Privacy Policy

Vercro is run by Vercro Ltd, a company registered in England and Wales (company number 17113010), registered office 124 City Road, London, EC1V 2NX. We are the controller of the personal data described in this policy, which means we decide how and why it is used. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC113623.

For anything about your data, email hello@vercro.com or write to us at the address above. We have not appointed a data protection officer because the law does not require one for a business of our size and type; privacy questions go straight to the people who run Vercro.

• Website visitors to vercro.com, including people who never sign up.
• Gardeners with a Vercro account, on Free or Pro, whether you use app.vercro.com or our iPhone or Android app.
• People who contact us, for example by email or through in-app feedback.

Apple, Google, Stripe and the sign-in providers you choose (Google or Apple) also have their own privacy policies for the parts they are responsible for, such as taking payment in their stores.

We do not ask for your date of birth, and we never use your device's GPS location. Please don't put sensitive information about yourself or anyone else (for example health details) in notes, photos or Ask Vercro questions: Vercro does not need it.

UK data protection law says we need a lawful basis for each use of personal data. The ones we rely on are: contract (we need it to provide Vercro to you), legitimate interests (a genuine reason that does not override your rights; you can object), legal obligation and consent (you can withdraw it at any time, as easily as you gave it).

Legitimate interests and your right to object. Where we rely on legitimate interests, we have weighed our reason against your interests and rights. You can object at any time by emailing us, and we will stop unless we have a compelling reason (for example security). You can always stop optional emails.

Agreeing to our Terms is not consent. Creating an account means you accept our Terms of Use, which lets us provide the service. It does not mean you have agreed to analytics or marketing cookies, optional emails or anything else that needs your separate permission.

Our AI provider is Anthropic (Anthropic, PBC in the United States, with Anthropic Ireland Ltd as its contracting company for the UK). Anthropic acts for us as a processor. Under its commercial terms it does not use what we send to train its models, and it keeps what we send only for a limited period (at the time of writing, up to 30 days, or up to 2 years where a request is flagged under its usage policy) before deleting it. See section 12 for how that transfer is protected.

For Ask Vercro only, our backup AI provider is OpenAI (OpenAI OpCo, LLC in the United States). If Anthropic is unavailable when you ask a question, the same information is sent to OpenAI instead, so that you still get an answer. OpenAI acts for us as a processor. Under its API terms it does not use what we send to train its models, and it keeps what we send only for a limited period (at the time of writing, up to 30 days, or longer where the law requires it or where needed to prevent harm) before deleting it. Plant Check, Fast Start, scanning and written explanations do not use OpenAI. See section 12 for how that transfer is protected.

Fast Start is optional. Before it reads anything, we ask your permission to share what you give it with Anthropic. Photos are resized on your device first, which removes hidden details such as where they were taken. Nothing is added to your garden until you have checked it and pressed Add to my garden; what you add then becomes ordinary garden records, and earlier seasons are kept as garden history marked as imported. Choosing to set it up yourself deletes your files straight away. Beds and crops you add can be changed or deleted like any others; to remove imported history, email us. Deleting your account deletes your Fast Start files and drafts along with the rest of your garden.

AI answers are produced automatically and are not checked by a person before you see them. They can be wrong, especially about identifying plants, pests and diseases. Never eat a plant or fungus, or use a treatment, based only on an answer from Vercro. Our Terms of Use say more.

We do not use your photos or Ask Vercro conversations to train AI models, we do not use your Ask Vercro conversations to improve our products, and we do not share either with anyone other than the service providers named in this policy. Please don't include personal details, such as health information, in questions, notes or place names. We use only Anthropic for these features, and OpenAI only as the backup for Ask Vercro described above. If we ever add or change an AI provider, we will update this policy before any of your data is sent to it.

• Photos are stored in private storage with our database provider, Supabase, in London. They are not public and other gardeners cannot see them.
• When you add most photos in the app, we make a resized copy on your device first, which removes hidden details such as the location where the photo was taken. One older screen for adding a harvest photo does not yet remove them, so check your phone's camera location setting if that matters to you.
• Only Plant Check photos, photos you add to an Ask Vercro question, photos and files you give Fast Start, and packet or label scans are sent to Anthropic (or, for an Ask Vercro question, to OpenAI as the backup). Diary, bed, harvest and profile photos are not.
• Share cards you create are made on your device and only shared where you choose to share them.
• Please avoid photographing people, especially children, or anything that shows where you live.
• You can delete a photo in the app, and all your photos are deleted when you delete your account.

• For UK postcodes we look up approximate coordinates with postcodes.io. For other countries we use OpenStreetMap Nominatim, sending the postcode and country.
• We work out your typical frost dates ourselves, from Met Office records Vercro holds, using the first half of your postcode; this does not leave Vercro. We send coordinates (or the first half of your postcode) to OpenWeather for forecasts.
• None of these services receives your name, email or account details from us.

When you first visit vercro.com or app.vercro.com you can accept or reject analytics and marketing cookies, or choose each one. Your choice is stored in a cookie called vercro_consent and applies to both. You can change it at any time with Cookie settings, and turning something off takes effect straight away. Our Cookie Policy lists every cookie.

• Essential: sign-in, security and remembering your cookie choice. Always on.
• Cookieless statistics: Vercel Web Analytics counts page visits without storing anything on your device. It stops if you reject analytics.
• Analytics (your choice): PostHog, hosted in the EU, records pages viewed and clicks with a random identifier, so we can see what helps people get started. If you are signed in to the web app, events are linked to your account id, not your email. Session recording is not used. We remove sign-in codes and similar details from page addresses before anything is sent.
• Marketing (your choice, website only): Google Analytics and the Meta Pixel measure which adverts and campaigns bring people to Vercro. For the Meta Pixel, Meta Platforms, Inc. and Vercro are joint controllers for collecting and sending that data to Meta; after that, Meta is responsible for its own use. Google is responsible for its own use of data under its own settings.

In our iPhone and Android apps, version 2.1 and later ask for your choice first, the same as the web app. In version 2.0.2 and earlier, PostHog analytics runs while you use the app, without a separate choice; update the app to choose, or email us and we will delete the analytics linked to your account.

Our service providers (processors) may only use your data to provide their service to us, under written terms. The table lists them all.

We don't sell your personal data, and we don't share it with advertisers or data brokers. The only data we would ever share outside the list above is genuinely anonymous statistics, as set out in section 13.

Where personal data leaves the UK, it is protected in one of these ways:

• EU and EEA countries, and Switzerland: the UK government has decided they protect personal data adequately (Nominatim, Open Food Facts, and EU hosting for PostHog, Sentry and Resend).
• United States companies certified to the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"): Vercel, PostHog, Stripe, Resend, OneSignal, Sentry and Google.
• Other United States companies: the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, in the provider's data processing terms (Anthropic, OpenAI, RevenueCat, Meta, and Supabase for any support access from outside the UK).

You can ask us for more information about these protections, or a copy of the relevant terms.

Inside Vercro. We analyse garden records across Vercro to improve our advice, for example how sowing dates relate to local frost, or which suggestions help crops do well. We do this with pseudonymised data and limit who can see it.

Sharing with others. We do not currently share insights from gardeners' data with any other organisation. In future we may want to publish, or share with organisations such as horticultural charities, universities, seed suppliers or weather researchers, statistics describing many gardens together, for example the share of UK allotments that sowed garlic in October. If we do:

• It will only ever be genuinely anonymous, aggregated statistics: grouped by large regions (for example a UK nation or region) and by month or season, and never a figure based on fewer than 10 gardens, with further checks so no one can be singled out by combining figures.
• It will never include names, contact details, postcodes, exact locations, notes, photos or Ask Vercro conversations.
• It will never be data that identifies you or your garden, even without your name.
• We will update this policy and tell you before we start, and you will be able to object to your garden being included.

Anything beyond that, such as sharing records about individual gardens even without names, would only happen if you separately chose to take part. You can object to your data being used for statistics at any time by emailing us.

Our planning engine automatically decides which tasks and advice to show you, based on your garden, dates, weather and what you have done. Your plan (Free or Pro) and monthly usage decide which features are available. None of this has a legal or similarly significant effect on you. If you think something about your account is wrong, for example a limit or a subscription status, email us and a person will look at it.

• Data travels between you and Vercro encrypted (HTTPS).
• Our database controls access row by row, so each gardener can only reach their own records. Photos are in private storage and shown through short-lived links.
• Staff access is limited to what is needed, and administrative access to accounts is logged.
• We remove sign-in codes from page addresses before analytics runs, and error reports exclude your name and email.
• If you use a shared device, sign out when you finish.

If we have a data breach that is likely to put your rights at risk, we will tell the ICO within 72 hours of becoming aware of it, and tell you without undue delay if the risk is high. To report a security problem, email hello@vercro.com.

We reply within one month. For complex or multiple requests we may extend that by up to two more months and will tell you why. We may need to confirm it is you before we act, and the clock starts once we have what we need. Using your rights is free unless a request is clearly unfounded or excessive. We search for your data in a reasonable and proportionate way.

To complain about how we use your data, email hello@vercro.com with "Data protection complaint" in the subject, or write to Vercro Ltd, 124 City Road, London, EC1V 2NX. Tell us what happened and what you would like us to do. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113. You do not have to complain to us first, but we would appreciate the chance to help.

Vercro is a gardening tool for adults and families and is not designed for children. You must be 13 or over to create an account, and 18 or over to buy a subscription. If you believe a child under 13 has an account, email us and we will delete it.

We will update this policy when what we do changes. If a change is important, for example a new use of your data, a new type of provider or anything described in section 13, we will tell you by email or in the app before it takes effect, and ask for your permission where that is needed. The version number and date at the top change every time. We keep every earlier version; ask us for a copy. The previous version was dated 19 September 2026 (version 2.4).