Comprehensive privacy notice

Grower: mobile app, web Console and the machines' local panel.
Version: 2026-09-29 · Versión en español

This is an English translation of the Spanish privacy notice (aviso de privacidad integral). If the two differ, the Spanish version prevails.

Tlachia Systems, S.A. de C.V. ("Tlachia", "we") develops and operates Grower, a platform to monitor and operate fertigation machines. This notice explains what personal data we process when you use the Grower app for iPhone and Android, the web Console, the machine's local panel and this website; why we use it, who we share it with and how you can exercise your rights. We issue it under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette (DOF) on March 20, 2025 (the "Law").

1. Controller and contact

The party responsible for processing your personal data (the controller) is:

Our Personal Data Department handles your requests and questions about this notice:

• Email: contacto@tlachia.org
• In writing, at the address above.

2. Who this notice applies to

This notice applies to people who use Grower (staff or collaborators of the organizations that are our customers, such as growers and agricultural companies) and to visitors of grower.digital.

Grower has no open sign-up: accounts are created by your organization's administrator. Your organization decides who can access its machines, and the operating records of its machines belong to it. If your organization has its own privacy notice for its staff, that notice also applies to what it does with your data.

3. Personal data we process

3.1 Your account data (all products)

• Name, email address and internal user ID.
• The organization you belong to, your role (for example, operator or agronomist) and the machines you can access.
• Your password, which we store only as a cryptographic hash and never in readable form, and your second authentication factor, if you use one.
• Sign-in records: date and time of sign-in, IP address and the application used.

3.2 Mobile app (iPhone and Android)

• The notification token that Apple or Google assigns to your phone, the platform, the app version and the date you were last connected.
• The commands you send to machines and your actions on alarms: what you did, on which machine, when, with what result and from which user.
• Crash reports: error type, technical details, phone model and operating system and app versions. They do not include your name or email address.

On your phone, the app keeps your session in the system's secure storage, your preferences (such as language) and a temporary copy of your machines' information. When you sign out, the stored session is deleted and the notification token is unregistered. The app does not access your location, camera, microphone, photos or contacts, and it does not use advertising identifiers.

3.3 Web Console

• Your account data and the actions you take: inviting users, changing roles, creating or editing recipes, acknowledging alarms and sending commands.
• The interface language, stored in your browser.
• Crash reports, without your name or email address.
• When product analytics is enabled: a pseudonymous identifier (your internal user ID and your organization's), the Console pages you visit, a few usage events (signing in, opening a machine, viewing recipes or alarms and changing an operating parameter), technical browser data (type, operating system and screen size) and the IP address of the connection. Sessions are not recorded and the text you type is not captured.

3.4 The machine's local panel

The machine panel is used with a per-machine PIN shared by the team that operates it, which does not identify a person. The machine stores the PIN only as a cryptographic hash. Commands given from the panel are recorded as made "from the local panel", without a person's name.

3.5 Machine data

Sensor readings, valve and pump status, recipes, alarms, configuration and the location (coordinates) of the site where the machine is installed. This is your organization's operating data. It is personal data only when it can be linked to a person, for example when the grower is an individual or when we record which user gave a command. In that case we protect it like the rest of your data.

3.6 Support

If you write to us, we process your name, your email address and the information you share in order to help you.

3.7 This website (grower.digital)

It uses no cookies, analytics or third-party resources, and we keep no visitor logs. The server uses your IP address only to deliver the page.

4. How we obtain your data

• From your organization's administrator, when they create your account: name, email address, role and machines.
• From you, when you use Grower or contact us.
• From your device, automatically: notification token, IP address at sign-in, technical crash data and, if product analytics is enabled, Console usage data.

5. Purposes

Primary purposes

These are necessary to provide the service your organization contracted, so they do not require your consent (article 9, section IV, of the Law):

1. Create, manage and protect your account, and verify your identity when you sign in.
2. Let you monitor and operate the machines of your organization that you have access to.
3. Send you notifications about alarms, recipes and manual control of those machines.
4. Record in an audit log who gave each command, when and with what result, for security, traceability, incident handling and your organization's audit commitments.
5. Send you service emails: invitation, email verification and password or second-factor setup.
6. Detect, diagnose and fix faults, and protect the service against unauthorized use.
7. Handle your support and ARCO requests.
8. Comply with legal obligations and requests from competent authorities.

Secondary purpose

It is not necessary for the service and you may refuse it:

9. Measure, in pseudonymized form, how Console features are used in order to improve the product, when product analytics is enabled.

If you do not want your data used for this purpose, email us at any time at contacto@tlachia.org with the subject "Refusal of secondary purpose". Refusing does not affect your access to the service. If you do not object, we will understand that you accept it (tacit consent, article 7 of the Law).

We do not use your data for advertising, we do not sell it and we do not build commercial profiles with it.

6. Providers that process data on our behalf

To provide the service we use providers that process data only on our behalf and under our instructions (processors, "personas encargadas", article 2, section XII, of the Law). Sharing data with them is not a transfer (article 2, section XX) and does not require your consent. We require them to keep it confidential and secure.

These external services receive no personal data:

• Open-Meteo and NASA POWER (weather services): they receive only the coordinates of the machine's site to return the forecast and weather, with no names, email addresses or personal identifiers.
• healthchecks.io: it receives signals that our servers and backups are working; it receives no customer or personal data.
• GitHub: machines download their software updates from it; no personal data is sent to it.

7. Transfers

We do not sell or rent your data. We share it with third parties only in these cases, which do not require your consent (article 36 of the Law):

• With your organization. Its administrators can see your name, email address, role, sign-in records (date, time and IP address) and the actions you take on its machines. This is necessary to maintain the legal relationship between you, your organization and us (article 36, sections IV and VII).
• With competent authorities, when required by a law, a treaty, a court order or a duly grounded order, or when necessary to establish, exercise or defend a right in court (article 36, sections I, V and VI).

If we ever want to make a transfer that requires your consent, we will ask you first and update this notice.

8. How to limit the use or disclosure of your data

• Notifications: turn them off in your phone settings or sign out of the app. In the Console you can also revoke registered phones under Settings › Notifications.
• Browser: you can delete or block local storage and cookies (section 13). If you block the sign-in cookies, you will not be able to use the Console.
• Analytics: ask us to exclude you by emailing contacto@tlachia.org.
• Email: we only send service emails; we do not send advertising.
• You can also email us to ask that we limit a specific use. We will reply within the time limits in section 9.

9. ARCO rights

You have the right to:

• Access: know what data we hold about you and how we process it.
• Rectification: correct it if it is inaccurate, incomplete or out of date.
• Cancellation: ask us to delete it from our records and systems.
• Objection: object to processing on legitimate grounds.

How to submit a request

Email contacto@tlachia.org with the subject "ARCO rights", or send a letter to the address in section 1. Under article 28 of the Law, include:

1. Your name and an email or postal address where we can send the reply.
2. A document proving your identity or, if a representative acts for you, their identity and proof of representation.
3. A clear description of the data concerned (not needed for the right of access).
4. The right you are exercising or what you are requesting.
5. Anything that helps us locate your information, such as your account email and your organization's name.

For a rectification, tell us what should change and attach supporting documents.

Time limits and response

• We will send you our decision within 20 business days of receiving your request. If it is granted, we will carry it out within the following 15 business days. Both periods may be extended once by an equal period when circumstances justify it; if so, we will let you know (article 31).
• For access, once your identity is verified we will email your data as an electronic document to your account email or the address you give us (article 32).
• The process is free. We could only charge reproduction or shipping costs if you ask for physical copies (article 34).
• We may deny a request in whole or in part in the cases set out in article 33 of the Law; we will always tell you why.

Some data cannot be cancelled while it is needed to perform the contract with your organization or to meet a legal obligation (article 25). In particular, the command audit log is kept for 5 years: when your account is cancelled those records are blocked, meaning they are kept only to address possible liabilities, and they are deleted when that period ends (articles 2, section III, and 24).

If you disagree with our response, you may file a rights protection request with the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno) within 15 business days of the date we communicate it to you. If we do not respond, you may file it as soon as our deadline to respond expires (article 40).

10. Revoking consent

You may revoke any consent you have given us at any time, through the same channel and with the same requirements as an ARCO request, using the subject "Revocation of consent". Revocation has no retroactive effect (article 7). If you revoke processing that is necessary for the service, we may be unable to keep your account; if so, we will explain this in our reply. We respond within the time limits in section 9.

11. Deleting your account

You can ask us to close your account at any time, directly or through your organization's administrator, by emailing contacto@tlachia.org with the subject "Delete my account". We treat it as a cancellation request (section 9) and resolve it within those time limits. In the meantime, we disable your access as soon as we confirm the request comes from you or your organization. When we handle it:

• We delete your sign-in account, your notification tokens and your per-machine permissions.
• In the records we must keep, such as the audit log, we replace your name and email address with an anonymous value and keep only the internal identifier.
• Encrypted backups rotate automatically; those that still contain your data disappear within 6 months at most.

The steps are also in Support › Delete your account.

12. How long we keep your data

13. Cookies and similar technologies

• This website (grower.digital) uses no cookies or browser storage.
• Web Console:
  • Session cookies of the sign-in service (auth.grower.digital). They are strictly necessary to sign you in and keep your session, and they are deleted when you sign out or when they expire.
  • Browser local storage to remember the interface language and, only while you sign in, a temporary value that protects that process and is deleted when it finishes.
  • When product analytics is enabled, local storage holding the pseudonymous identifier described in section 3.3.
• Mobile app: it uses no tracking cookies or advertising identifiers. To sign in, it opens the sign-in page in the system browser, which uses the same session cookies.

You can delete or block cookies and local storage in your browser settings. If you block the sign-in cookies, you will not be able to use the Console.

14. Security

• All connections are encrypted (HTTPS/TLS), and machines connect to the cloud with their own certificates.
• The database keeps each organization's information separate, so one organization cannot see another's.
• Passwords and PINs are stored only as cryptographic hashes. The audit log is chained to detect tampering.
• Backups are encrypted before they leave our server.
• Only staff who need it have access, under a confidentiality obligation.

If a security breach significantly affects your property or moral rights, we will inform you immediately so you can take action (article 19).

15. Changes to this notice

We will publish any change on this page with a new version date. If the change is significant, such as new purposes, new types of data or transfers that require your consent, we will also let you know in the app, in the Console or by email before it applies.

16. Authority

The authority for the protection of personal data held by private parties in Mexico is the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno).

Version: 2026-09-29