Privacy Policy — Livio Dairy Manager

1. Data Controller

The controller of your personal data is:

Gabinet Weterynaryjny AMICUS
pl. Jana Pawła II 13, 18-420 Jedwabne, Poland
Email: gabinet.amicus@gmail.com

For any data protection inquiries, please contact us at the email address above.

2. Scope

This Privacy Policy applies to the Livio — Dairy Manager mobile application (the "App") available on Google Play, associated backend services (data synchronization, purchase validation, AI assistant), and the website app.livio.farm.

We comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) and, where applicable, the California Consumer Privacy Act (CCPA/CPRA).

3. Data We Collect

3.1. Account Data (Registration & Login)

Data	Purpose	Legal Basis	Status
Email address	Account creation, login, communication	Art. 6(1)(b) GDPR (performance of contract)	Required
Name / display name	UI personalization, team identification	Art. 6(1)(b) GDPR	Optional
Profile photo (URL)	Avatar display (from Google account)	Art. 6(1)(a) GDPR (consent)	Optional
Password (BCrypt hash)	Offline authentication	Art. 6(1)(b) GDPR	Required

Login is available via email/password or Google Sign-In (Credential Manager). When using Google Sign-In, we only retrieve your email, name, and profile photo from your Google account.

3.2. Farm & Animal Data

Data	Purpose	Legal Basis
Farm name, address, GPS coordinates	Farm identification, geolocation (optional)	Art. 6(1)(b) GDPR
Animal records (ear tag number, breed, sex, birth date, health, reproduction, nutrition data)	Herd management — the App's primary purpose	Art. 6(1)(b) GDPR
Prophylactic data (vaccinations, treatment programs)	Herd health tracking	Art. 6(1)(b) GDPR
Nutritional data (rations, ingredients, feed analyses)	Feeding optimization	Art. 6(1)(b) GDPR

Note: Farm animal data does not constitute personal data under GDPR. We process it as part of the service in accordance with our Terms of Service.

3.3. Device Data & Identifiers

Data	Purpose	Legal Basis
Device identifier (Device ID)	Audit trail, synchronization, purchase validation	Art. 6(1)(f) GDPR (legitimate interest)
Device model, Android version	Crash diagnostics (Crashlytics)	Art. 6(1)(a) GDPR (consent)

3.4. Location

The App may request access to your device's GPS location solely to:

Auto-fill your farm's address (reverse geocoding)
Save the farm's GPS coordinates

Location is obtained as a one-time, user-initiated action — the App does not track your location in the background. You may deny permission without losing other features.

3.5. Camera

The App uses the camera solely for:

Feed label scanning — OCR (text recognition) using Google ML Kit Text Recognition. Processing occurs entirely on-device — images are not sent to any server.

3.6. Purchase Data (Google Play Billing)

Data	Purpose	Legal Basis
Purchase token	Server-side subscription verification	Art. 6(1)(b) GDPR
Product identifier, subscription status	Managing access to premium features	Art. 6(1)(b) GDPR

We do not have access to your credit card number or banking details — payments are handled exclusively by Google Play.

3.7. Analytics & Diagnostics

Service	Data	Purpose	Consent
Firebase Analytics	Usage events (no PII), screens, session duration	UX improvement, feature usage analysis	Optional
Firebase Crashlytics	Crash reports, stack traces, device model	Bug fixing, app stability	Optional

During the initial onboarding, we ask for your consent for analytics and diagnostics. You may decline — the App will work fully without these services.

3.8. AI Assistant

The App offers an AI assistant feature. When you use it:

Your question and anonymized farm context data (herd statistics, no personal data) are sent to a proxy server (Supabase Edge Function).
The proxy server forwards the query to OpenAI (GPT) to generate a response.
We do not store AI conversation history on the server — it is stored only locally on your device.

Using the AI assistant requires separate consent during onboarding.

4. Data Storage & Synchronization

4.1. Local Data

All App data is stored locally on your device in an encrypted database (SQLCipher — AES-256). The App works fully offline.

4.2. Cloud Synchronization

If you have an account and an active subscription, data may be synchronized with our cloud server:

Provider: Supabase (EU servers — AWS eu-central-1, Frankfurt)
Scope: Farm, animal, event, and task data — encrypted in transit (TLS 1.3)
Purpose: Backup, multi-device access, team collaboration

4.3. Security Measures

Local database encryption: SQLCipher (AES-256)
Data in transit: TLS 1.3
Authentication tokens: EncryptedSharedPreferences (Android Keystore)
Passwords: BCrypt (hashed, never stored in plain text)
Biometrics: Optional biometric unlock

5. Who We Share Data With

We do not sell your personal data. Data may be shared only with the following categories of recipients:

Recipient	Purpose	Location
Supabase Inc. (sub-processor)	Database hosting, authentication, Edge Functions	EU (Frankfurt, AWS eu-central-1)
Google LLC (Firebase)	Analytics, crash diagnostics, push notifications	USA (Standard Contractual Clauses)
Google LLC (Play Billing)	Payment processing, subscription validation	USA (SCC)
OpenAI Inc.	AI query processing (anonymized)	USA (SCC)

Data transfers to the USA are based on Standard Contractual Clauses (SCC) approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework.

6. Data Retention Period

Category	Period
Account data	Until account deletion by the user
Farm & animal data (cloud)	Until account deletion or 30 days after subscription ends
Local data (device)	Until App uninstallation or manual data reset
Audit logs	12 months
Purchase logs	Per tax requirements (5 years)
Crash reports (Crashlytics)	90 days (Firebase policy)

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

Access — the right to obtain information about processed data (Art. 15)
Rectification — the right to correct inaccurate data (Art. 16)
Erasure ("right to be forgotten") — the right to request deletion of your data (Art. 17)
Restriction — the right to request restriction of processing (Art. 18)
Data portability — the right to receive your data in a machine-readable format (Art. 20). The App supports CSV data export.
Objection — the right to object to processing based on legitimate interest (Art. 21)
Withdraw consent — at any time, without affecting the lawfulness of prior processing (Art. 7(3))

To exercise any of these rights, write to: gabinet.amicus@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority:

President of the Personal Data Protection Office (UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
https://uodo.gov.pl

8. Information for California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know — you have the right to know what categories of personal information we collect and for what purpose.
Right to Delete — you have the right to request deletion of your personal information.
Right to Opt-Out of Sale — we do not sell your personal information to third parties.
Right to Non-Discrimination — we will not discriminate against you for exercising your rights.
Right to Correct — you have the right to correct inaccurate personal information.
Right to Limit — you have the right to limit the use of sensitive personal information.

To exercise these rights, contact: gabinet.amicus@gmail.com. We will respond within 45 days.

Categories of Personal Information Collected (CCPA)

CCPA Category	Examples	Sold
Identifiers	Email, Device ID	NO
Commercial information	Subscription purchase history	NO
Geolocation data	Farm GPS coordinates (one-time)	NO
Internet activity data	Analytics events (anonymized)	NO
Professional information	Farm operation data	NO

9. Children's Data

The App is not intended for persons under the age of 16. We do not knowingly collect personal data from children. If you learn that a child has provided us with their data, please contact us — we will delete it promptly.

10. Push Notifications

The App may send local notifications regarding:

Upcoming pregnancy checks
Scheduled calvings
Dry-off dates
Tasks and reminders

Push notifications require separate Android system permission. You can disable them in system settings at any time.

11. Cookies & Tracking Technologies

The mobile App does not use cookies. Firebase services may use Instance IDs for analytics purposes — only with your consent given during onboarding.

12. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy. We will notify you of material changes by:

In-App notification
Updating the date at the top of this document

Continued use of the App after changes constitutes acceptance of the updated policy.

13. Contact

For questions regarding this Privacy Policy or data processing, contact us:

Gabinet Weterynaryjny AMICUS
pl. Jana Pawła II 13, 18-420 Jedwabne, Poland
Email: gabinet.amicus@gmail.com