1. Information We Collect
We collect the following categories of information when you use GAP APP:
- Account Information: Name, email address, and password when you create an account.
- Farm Profile Data: Farm name, address, operation type, water sources, worker count, and other compliance-related farm details.
- Compliance Records: SOPs, daily logs, facility checklists, HACCP plans, mock audit results, and assessment data.
- Photos and Media: Images uploaded for compliance documentation, photo validation, and facility records.
- Geolocation Data: Location information captured with logs and traceability events when you grant permission.
- Traceability Data: Lot codes, harvest records, critical tracking events, supplier information, inventory receipts, and shipping records.
- Documents: Uploaded certificates, permits, test results, and other compliance documents.
2. How Your Data Is Shared with Outside Platforms
Your data is shared with the following categories of third-party services to provide the functionality of GAP APP:
- AI / Large Language Model Providers: We send portions of your data to third-party AI model providers to power features such as:
- Generating and explaining Standard Operating Procedures (SOPs)
- Analyzing farm risks and producing risk assessments
- Validating compliance photos
- Generating mock audit questions and evaluating responses
- Creating compliance reminders and readiness roadmaps
- Generating traceability and export reports
Data sent may include farm profiles, log entries, SOP content, photos, and other compliance information relevant to the feature being used.
- Cloud Hosting and Database Infrastructure: All data is processed and stored using third-party cloud hosting and database services. These providers may process your data in various geographic locations.
- Auditor Access: When you create and share auditor access links, the recipients can view your farm's compliance data including facilities, SOPs, logs, documents, and checklist status.
3. AI-Assisted Processing
Some GAP APP features use artificial intelligence to help you keep records. When you use one of these features, we send the parts of your records that the feature needs — for example your farm profile, log entries, SOP text, photos, or an uploaded document — to an AI model and return its output to you.
- How it is sent: AI requests are made from our servers, not from your device, through the Lovable AI Gateway. The models we currently use are provided by Google (Gemini models) and OpenAI. The models used may change as we improve the Service.
- You stay in control: AI output — such as draft SOPs, risk suggestions, document readings, photo checks, and mock-audit feedback — is a suggestion. It can be incomplete or wrong. You are responsible for reviewing and editing it before relying on it or keeping it in your records, and it is never a certification decision.
- Usage records: We keep a record of each AI request (such as the feature used, the model, and how much was processed) to monitor cost and reliability.
- Only when you use it: Data is sent for AI processing when you, or someone on your farm team, use an AI-assisted feature.
4. How We Use Your Information
We use your information to:
- Provide and maintain the GAP APP service
- Generate AI-powered compliance insights and recommendations
- Track your audit readiness and compliance progress
- Send you compliance reminders and notifications
- Enable traceability and recall management features
- Improve the Service and develop new features
5. Your Data Belongs to You
You own the records you put into GAP APP — farm profiles, logs, SOPs, photos, documents, and traceability data. We use them only to provide the Service to you, as described in this policy and in Section 4 of our Terms of Service. Each farm's records are kept separate from other farms'. Beyond the service providers described in Section 2, your records are shared through the sharing features you choose to use — for example inviting team members or consultants, creating auditor links, granting buyer access, or publishing public traceability or directory information.
6. Data Retention, Export, and Deletion
We retain your data for as long as your account is active or as needed to provide the Service. Compliance records may be retained for the duration required by applicable food safety regulations. Some data may be retained as required by law or for legitimate business purposes even after account deletion.
To get a copy of your data:
- Use the export tools in the app (CSV exports, PDF reports, and the Export Binder) at any time, or
- Email hello@mygapapp.com from the address on your account and ask for an export.
To ask us to delete your data:
- Signed in, go to Settings and choose Delete my account or farm data. You can ask us to delete your account and personal data; a farm owner can also ask us to delete that farm's records. Or
- Email hello@mygapapp.com from the address on your account.
Our team reviews each request and contacts you before deleting anything. Deletion is permanent, so export anything you need to keep first.
Operator responsibility: FSMA 204 generally requires covered entities to retain required traceability records for two years, subject to specific exceptions, and to make required records available to FDA upon request. GAP APP provides export tooling (CSV, PDF, Export Binder) to help you meet these obligations, but you are responsible for periodically exporting and independently retaining off-platform copies of your records. Following account termination, extended inactivity, or non-payment, we may — with reasonable notice where practicable — archive, restrict access to, or delete your data. Export your records before any such event. See our Terms of Service for full details.
7. Data Security
We implement industry-standard security measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
8. Your Rights and Controls
You have the right to:
- Access and review the data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention requirements) — see Section 6
- Export your data through our export and binder features
- Revoke auditor access links at any time
- Control geolocation permissions through your device settings
9. Children's Privacy
The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the Service or via email. Your continued use after changes take effect constitutes acceptance of the updated policy.