Privacy Policy

Account information

When your employer creates an account for you, we collect your name, email address, role, and phone number. Account credentials are stored using industry-standard bcrypt hashing — we never store plaintext passwords.

As you use Kloro, we collect data necessary to operate the service, including:

• Property information (addresses, plant inventories, zones, care records)
• Visit records (scheduled dates, arrival/departure times, form data, activity logs)
• Time entries (clock in/out, break tracking, activity types)
• Photos you upload during visits
• Notes, observations, and client preferences
• Invoice and payment records

We ingest publicly available weather data from the Open-Meteo API based on weather station IDs associated with properties. This data is used to calculate Growing Degree Days (GDD) and generate horticultural advisories. No personal data is shared with Open-Meteo.

When you use the Kloro mobile app, we may collect device identifiers for push notification delivery. We access your camera and photo library only when you explicitly choose to take or attach photos during a visit — we do not access these in the background.

We collect standard server logs (IP addresses, request timestamps, browser/device type) for security monitoring and service reliability. We do not use third-party analytics or advertising trackers.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Generate phenology advisories and weather-based scheduling intelligence
• Process invoices and facilitate payment between firms and their clients
• Send transactional emails (visit summaries, invoice notifications, account invitations)
• Deliver push notifications for visit assignments and schedule changes
• Ensure security and prevent unauthorized access
• Respond to support requests

We do not sell your data. We do not use your data for advertising. We do not build profiles for purposes unrelated to the Service.

We share your information only in the following circumstances:

• Within your organization: Data you enter is visible to other users in your tenant (firm) according to their role permissions. Managers can see crew member activities.
• Client portal: Property owners who access the client portal can view visit summaries, photos, invoices, and property information related to their properties only.
• Service providers: We use the following third-party services to operate Kloro:
  • Google Cloud Platform (hosting, database, file storage)
  • Stripe (payment processing)
  • Resend (transactional email delivery)
  • Expo (mobile push notification delivery)
  These providers process data only as necessary to provide their services to us, under contractual obligations to protect your information.
• Legal requirements: We may disclose your information if required by law, court order, or governmental regulation.

Your data is stored on Google Cloud Platform infrastructure in the United States (us-central1 region). We implement industry-standard security measures including:

• Encryption in transit (TLS/HTTPS for all connections)
• Encryption at rest (Google Cloud SQL managed encryption)
• Bcrypt password hashing with salt
• JWT-based authentication with short-lived access tokens (30 minutes)
• Role-based access control with multi-tenant isolation
• Rate limiting on authentication endpoints
• Automated database backups with point-in-time recovery

Photos are stored in Google Cloud Storage with access controlled by signed URLs. Mobile app authentication tokens are stored in your device's secure keychain (iOS Keychain / Android EncryptedSharedPreferences).

We retain your data for as long as your organization maintains an active Kloro account. Operational data (visits, time entries, invoices) is retained as business records for the duration of the account. If your organization cancels its subscription, we will delete all associated data within 90 days, unless retention is required by law.

Individual user accounts can be deactivated by your organization's administrator at any time. Deactivated accounts cannot access the Service but associated records are retained for business continuity.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data
• Object to or restrict certain processing
• Request data portability

Because Kloro is a business tool provided by your employer, some requests may need to be directed through your organization's administrator. To exercise your rights, contact us at privacy@kloro.ai.

Kloro is a business application not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.