This Privacy Policy applies to PlantOps, the plant-care operations management service provided by Office Hasegawa. It also covers information about customers, employees, business contacts, and site contacts that customer organizations enter into the service. The separate Office Hasegawa website privacy notice covers the corporate website itself.
1. Provider and scope
PlantOps is operated by Office Hasegawa, a sole proprietorship. Business address: 2F-C Shibuya Dogenzaka Tokyu Building, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan. Contact us about privacy at [email protected]. This Policy applies to PlantOps users and personal information entered into the service by customer organizations.
2. Information we handle
- Account and organization information: names, email addresses, authentication and session information, organization membership, roles, language, and time zone.
- Customer and work information: customer and contract details, contact names, email addresses and phone numbers, site addresses, location information, contacts and access notes, plant records, visit schedules and assignees, checklists, work records and notes, plant relocation and replacement history, reports, and uploaded photos.
- Subscription and billing information: plan and subscription status, billing details, Stripe customer, subscription, and invoice identifiers, and payment status. PlantOps does not store card numbers or other payment credentials; Stripe handles them.
- Usage and security information: service actions and audit records, access times, IP addresses and other network or device information, support requests, notification recipients, and records used for troubleshooting and abuse prevention.
Free-text fields, work records, and photos entered by a customer organization may contain information about other people. PlantOps does not continuously track user locations. Metadata is removed from JPEG, PNG, and WebP photos before storage.
3. Purposes and roles
We use information to create and manage accounts, provide PlantOps, manage contracts and billing, respond to requests, send service notices, maintain security, prevent abuse, investigate incidents, improve the service, and comply with law. Where applicable law requires a legal basis, we rely on the performance of a contract, compliance with a legal obligation, consent, or our legitimate interests in securing and operating the service, as applicable.
When a customer organization enters information about its customers, employees, business contacts, or site contacts, that organization usually determines the purposes, content, and sharing scope and is responsible for providing required notices and obtaining any required legal basis. Office Hasegawa processes the information as needed to provide PlantOps and follow the organization’s instructions. Office Hasegawa determines the purposes for information needed to operate the service, such as account, contract, billing, and security information. For information within a customer organization, contact the organization that entered it first.
4. Service providers and international processing
- Cloudflare: runs the PlantOps app and API and provides network, security, D1 database, R2 photo storage, backup storage, and Cloudflare Email Service for verification, password-reset, invitation, and operational emails. The sender is “PlantOps” ([email protected]), with ordinary replies directed to [email protected]. Cloudflare handles message content, recipients, subject lines, and sending-event information as needed to deliver email. Log, analytics, message-preview settings, and retention periods depend on our Cloudflare account configuration and Cloudflare’s terms. Email processing regions depend on Cloudflare’s service configuration; we do not guarantee processing only in a particular country.
- Stripe: provides Checkout, the customer portal, payment, invoices, and subscription management for paid plans. Stripe handles payment information under its own terms and privacy documents.
PlantOps production data is processed and stored using Cloudflare D1 and R2. The placement regions for D1 and R2 depend on Cloudflare’s service configuration; they do not guarantee that data is stored or processed only in a particular country or region, or prevent access from other regions. App and API requests are also processed across Cloudflare’s network. Providers may process information in other countries as needed to provide their services and under their respective terms. Where required by applicable law, we provide transfer notices and use required contractual safeguards or other transfer mechanisms.
Provider information: Cloudflare Privacy · Cloudflare DPA · Cloudflare subprocessors · Stripe
5. Retention and deletion
We retain information while an account or subscription is active and for as long as needed to provide PlantOps. After a contract ends, we verify a deletion request from the customer organization and complete the necessary operational checks before deleting information from active systems, except for information needed for legal obligations, billing, disputes, or security. We retain information required by law only for the period needed for that purpose.
A workspace deletion request must be submitted by its owner, verified by email, and reviewed by the operator before it is processed. Deleted photos may remain in a recovery archive for up to 30 days, after which they are deleted. Deleted information may also remain in database recovery history and backups for up to 30 days before those copies expire or are deleted. There may be a delay between deletion from ordinary service screens and deletion from all recovery copies.
Cloudflare Email Service or Stripe may retain email and payment-related records under their own terms, account configuration, and legal obligations. Send deletion requests or questions about your information to [email protected].
6. Cookies and security
We use cookies or browser storage needed to keep you signed in, prevent request forgery, and provide PlantOps’s core functions. We do not sell PlantOps information or use it for targeted advertising.
We use safeguards appropriate to the service, including organization-level data separation, role-based access controls, encrypted connections, authenticated access to private files, audit records, and backup controls. We also rely on infrastructure providers’ safeguards, including encryption at rest where provided. Operator access to customer records, site access details, and plant records is limited to an active request with a recorded reason and scope that the customer organization’s owner has approved. Access and status changes are recorded in audit logs. We regularly review these measures, but no communications or information system can be guaranteed completely secure.
7. Privacy requests, changes, and contact
Depending on applicable law, you may have the right to request access, correction, deletion, restriction of processing, object to processing, or receive a portable copy of information. You may also be able to withdraw consent for future processing where processing is based on consent. To make a request, contact us below and provide the information needed to verify your identity. We will respond after verifying that you are the individual or an authorized representative, except where applicable law provides otherwise. You may also have the right to complain to the privacy regulator in your location. The customer organization may be responsible for requests concerning information it entered about its customers, employees, business contacts, or other individuals; please contact that organization first.
When we change this Policy, we will post the updated text and its effective date on this page. We will notify users of material changes using a method required by law or contract.
Privacy contact: [email protected]