Last updated: 23 September 2026
1. Who We Are
Where's The Farmer ("we", "us", "our") is a platform that connects customers with local farmers, butchers, and fresh produce sellers. The app is operated from Ireland and we aim to comply with applicable EU and Irish data protection law, including the GDPR. Where's The Farmer is the controller for personal data processed to provide the app. For privacy questions, contact us at team@wheresthefarmer.com.
2. What Data We Collect
- Account information — your name and email address, provided when you create an account.
- Profile information — if you register as a farmer, your farm name, description, location (latitude/longitude), operating hours, product categories, certifications, and social links.
- Posts and listings — product images, descriptions, prices, and tags you submit.
- Shop, delivery, and communication data — catalogue items, delivery requests, dates, quantities, addresses or Eircodes, map pins, notes, chat messages, and delivery status information.
- Reviews and favourites — reviews you submit and farmers or posts you save.
- Location data — approximate location used to show nearby farmers and posts in your feed, and place names, addresses or postal codes you type into location search. Saved farm or market locations are stored when you choose to save them.
- Payment and subscription information — if you buy a Posting or Full farmer plan, or a boost, Stripe processes the payment. We store identifiers and subscription or payment status needed to provide the feature; we do not store your card details.
- Marketing preference and consent audit data — whether you opted in to marketing, and records of consent or withdrawal and their timestamps.
- Authentication and technical data — password hashes where applicable, secure sessions, verification or password-reset records, request timestamps, route paths, and error or security logs.
- Device and preference data — your privacy choice, optional display and unit preferences, PWA cache data, and a push endpoint and encryption keys if you enable Web Push.
3. How We Use Your Data
- To provide and operate the app and its features.
- To show your farm profile and posts to other users.
- To connect customers and farmers through delivery requests, chat, reviews, and delivery updates.
- To process subscription payments via Stripe.
- To send transactional or service emails needed to operate your account, such as verification, password reset, account, delivery, and subscription communications.
- To send occasional news, offers, and updates only where you have separately opted in to marketing emails.
- To resolve support requests — we may look up your email to identify your account.
- To prevent fraud, enforce our terms, protect the app, and meet legal obligations.
- To provide optional maps, remembered preferences, offline PWA support, and Web Push only where you have enabled the relevant functional service and, for notifications, granted browser permission.
- To return matching places when you type into location search; searches are sent after a short pause even if you have not turned on the map.
We do not sell your data to third parties. We do not use your data for advertising.
4. Legal Basis (GDPR)
We process your data on the basis of:
- Contract — to deliver the service you signed up for.
- Legitimate interests — to operate, secure, and improve the platform.
- Legal obligation — where required by law (e.g. financial records).
- Consent — for optional marketing emails and optional device technologies. Marketing consent is separate from creating or using an account and can be withdrawn below. Functional technology choices can be changed in Privacy Settings.
5. Data Sharing
- Other users — public farmer profiles, listings, reviews, and selected location information are visible as described in the app. Delivery requests and chat content are shared with their intended participants.
- Stripe — payment processor for farmer plans and boosts. Subject to Stripe's own privacy policy.
- Google Cloud Storage / Replit App Storage — used to store uploaded images and documents.
- Resend — processes email addresses and message content to send our transactional emails and, where you have opted in, marketing emails.
- OpenFreeMap — provides optional map tiles and receives technical request information, including IP address and requested tile coordinates, only when functional services are allowed and a map is displayed. OpenFreeMap may use Cloudflare to deliver map resources.
- Google Maps Platform (Geocoding) — when you type a place name, address or postal code into location search, our server sends the search text to Google to return matching places worldwide. This search is separate from the optional OpenFreeMap map and can be used while the map is off. Google receives the request from our server, not a direct map-tile request from your browser.
- Google Maps links — if you choose to open a directions or location link, you leave our app for Google Maps, which processes your visit under its own policies.
- Browser push services — Apple, Google, Mozilla, Microsoft, or another browser vendor may process a push endpoint and delivery metadata when you enable notifications.
- Service providers and authorities — where necessary to host, secure, maintain, or legally operate the app, or where disclosure is required by law.
We require service providers to protect personal data and use it only for the services they provide. International transfers, where applicable, are handled using a lawful transfer mechanism, which may include an adequacy decision or the European Commission's Standard Contractual Clauses. Contact us for information about the safeguards relevant to a particular provider.
6. Data Retention
We retain your account data for as long as your account is active. We retain consent and withdrawal audit records for as long as needed to demonstrate and manage your marketing preference, and where required by law. Public listings, reviews, messages, delivery records, and payment records may be retained for as long as needed to provide the service, resolve disputes, prevent abuse, or comply with legal and financial obligations. If you delete your account, we will delete or anonymise personal data within 30 days where practicable, except where retention is required by law or needed to establish, exercise, or defend legal claims. Push subscriptions are retained until disabled, unsubscribed, or reported invalid. Optional device preferences and caches remain until you withdraw the choice, clear site data, or a cache update replaces them. Security and request logs are retained only for the period reasonably needed to investigate incidents and protect the service.
7. Your Rights (GDPR)
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your data ("right to be forgotten").
- Object to or restrict processing.
- Data portability.
- Withdraw consent where processing is based on consent.
- Complain to the Data Protection Commission (Ireland): www.dataprotection.ie
When signed in, you can download a portable JSON copy of your app data here or request account deletion from the Account section of Profile. Before deletion, any active subscriptions must be managed first. You can also withdraw marketing consent below at any time; this does not stop transactional or service emails needed for your account. You can withdraw functional-technology consent through Privacy Settings in the legal links. This removes optional local preferences, PWA registrations and caches, and attempts to remove the current Web Push subscription.
To exercise any right, contact us at the email below.
8. Delivery diary data
Delivery diary entries are stored in our PostgreSQL database. They are available to the farmer account that created them and to authorised personnel where needed for support, security, legal compliance, or operation of the service.
9. Cookies, Device Storage, Maps and Push
We use a strictly necessary session cookie for sign-in and a necessary preference record to remember your privacy choice. Optional functional services—including persistent display and unit preferences, PWA caching, OpenFreeMap tiles, and Web Push—remain off until allowed. Location search is separate: if you type a place query, it is sent through our server to Google even when optional map features are off. Notifications also require separate browser permission. We do not use advertising cookies, cross-site tracking, tracking pixels, or third-party analytics. See the Cookies Policy for the full storage inventory and withdrawal controls.
10. Children
This app is not intended for users under the age of 16. We do not knowingly collect data from children.