Privacy policy

About this policy

This privacy policy explains how Production AS ("we", "us", "our") collects and uses personal data when you use Planting Matrix, including the website at plantingmatrix.com and the Matrix Planting Planner web and mobile applications (the "Service").

We are committed to processing your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Norwegian data protection law.

Who we are

The data controller is:

If you have any questions about this policy or how we handle your personal data, please contact us at the email address above.

Information we collect

How we use your information

We use your personal data to:

• Create and maintain your account
• Provide the Service and store your content
• Process payments and manage subscriptions
• Sync your data across your devices
• Provide customer support and respond to your messages
• Send transactional emails (billing receipts, account notifications, security alerts)
• Match plants and design suggestions to your local climate and hardiness zone
• Show measurements and content in units appropriate to your region
• Personalize your experience and content recommendations based on your activity and preferences
• Monitor the Service for bugs, errors, and performance issues
• Send marketing emails, if you've opted in
• Improve the Service through product analytics
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

Legal bases for processing

We rely on the following legal bases under GDPR Article 6:

• Contract (Art. 6(1)(b)) - to create your account, store your content, process payments, and provide the Service you've signed up for.
• Consent (Art. 6(1)(a)) - for non-essential cookies on the marketing website, session recording and heatmaps inside the Service, and marketing emails.
• Legitimate interests (Art. 6(1)(f)) - for product analytics inside the logged-in Service, system monitoring and error correction, security monitoring, fraud prevention, in-app personalization, and improving the Service. You can opt out of product analytics at any time from your account settings, and you have the right to object to any other processing based on legitimate interests.
• Legal obligation (Art. 6(1)(c)) - to keep accounting records, respond to lawful requests from authorities, and keep a record of your cookie-banner choices to demonstrate consent under Art. 7(1). This record is kept even when you reject, and does not itself depend on your consent.

Sharing your information

We don't sell your personal data. We share it only with the processors and partners that help us run the Service:

Each of these providers acts as a data processor and is bound by a data processing agreement that requires them to handle your data in line with GDPR.

We may also share data in connection with a business transfer (such as a merger, acquisition, or sale of assets), and as described in the "Disclosures to authorities" section below.

Disclosures to authorities

We disclose personal data to authorities only when required by valid legal process – for example, a court order, a properly issued warrant, or a binding statutory request from Datatilsynet, Skatteetaten, or the police. We assess each request against Norwegian and EU law and push back on requests we consider overbroad, improperly served, or otherwise without legal basis.

Where the law allows it, we will notify the affected user before complying so they can challenge the request themselves. Many criminal investigations come with a confidentiality obligation that prevents this – in those cases we comply with the gag order until it lifts, and notify you afterwards where we can.

International data transfers

Some of our processors are based outside the European Economic Area, primarily in the United States and the United Kingdom. Where personal data is transferred outside the EEA, we rely on:

• The EU-US Data Privacy Framework, where the recipient is certified
• Standard Contractual Clauses (SCCs) approved by the European Commission
• The UK's adequacy decision, for transfers to the United Kingdom

You can request more information about the safeguards in place by contacting us.

Personalization and profiling

To make the Service more useful, we may analyze your activity – for example, the plants you save, the beds you design, your hardiness zone, and how you interact with features – to:

• Suggest plants and design ideas that suit your conditions and interests
• Tailor the content, tips, and prompts you see in the app
• Group users into segments for relevant marketing communications, if you've opted in

Under GDPR this is considered profiling. We rely on legitimate interests for in-app personalization and on consent for profiling tied to marketing. You can object to profiling based on legitimate interests, or withdraw your consent for marketing profiling, at any time by contacting us at privacy@plantingmatrix.com or adjusting your account settings.

AI features

The Service does not currently use AI to process the content you create (such as your beds, plant lists, or notes). If we add AI-powered features in the future - for example, plant suggestions or design assistance that send your content to a third-party AI provider - we will:

• Update this policy and disclose the provider before launching the feature
• Ask for your consent before any of your content is shared with a third-party AI provider

Cookies and tracking

We use cookies and similar technologies for:

• Essential cookies - authentication, session management, and security. These cannot be disabled because the Service won't function without them.
• Analytics cookies on the marketing website - PostHog product analytics on plantingmatrix.com before sign-in. We ask for consent via our cookie banner.
• Product analytics inside the Service - PostHog event tracking after sign-in, under our legitimate interest. You can opt out from your account settings.
• Session recording and heatmaps – only activated after your explicit, separate opt-in. Off by default.
• Marketing and advertising cookies – campaign attribution and ad measurement on the marketing website. We ask for consent.

You can manage non-essential cookies on the marketing website from the cookie settings link in our footer, and your in-app analytics and session recording preferences from your account settings. You can also use your browser's cookie controls to block or delete cookies for plantingmatrix.com.

Keeping a record of your choice. When you accept, reject, dismiss, or customise the cookie banner, we log that interaction together with a random session identifier, your browser's user-agent string, a timestamp, and – if you're signed in – your account ID. We keep this essential record to evidence that we obtained (or did not obtain) your consent, as required by data-protection law. It is created regardless of your choice – including when you reject – because it is how we demonstrate that we honoured your decision. It is not analytics and is not shared with third parties.

Marketing communications

We'll only send you marketing emails if you opt in during sign-up or later in your account settings. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time from your account settings or by contacting us.

Withdrawing marketing consent doesn't affect transactional emails, which we need to send to provide the Service (e.g. billing receipts, security notifications).

Featuring user content

By default, the content you create in the Service is private to your account. If we'd like to feature user-created content (such as bed designs or photos) in our marketing materials, we'll ask for your permission first, and you can withdraw that permission at any time. If you withdraw permission, we'll stop using the content going forward, but we may not be able to recall materials already published.

How long we keep your data

You can delete your account at any time from your account settings, which will trigger deletion of your content within 30 days, except where we're required by law to retain certain records (such as billing).

Your rights

Under GDPR you have the right to:

• Access - request a copy of the personal data we hold about you
• Rectification – ask us to correct inaccurate data
• Erasure – ask us to delete your data ("right to be forgotten")
• Restriction – ask us to limit how we use your data
• Portability – receive your data in a structured, machine-readable format
• Object - object to processing based on legitimate interests, including direct marketing
• Withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact us at privacy@plantingmatrix.com. We'll respond within 30 days.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or with the supervisory authority in your country of residence.

Children

The Service is not intended for users under 16. We don't knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at privacy@plantingmatrix.com and we'll take the appropriate steps.

Security

We take security seriously and use industry-standard measures to protect your data:

• Encryption in transit (TLS) for all connections
• Encryption at rest where supported by our infrastructure providers
• Access controls and the principle of least privilege for our team
• Due diligence and data processing agreements with all our processors
• Regular review of our security practices

No system is perfectly secure, and we can't guarantee absolute security. If we become aware of a personal data breach that's likely to result in a risk to your rights, we'll notify you and Datatilsynet as required by GDPR.

Changes to this policy

We may update this policy from time to time. When we make material changes, we'll notify you by email and/or by an in-app notice before the changes take effect. The "Last updated" date at the top of this policy will always reflect the most recent version.

Contact us

For any questions, requests, or complaints about this policy or our handling of your personal data: