Privacy Policy

What we collect

• Account — your email and authentication, handled by our processor Supabase.
• Profile — what you choose to add (name or nickname, country, interests, public identity preference).
• Contributions — the facts, sources, proposals, articles, replies and votes you submit. These are public by design — they build a shared, sourced knowledge graph.
• Billing — if you subscribe to Hemp'in PRO, a record of your plan, subscription status and renewal date, plus the customer and subscription identifiers from our payment processor. We never receive or store your card number — see Payments below.
• Usage analytics — first-party product events (page views, clicks) tied to an anonymous id, so we can improve the product. No third-party analytics, no advertising profiles.

Why we use it (legal basis)

• To provide the service you signed up for, including processing your subscription (performance of a contract).
• To secure and improve the platform (legitimate interest).
• To meet legal and accounting obligations (for example, keeping invoice records).
• Where required, on the basis of your consent, which you can withdraw.

Payments

When you subscribe to Hemp'in PRO, your payment is processed by Stripe, our payment processor. You enter your card details on Stripe's secure, hosted checkout — they never pass through, and are never stored on, Hemp'in's systems.

To take the payment, Stripe receives the information you give it (your name, email, billing country and card details) and acts as an independent controller of that data under its own terms. Stripe returns to us only what we need to run your subscription: your plan, its status, the renewal date, and non-sensitive customer and subscription identifiers. We use these to grant and manage your PRO access. See Stripe's Privacy Policy for how they handle your data.

Who we share it with (processors)

We don't sell your data or share it with advertisers. We rely on a small set of vetted processors, each acting on our instructions:

• Supabase — database and authentication, on EU-region infrastructure.
• Stripe — subscription payments (see Payments above).
• Resend — transactional email (for example, sign-in and billing notifications).

Some processors, such as Stripe, may process data outside the EU. Where they do, that transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Where it lives

Your account and contribution data is stored with Supabase on EU-region infrastructure, in line with our EU-sovereign data posture. Your login session is kept in your browser's local storage on your own device — see Cookies & Storage.

Your rights (GDPR)

You can access, correct, export, delete, or object to the processing of your personal data, and withdraw consent at any time. To exercise any of these, reach us via the contact option in the app. We don't sell personal data or share it with advertisers.

Deletion is self-service and needs no request: how to delete your account sets out the steps, the 30-day grace period, and exactly what is erased and what is kept.

Retention, age, changes

We keep personal data only as long as your account is active or as needed to provide the service and meet legal obligations; billing and invoice records are kept for the period required by tax and accounting law, and public contributions may persist as part of the knowledge record (you can request correction or takedown). The platform is intended for users aged 16+. We'll post material changes here with a new date above.