Privacy Policy
Saibro Lda.
1. Who we are and what this policy covers
Saibro Lda. (“Saibro”, “we”, “us”) makes web software, with an Android field app, that enhanced rock weathering developers use to plan the soil sampling rounds of a project and to compute the measured claim for each reporting period. Its models read the project data a developer uploads, such as field boundaries, baseline results, the rock analysis, spreading logs and lab results, and propose how many soil cores go where; people at the developer approve every plan and every claim. This policy explains what personal data we handle when we do that, and why.
Registered at Rua Romão Ramalho 59, Sala 2.04, 7000-671 Évora, Portugal.
We handle personal data in two different situations, and different rules apply to each:
| Whose data | Our role | What applies | |
|---|---|---|---|
| Part A | People who visit this website, ask about the service or write to us | Controller: we decide why and how the data is used | This policy |
| Part B | Staff of our customers who use the service (MRV leads, scientists, field team members and lab staff), verifiers a customer invites, and farmers and farm managers whose names or land appear in the project data a customer uploads | Set out in B.1, because it depends on the data | This policy and the data processing agreement we sign with each customer |
If the data processing agreement (“DPA”) and this policy ever disagree about Part B, the DPA wins.
2. Part A: this website and our contact with you
This part covers the personal data we collect for our own purposes: running this website, answering requests, and staying in touch with people who are or might become customers.
A.1 What we collect
What you give us. When you send the form on this site, we collect what you type into it, such as your name, email address, phone number or company, and the fact that you agreed to be contacted. If you email or talk to us, we keep that correspondence and any contact details in it.
What is collected automatically. Our web server records the IP address a request came from, the browser used, the pages requested, the page you came from and the time. These logs exist to keep the site running and secure.
We don’t ask for sensitive data (the “special categories” in Article 9 GDPR) through this website, so please don’t send any through the form.
A.2 Why we use it, and what allows us to
| Why | What | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering your request and working out whether the service fits | What you sent in the form, our correspondence | Art. 6(1)(b): steps you asked for before a contract |
| Looking after customers, billing and support | Contact details, correspondence | Art. 6(1)(b): carrying out a contract |
| Keeping the site running, secure and free of abuse | Server logs | Art. 6(1)(f): our legitimate interest in running a secure service |
| Contacting you about the service | Email address, company | Art. 6(1)(f): our legitimate interest in business-to-business marketing. You can object at any time |
| Meeting tax, accounting and legal duties | Billing and contract records | Art. 6(1)(c): a legal obligation |
Where we rely on legitimate interest, we have weighed that interest against your rights, and you can ask to see the assessment.
A.3 How long we keep it
- Requests from people who don’t become customers: 12 months from our last contact, then deleted.
- Customer contact and contract records: for the length of the agreement plus ten years, the period article 123 of Portugal's Corporate Income Tax Code sets for a company's books and the documents behind them.
- Server logs: 30 days.
- A record that you objected or opted out: kept indefinitely, so we can keep respecting it.
A.4 Your rights
If you are in the EEA or the UK, you can ask to see your data, correct it, have it deleted, limit or object to how we use it, get a copy you can take elsewhere, and withdraw consent where we rely on it. Write to [email protected] and we will answer within one month.
You can also complain to a data protection authority. If you are in the EEA, that can be the authority where you live or work.
3. Part B: data inside the service
This part covers the data that passes through the service itself: the project data a customer uploads, the core records its field team logs in the app, and the accounts of the people who sign in.
B.1 What we handle, and in what role
For project data and core records we act as a processor under the EU General Data Protection Regulation (GDPR), on the instructions of the developer, which decides what a project holds and is the controller. For the account details of the people who sign in, and for billing, we act as a controller. The service handles the following:
- Field boundaries and farm records. Field and Unit boundaries, field names, control plots and, where the customer includes them, the farm's name, the farmer's or farm manager's name and contact details, and the numbers its parcels carry in IFAP's parcel identification system (iSIP).
- Spreading logs. For each field, the dates rock was spread, the tonnes per hectare, the rock lot and, if the customer's log carries them, the names of the contractor, the vehicle and its operator.
- Lab and rock results. Sample identifiers, element and oxide concentrations, mineralogy and particle size results, the lab's name, and the analyst names printed on its result sheets.
- Core records from the field app. For each core: its planned point, the position the phone recorded when the core was logged, the time, the depth, the account that logged it, and any reason given for replacing or skipping a point.
- Accounts. Names, work email addresses, roles and sign-in records of the customer's users and of the verifiers a customer invites.
The field app records a position only at the moment a core is logged. It keeps no track of where anyone walks or drives, and it never uses the phone's camera or microphone.
Names, contact details and parcel numbers are removed before project data reaches any model. Models read boundaries, soil, rock, spreading and lab values only.
Our staff see a customer's project only through a support session one of the customer's admins opens for a set number of hours, at most eight, and each session is listed in the project's history.
A verifier the customer invites can read the file pack of the reporting period it was invited to and nothing else, and loses access when the customer removes it.
B.2 What we do with it
Planning rounds. Our weathering models read the project data, without names, contact details or parcel numbers, and propose how many cores each zone of each Unit needs. They run on cloud GPU capacity we control in N. Virginia, United States.
Reading lab sheets. A document model we run ourselves reads lab result files that arrive as PDFs into rows; files that arrive as spreadsheets or CSV are read by fixed rules. Every value it is unsure of, and every sample identifier that matches no planned core, is shown to the person who uploaded the file to resolve.
The claim and the file pack. The claim for a reporting period is computed from the measured cores with the protocol's own calculation, and no model output enters it. The file pack is released only after a person the customer names approves the claim.
Approval by people. No plan reaches the field app and no claim reaches the file pack until a person the customer names approves it. Our scientists review a plan only when the customer asks them to.
No onward sale. We do not sell, rent or share project data. The subprocessors that host the service on cloud infrastructure in N. Virginia, send our email and take payment are named on our subprocessor list, and no third-party model provider is among them.
B.3 AI models: where they run and what they learn from
Where models run. Every model in the service runs on cloud GPU capacity we control in N. Virginia, beside the rest of the service on cloud infrastructure in N. Virginia: the weathering models (a neural network with a spatial term fitted per project, gradient-boosted trees with kriging, and a rate law fitted per rock) and the document model that reads lab sheets. They read project data with names, contact details and parcel numbers removed. No project data is sent to a third-party model provider, which is why none appears on our subprocessor list. The field app runs no model.
Training. We do not train our shared models on a customer's data unless the customer opts in, in writing, for a given project. Each project's own fit is trained on that project's data alone, serves only that project and is deleted with it. A customer who opts in shares field-level pairs, meaning the inputs the model read and the signal the cores measured, with coordinates coarsened to a 10 km grid and no farm or farmer names; they train our shared network, and corrected lab sheets the customer also opts in train our sheet reader. Withdrawing stops their use in future versions. Otherwise the shared network is trained only on published field-trial data whose licenses allow it and on public soil, climate and land-use data.
Where a person decides. The models propose and people decide. A plan reaches the field app only after a person the customer names approves it, and a claim reaches the file pack only on the same approval. The models never drop a field from a claim, never remove an outlier on their own, never plan fewer than one core per 10 hectares in a Unit, and allocate nothing in fields whose inputs fall outside the data they were trained on; there, the plan falls back to plain power analysis. Each reporting period a model must place at least nine in ten cores from fields held out of its fit inside its 90% range, or it stops shaping plans until a retrained model passes. The service makes no automated decision with legal or similarly significant effect on any person.
B.4 Where the data is kept
Project data, core records, lab results, plans, claims and account details are stored and processed on cloud infrastructure in N. Virginia, United States. Personal data among them is transferred from the European Union under the European Commission's standard contractual clauses.
The field app keeps the round's plan and the cores logged on the phone until they reach our servers, then deletes its copy. Saibro Lda. is registered in Évora, Portugal, and our staff there reach project data only through support sessions. Payment details are held by our payment provider and never reach our systems.
The suppliers that handle data in the service are named on our subprocessor list, which comes with the data processing agreement and which we send to anyone who asks: write to [email protected].
B.5 How long we keep it, and what deleting can’t remove
Project data, plans, lab rounds and claim versions are kept while the account is open. After it closes, the customer has 90 days to export them and they are then deleted, unless the customer asks us in writing to keep a read-only archive until the end of the project's crediting period.
Core records stay with the project for as long as it is kept, because a verifier may ask where and when each core was cut.
Account details are kept for the life of the account and 24 months after it closes.
Field-level pairs a customer has opted in to share, with coordinates coarsened to a 10 km grid and no names, are kept for as long as the shared model they train is in use.
Invoices and the accounting records behind them are kept for ten years, the period article 123 of Portugal's Corporate Income Tax Code sets for a company's books and the documents behind them.
B.6 Requests from people whose data is in the service
If your name or land appears in a developer's project, for example as a farmer whose fields received rock, the developer decides what the project holds, and requests to see, correct or delete that data go to them. If you write to us instead, we pass your request to the developer within five business days and help them answer it. If you hold an account with us, write to us directly about your account details.
For everyone
4. Moving data between countries
Saibro Lda. is a company in Portugal, inside the EEA. Section B.4 says where the data in the service is kept. If any personal data we control ever has to leave the EEA, for example because a supplier named on our subprocessor list handles it elsewhere, it is protected by the European Commission’s Standard Contractual Clauses or another safeguard the GDPR accepts. You can ask us for a copy.
5. Security
We protect data in line with the risk. That includes encryption in transit and at rest, access limited to the people and systems that need it, each customer’s data kept separate from every other’s, and a log of every access to production systems.
If a personal data breach affects you, we tell you without undue delay, and at the latest within 36 hours of finding out, with the information you need to meet your own reporting duties.
6. Children
The service is sold to businesses and is not meant for children. We don’t knowingly collect personal data from anyone under 16.
7. Changes to this policy
We may update this policy. If a change matters, we email customers at least 30 days before it takes effect. The version number and date at the top of this page change every time.
8. Contact
Privacy questions and anything else: [email protected]
By post: Saibro Lda., Rua Romão Ramalho 59, Sala 2.04, 7000-671 Évora, Portugal