Legal
Operational Privacy Policy
Layer 1
Executive Summary
Data Residency
Freyr's own platform is hosted exclusively on EU-owned infrastructure in Finland (Hetzner). The one exception is payment, where our provider runs on Google Cloud under SCCs / the EU-US Data Privacy Framework.
Data Ownership
All data entered into a farm's Freyr account belongs to the account holder: the farm business that created and pays for the account. That includes everything entered by staff or advisers the account holder has added.
Minimalism
We process only the telemetry required to deliver precision agriculture services.
EU-First Infrastructure
Core infrastructure runs on EU-owned providers. No personal data is sold to brokers. Where a provider is non-EU-owned (our payment provider Mollie, which runs on Google Cloud), Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework apply.
Layer 2
Detailed Disclosure (Art. 13 & 14 GDPR)
1. Identity and Contact Details of the Controller
The data controller is Arcteon Oy, a Finnish limited liability company (Y-tunnus: pending registration). Registered address: Helsinki, Finland. This Privacy Policy applies to the Freyr precision agriculture platform (freyrag.com and app.freyrag.com) operated by Arcteon Oy. For data protection matters, contact dpo@arcteon.space.
2. Legal Basis for Processing (Article 6 Matrix)
| Data Category | Purpose of Processing | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Account Data | Registration, authentication, and account management. | Art. 6(1)(b): Performance of a Contract. |
| Field Geometry | Definition of operational perimeters for satellite analysis. | Art. 6(1)(b): Performance of a Contract. |
| Field Event Photos | An optional photo you or your farm's staff attach to a field journal entry, to show the work that was done. Location, time and camera details are removed from the photo when it is uploaded. | Art. 6(1)(b): Performance of a Contract. |
| Satellite Telemetry | Generation of crop health (NDVI) and harvest optimization reports. | Art. 6(1)(b): Performance of a Contract. |
| Weather Data | Field coordinates sent to national weather APIs (FMI, SMHI, MET Norway) for forecast display. | Art. 6(1)(b): Performance of a Contract. |
| VRA Maps | Variable-rate application map generation from field data and NDVI zones. Field NDVI pixels are grouped into management zones by k-means clustering — the one AI model we run. | Art. 6(1)(b): Performance of a Contract. |
| Account Metadata | Service communication, authentication, and security alerts. | Art. 6(1)(f): Legitimate Interest (System Security). |
| Security Logs | IP addresses, login timestamps, and access logs for fraud prevention. | Art. 6(1)(f): Legitimate Interest (Security). |
| Error and Crash Diagnostics | Detecting and diagnosing software faults, so that a defect cannot silently corrupt or lose your field records. A report contains the error, where in our code it happened, and a correlation identifier — never your name, your email address, or your field geometry. | Art. 6(1)(f): Legitimate Interest. The interest pursued is service integrity and security. You may object at any time under Art. 21 by contacting dpo@arcteon.space. |
| Email Notifications | Delivery of platform notifications and communications. | Art. 6(1)(b): Performance of a Contract. Field alerts and service notices are part of the service you subscribe to. You control delivery in your alert settings. |
| Email Delivery Protection | Keeping a list of addresses we must stop emailing, so that a message which bounced or was reported as spam is not sent again. The list holds the address, the reason, and when the entry was added or removed — no message content and no field data. Entries expire automatically after 90 days. | Art. 6(1)(f): Legitimate Interest. The interests pursued are protecting email delivery and sender reputation: honouring bounce and spam-complaint signals, so we stop mailing an address that cannot or does not want to receive, and keeping our sending domain trusted, so other farmers' password resets and field alerts still arrive. You may object at any time under Art. 21 by contacting dpo@arcteon.space. |
| Billing Data | Payment processing via Mollie, invoice generation and storage. | Art. 6(1)(b): Contract + Art. 6(1)(c): Legal Obligation (Finnish Accounting Act). |
| Legal Compliance | DSAR request records, consent audit trails, identity verification. | Art. 6(1)(c): Legal Obligation (GDPR). |
| Farm Member Accounts (staff and advisers) | A farm's account holder can add staff or an adviser to work in the farm's account. For these member accounts and everything members enter, the farm is the controller and Arcteon processes the data on the farm's behalf: the member's full name and email address, which the farm supplies, their sign-in, and their name on the entries they make. | The farm's own lawful basis as controller (typically its employment or service relationship with the member). Arcteon acts as the farm's processor (Art. 28). Sign-in security logs are Arcteon's own, under the Security Logs row above. |
| Web Push Notifications | A notification that Freyr has a new alert for your farm, with no alert content included — you open the app to read it. The push is delivered only through the browser's own push service: Google Firebase Cloud Messaging (FCM) on Chrome and Android, or Microsoft's Windows Notification Service (WNS) on Microsoft Edge and Windows. We hold only the device's subscription endpoint and encryption keys for this purpose, never the alert itself. Web Push is not offered in Safari, on iPhone or iPad, or in Firefox — on those devices you still get alerts by email and in the app. | Art. 6(1)(b): Performance of a Contract. Push is part of the alert delivery you choose in Settings; turning it off does not affect email or in-app alerts. |
| Machine File Import (TaskData) | When you upload a terminal's TaskData file, Freyr reads it and shows each completed task for you to review. For each task we keep the matched parcel, the kind of work, product, rate, unit, area, start and end time, and your decision. The uploaded file is kept for 90 days after you have reviewed every task in it, and at most one year after upload if the review is never finished, then deleted. The GPS tracks and operator names inside the file are read only to work out the totals and the matching parcel; they are not kept. Records you approve are written to your fertilisation or plant-protection register or your field journal and kept as long as those records are. | Art. 6(1)(b): Performance of a Contract, feeding your approved records into the statutory registers under Art. 6(1)(c) once you approve them. |
| Farm-Member Permissions | A farm owner can allow or deny each staff member or adviser, by role, six separate actions: downloading machine files (ISO 11783 prescription ZIPs and completed-task exports), sending to agrirouter, downloading official reports (compliance PDFs, inspection dossiers, Vipu packs and organic reports), input purchase records, variable-rate zone generation, and the register and eco-evidence downloads and exports. Granting or removing one of these for a role does not affect the others. | Art. 6(1)(b): Performance of a Contract. Each farm sets these on its own instruction; Arcteon processes member accounts as the farm's processor (Art. 28). |
| Farm Business Data (Pro) | With Pro, a farm can keep its business records beside its registers: its list of products, including the reason an organic farm gave for listing a product not approved for organic farming; the price paid on input purchases and which product on the list a purchase, sowing, fertilisation or spraying entry used; harvest stores, the lots put into them with the parcels each lot came from, and what was taken out; and the farm's own selling prices. From these, Freyr works out stock left and the gross margin per crop, before subsidies, each time you open them; those figures are not stored. The farm owner decides what staff and advisers may see or change: by default staff do not see selling prices or margins, and an adviser can view them; prices paid on input purchases follow the input purchases permission, which lets staff view them by default. This data is not shared outside Freyr and involves no new service provider or transfer. | Art. 6(1)(b): Performance of a Contract. |
| Product Feedback and Surveys | Improving Freyr from what you tell us: messages and screenshots you send through Feedback, and your answers to optional short surveys — how likely you are to recommend Freyr, or whether a help article was useful — with any comment you add. | Art. 6(1)(f): Legitimate Interest. The interest pursued is improving the service from its users' experience. Answering is always optional. You may object at any time under Art. 21 by contacting dpo@arcteon.space. |
3. Data Subject Rights
In accordance with Chapter III of the GDPR, Users may exercise the following rights via the platform interface or by contacting the Data Protection Officer:
- Right of Access & Portability: Users may export their operational data in standard formats (e.g., ISOXML, GeoJSON, CSV) via Settings > Data Export.
- Right to Erasure: Users may request the permanent deletion of their account and all associated field data via Settings > Account.
- Right to Rectification: Users may update field boundaries or account information to ensure data accuracy.
- Right to Restriction of Processing: Users may request that processing of their data be restricted while a complaint or rectification request is pending.
- Right to Object: Users may object to processing based on legitimate interest (Art. 6(1)(f)). We will cease processing unless compelling legitimate grounds override.
- Right to Withdraw Consent: Where processing is based on consent, users may withdraw it at any time via Settings > Consent & Privacy. Withdrawal does not affect the lawfulness of prior processing.
- Right to Lodge a Complaint: Users may file a complaint with the Finnish Data Protection Authority: Tietosuojavaltuutetun toimisto, P.O. Box 800, FI-00521 Helsinki, Finland. Email: tietosuoja@om.fi. Phone: +358 29 56 66700.
- Staff and Advisers of a Farm: If a farm has added you to its account, the farm is the controller of your account and of the entries you make, and those entries belong to the farm. Direct requests about them to the farm; we help the farm answer them. Freyr does not release a farm's data to a member without the farm's decision.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Finnish Data Protection Authority (Tietosuojavaltuutetun toimisto), P.O. Box 800, FI-00521 Helsinki, Finland. Email: tietosuoja@om.fi. Phone: +358 29 56 66700. Website: tietosuoja.fi.
Execution: Requests for erasure are acknowledged within 72 hours. Account deletion includes a 30-day grace period during which you may cancel the request, after which all personal data is permanently removed from active systems. Backup purging completes within 90 days.
4. Technical and Organizational Security Measures
EU Localization: Core infrastructure is hosted by Hetzner Online GmbH in Finland (EU-owned). The one exception is payment: our provider (Mollie) runs on Google Cloud, covered by SCCs and the EU-US Data Privacy Framework.
Encryption: Data is encrypted both in transit (TLS 1.3) and at rest (AES-256) using industry-standard protocols.
Audit Trails: All data access and modifications are recorded in append-only audit logs with timestamps and actor identification, enabling post-incident reconstruction.
Access Controls: Role-based access control (RBAC) with principle of least privilege. Administrative actions require separate authentication and are logged independently.
5. Retention and Disclosure
Personal data is retained according to the schedule below. Upon account deletion, data is removed per the retention periods listed.
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account data | Kept while your account is active or in trial. If you ask us to delete your account yourself, we wait 30 days before doing so in case you change your mind. If access instead ends because a paid or free year, or an unpaid trial, comes to an end, we email you that same day and erase your data 3 months later — 1 month if it was a trial — unless you pay before then, which restores access and keeps everything. | Art. 6(1)(b) Contract |
| Field & agricultural data | Kept while your account is active or in trial. If access ends because a paid or free year, or an unpaid trial, ends without payment, this data is erased 3 months later (1 month after a trial); we email you on the day access ends, and paying before the erasure date keeps everything. | Art. 6(1)(b) Contract |
| Field event photos | Kept with the journal entry they belong to. Erased when the entry is deleted, when the field is removed (also when you keep the field's compliance record), or when your account is erased — including 3 months after unpaid access ends (1 month after an unpaid trial). | Art. 6(1)(b) Contract |
| Satellite imagery (NDVI) | Kept while your account is active or in trial, on the same schedule as your other field data: erased 3 months after unpaid access ends (1 month after an unpaid trial), unless you pay before that date. You're emailed the day access ends. | Art. 6(1)(b) Contract |
| Billing records | 6 years from the end of the year in which the financial year ended | Finnish Accounting Act (kirjanpitolaki 1336/1997) and VAT Act (arvonlisäverolaki 1501/1993) |
| Access & security logs | 12 months | Art. 6(1)(f) Legitimate Interest |
| Consent records | 3 years after withdrawal | Art. 5(2) Accountability |
| DSAR request records | 3 years from request completion | Art. 6(1)(c) Legal Obligation |
| Support tickets | 2 years after resolution | Art. 6(1)(f) Legitimate Interest |
| Farm member accounts | Kept while the account belongs to at least one farm. When the account stops belonging to any farm — because the farm removed the member or the farm's own account was erased — we email the member the date and erase the account one month later, unless a farm adds them again before then. A new member account whose set-password link is never used is erased when the link expires, 7 days after it was sent. Entries the member made stay with the farm as the farm's records. | On the farm's instructions (Art. 28); deletion when the service to the farm ends (Art. 28(3)(g)) |
| Machine file import (TaskData) | The uploaded file: 90 days after you have reviewed every task in it, at most one year after upload if the review is never finished. Approved records: kept as long as the register or field journal they were written to. GPS tracks and operator names in the file: never kept. | Art. 6(1)(c) Legal Obligation (approved records); Art. 5(1)(e) Storage Limitation (the uploaded file) |
| Web Push subscriptions | Kept while push is turned on for that device. Removed when you turn push off, sign out on that device, or the device's subscription changes — whichever happens first. | Art. 6(1)(b) Contract |
| Farm business data | Kept with the farm's other records for as long as its field and agricultural data, and erased with them — including 3 months after unpaid access ends (1 month after an unpaid trial). | Art. 6(1)(b) Contract |
| Product feedback and surveys | 24 months after you send it | Art. 6(1)(f) Legitimate Interest |
Third-Party Disclosure: Arcteon does not sell, lease, or trade user data to third parties for profiling, marketing, or advertising purposes.
6. Cookies and Tracking Technologies
Freyr sets no tracking cookies. We use no analytics, advertising, marketing, retargeting, or social-media cookies, and we do not measure how you use the app, where you arrived from, or where you go afterwards. Our model is a paid agricultural service, not data monetisation. Only strictly-necessary technologies are involved, described below.
- Authentication uses one strictly necessary cookie, freyr_refresh, which keeps you signed in. It is HttpOnly, SameSite=Strict, scoped to /api/auth, and expires after 7 days. Under the ePrivacy Directive (Art. 5(3)) a strictly necessary authentication cookie requires no consent. The short-lived access token it issues is held in memory only, and neither is ever used for tracking.
- Payment requires strictly-necessary cookies. To take a payment, our payment provider (Mollie) sets strictly-necessary cookies — session, security, and fraud-prevention such as 3-D Secure — during the checkout step. Under the ePrivacy Directive (Art. 5(3)) these are exempt from consent, because they are required to deliver a service you asked for. Freyr uses Mollie's hosted checkout, so these cookies live on Mollie's own domain, not on freyrag.com, and are only involved when you pay.
- No analytics or tracking cookies are set on freyrag.com or app.freyrag.com. No Google Analytics, Facebook Pixel, or any US-based tracking service is used.
- Fonts are served via Bunny Fonts, an EU-based, GDPR-compliant alternative to Google Fonts.
- Maps use OpenFreeMap tiles with no tracking and no API keys required.
- CDN services are provided by Bunny.net, an EU-headquartered company (Ljubljana, Slovenia).
- No advertising networks, retargeting scripts, or social media tracking widgets are present.
- Your preferences (language, theme) are kept in the browser's local storage and are never transmitted to third parties.
7. Sub-Processors and Third Parties
The following third parties process data to deliver the Freyr platform. Sub-processors act on Arcteon Oy's behalf under data processing agreements; our payment provider (Mollie) acts as an independent controller for the payment data it receives.
| Service Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure and hosting | All platform data | Helsinki, Finland (EU) |
| Bunny.net d.o.o. | CDN and font delivery | Static assets, font requests | Ljubljana, Slovenia (EU) |
| OpenFreeMap | Map tile serving | Map tile requests (no PII) | EU-hosted |
| Nuntly | Transactional email delivery | Email address, email content | Chatillon, France (EU) |
| Mollie B.V. | Payment processing (independent controller) | Name, billing details, payment-card data (tokenised by Mollie), transaction metadata | Netherlands (EU) — platform hosted on Google Cloud (US-owned) |
| Copernicus / ESA | Satellite imagery source | Field coordinates (for image queries) | EU |
8. International Data Transfers
Freyr's own infrastructure is hosted within the European Union on EU-owned providers (Hetzner Online GmbH, Finland); map tiles, CDN, and fonts are EU-based, and transactional email (Nuntly, France) is processed within the EU. The one exception is payment: our provider, Mollie (Netherlands), runs on Google Cloud, a US-owned provider. Any resulting transfer or access risk is addressed through Standard Contractual Clauses and the EU-US Data Privacy Framework, documented in our Schrems II assessment. Should other services require processing outside the EEA, this policy will be updated with at least 30 days' notice and details of the safeguards applied.
9. Automated Decision-Making and Artificial Intelligence
Freyr uses satellite data analysis and machine learning techniques to provide agricultural guidance. These tools assist farmers in understanding field conditions but do not make decisions with legal or similarly significant effects as defined under GDPR Article 22.
- NDVI Analysis: Satellite imagery is processed to generate crop health indicators (Normalized Difference Vegetation Index). These are observational measurements, not automated decisions.
- Variable-Rate Zoning (the one AI model we run): field NDVI pixels are grouped into management zones by k-means clustering. This is machine learning applied to your field geometry and imagery. Every zone is shown to you and can be edited or rejected before any plan is exported — no zone is applied automatically. Model details are published in our AI documentation.
- Confidence Scoring: Each analysis output includes a confidence level (HIGH, MEDIUM, or LOW) indicating data reliability. Low-confidence results are flagged and may be suppressed.
- Agronomic Guidance: Recommendations are generated by a deterministic, template-based engine — not opaque AI. Outputs are predictable, auditable, and based on published agronomic science.
- AI Transparency: In-app AI transparency badges identify where automated analysis is used. Explanation drawers provide details on methodology, data sources, and confidence factors.
- No Profiling: Freyr does not profile users for marketing, credit scoring, or any purpose outside agricultural service delivery.
10. Children’s Data
Freyr is designed for professional agricultural use and is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that personal data of a child has been collected, we will take steps to delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email to registered users and through an in-app notification at least 30 days before taking effect. The current version number and effective date are always displayed at the top of this page. Previous versions are available upon request by contacting dpo@arcteon.space.