

This Privacy Policy is available in English, Czech, and German. In the event of any inconsistency between versions, the English version prevails, except where mandatory local law requires otherwise.

1. Introduction

Treetify ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you use the Treetify mobile and web applications (the "App" or "Services"), how and why we use it, who we share it with, and the rights available to you.

By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.

2. Who We Are — Data Controller

Treetify is operated by:

Bobr na stromě s.r.o.
Registered seat: Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic
Company ID (IČO): 22411313
Registered in the Commercial Register maintained by the Regional Court in Brno, Section C, Insert 142612
Email: info@treetify.app

(referred to as "Treetify", "we", "us", or "our" in this Policy.)

3. Two Kinds of Personal Data We Handle

Treetify processes two distinct categories of personal data, and our legal role is different for each. It's important that you understand the difference.

(a) Your data, as our user. Your name, email address, login credentials, company details, preferences, and how you use the App. For this data, Treetify is the data controller, and the rest of this Policy explains how and why we process it.

(b) Data you enter about your own clients. When you use the App to create a customer record, a site ("ground"), or a tree assessment, you may enter personal data about other people — names of clients or property owners, site addresses, GPS coordinates of private property, and photographs. This is your content, and you decide what is collected and why. For this data, you are the data controller and Treetify is the data processor, acting only on your instructions to store it, display it to you, and let you generate reports from it. Business customers may request a Data Processing Agreement (DPA) governing this relationship by contacting info@treetify.app.

This Policy is written from the perspective of (a) — you, our registered user. If you are a person referenced in someone else's Treetify records (for example, you are a client of an arborist who uses Treetify), please direct any request about your data to that arborist or tree-care company directly; Treetify will assist them in responding, as required by law.

4. Information We Collect

4.1 Information you provide directly

• Account information: name, email address, password (stored as a hash), profile picture, phone number if provided, and — if you sign in that way — your Google account ID or Apple ID/relay email.
• Professional and company information: company name, company registration number, company logo, your chosen PDF report style, and the disclaimer text you write for your reports.
• Preferences: interface language, email and push notification settings, and other in-app preferences.
• Content you create: customer records, grounds/sites, and tree records — including species, GPS coordinates, street address, trunk circumference, height, crown measurements, the six condition ratings, recommended treatment and urgency, public notes, internal notes, and photographs. Also condition presets you save for reuse.

Internal notes. A tree record can carry an internal note that is visible only to you within the App and is never included in the PDF report generated for your client.

4.2 Information collected automatically

• Authentication tokens (JWT): used to keep you signed in; stored in your browser's local storage (web) or on your device (mobile app).
• Session cookie: a short-lived cookie used only during the Google/Apple sign-in process.
• Basic device and app data: device type, operating system version, and app version, used to diagnose technical issues.
• IP address and server logs: used for security and to detect abuse.

We do not use any analytics SDK, advertising SDK, or tracking pixel anywhere in the App, and none of this data is used for advertising or profiling.

5. Device Permissions

The App may request access to:

• Location: to automatically fill in GPS coordinates when you record a tree.
• Camera: to photograph trees for your records and reports.
• Photo library: to attach existing photos to a tree record.

These permissions are used solely for the purposes described above. You can revoke any of them at any time in your device settings, though doing so will limit the related feature.

6. Legal Basis for Processing (EEA/UK)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contract (Art. 6(1)(b) GDPR) — to provide the Services you have registered for, including storing and displaying your records and generating reports.
• Legitimate interests (Art. 6(1)(f) GDPR) — to operate, secure, and maintain the App, prevent unauthorized access, and fix technical issues.
• Legal obligation (Art. 6(1)(c) GDPR) — where we are required to process data to comply with applicable law.
• Consent (Art. 6(1)(a) GDPR) — for optional communications you opt into, such as push or email notifications, which you may withdraw at any time in your preferences.

7. How We Use Your Information

We use the information we collect to:

• create, authenticate, and manage your account;
• store, display, search, and organize the customers, grounds, trees, and photos you record;
• generate branded, localized PDF assessment reports from the data you enter;
• display your profile and company information within reports and the App;
• operate, secure, and maintain the technical infrastructure of the App; and
• respond to support requests and comply with legal obligations.

We do not use your data for advertising, marketing to third parties, or any purpose beyond delivering the Services to you, and we never sell your data.

8. Sharing and Sub-Processors

We do not sell, rent, or share your personal data with third parties for their own purposes. We share it only with service providers who help us run Treetify — each bound by contractual confidentiality and data-protection obligations — and in the limited circumstances listed below.

We may also disclose information where required by law, court order, or a competent authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. If Treetify is involved in a merger, acquisition, or sale of assets, your data may transfer as part of that transaction; we will notify you and require the new owner to honor this Policy.

A note on accuracy: because tree coordinates are sent to Esri whenever a location map is rendered in a PDF report, we do not claim that "your data never leaves our servers," and we do not describe any part of the Service as end-to-end encrypted.

9. International Data Transfers

Some of the providers listed above — including Google, Apple, Esri, Vercel, and Expo/EAS — are based outside the European Economic Area, principally in the United States. Where we or our providers transfer personal data outside the EEA/UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the provider's own certified compliance mechanisms. Our primary database and file storage are hosted by Supabase in Zurich, Switzerland, and transactional email is handled by Zoho in its European data centre. Switzerland is not part of the EEA, but the European Commission has adopted an adequacy decision recognizing that it provides an adequate level of data protection, so no additional transfer safeguards are required for that hosting. Where personnel of those providers located outside the EEA access data for support or maintenance, that access is governed by the Standard Contractual Clauses agreed in our contracts with them.

10. Data Retention

• We retain your account and content for as long as your account remains active.
• If you request deletion, sign-in and API access are blocked immediately and a confirmation email is sent. Your account and associated data — including photographs — are then permanently deleted within 30 days of your request, other than copies retained for a limited additional period in backups, or as required by law.
• You may delete individual customers, grounds, trees, and photos at any time within the App.
• Beyond generating PDF reports, the App does not currently offer a self-service data export. If you need your data in a portable format, contact info@treetify.app and we will assist you manually (see Section 11).

11. Your Rights

Depending on where you are located, you may have the right to:

• Access a copy of the data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your data in certain circumstances;
• Restriction of our processing of your data;
• Portability — to receive your data in a commonly used, machine-readable format;
• Object to processing based on legitimate interests;
• Withdraw consent, where processing is based on consent, at any time; and
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at info@treetify.app. We aim to respond within the timeframe required by applicable law (generally 30 days).

If you are in the EEA, you may lodge a complaint with your local supervisory authority, or with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic — www.uoou.cz.

12. Security

We implement appropriate technical and organizational measures to protect your data, including encrypted data transmission (HTTPS), access controls, and password hashing. No system is completely secure; we encourage you to use a strong, unique password and to keep your login credentials confidential.

13. Cookies and Similar Technologies

The web app stores your sign-in token in your browser's local storage and uses a short-lived session cookie only during the Google/Apple sign-in process. The mobile app stores your sign-in token on your device. These technologies are strictly necessary for the Service to function and are not used for advertising, analytics, or tracking — consistent with applicable e-privacy rules, we accordingly do not display a cookie-consent banner. If this changes, we will update this Policy and add the appropriate controls.

14. Third-Party Services

The App uses Google OAuth 2.0 and Sign in with Apple for authentication. By signing in that way, you are also subject to Google's or Apple's own privacy practices, which we do not control. The App does not contain third-party advertising, trackers, or analytics SDKs that report your usage to external parties.

15. Children

Treetify is a professional tool intended for arborists and tree-care businesses and is not directed at children. We do not knowingly collect personal data from children under the age of 13 (or 16 in the EEA). If you believe we have inadvertently collected data from a child, please contact us at info@treetify.app and we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy within the App or by sending you an email. The "Last updated" date at the top of this Policy reflects when changes were made. Your continued use of the App after changes are posted constitutes acceptance of the updated Policy.

17. Contact

For any questions, requests, or concerns about this Privacy Policy or your personal data:

Bobr na stromě s.r.o. (operating Treetify)
Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic
Email: info@treetify.app