Privacy Policy

Your privacy matters to STEM Minds Corp. (“STEM Minds”, “we”, “our”, “us”). This Privacy Policy (“Policy”) explains how we collect, use, disclose, and protect personal information in connection with the Crop Help website and application at crophelp.ai and app.crophelp.ai and related products and services (the “Services”). We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy law; for school-board deployments, we also follow the privacy expectations of the ECNO Student Digital Privacy Standard. If you do not agree with this Policy, please do not use the Services.

How This Policy Is Organized

How your information is handled depends on how you use Crop Help. Shared rules apply to everyone (Sections 2–7 and 10–11). Section 8 adds protections for use through a school or school board. Section 9 covers U.S. children’s privacy for individual consumer users. We use these terms throughout:

• Individual user — someone who creates their own Crop Help account (for example, a home gardener or farmer).
• Student / educator — someone who uses Crop Help through a school or school board.
• School board (custodian) — the board that licenses Crop Help and controls student personal information under applicable law.
• Service provider — our role when we process student personal information on a board’s behalf and instructions.

1. Who We Are and Who Is Responsible for Your Information

For individual users, STEM Minds is the organization responsible for personal information under PIPEDA. For school-board deployments, the school board is the custodian of student personal information and STEM Minds acts as a service provider, processing that information only on the board’s instructions and only to deliver the Services under the board’s written agreement.

2. Information We Collect

2.1 Information you provide

• Account information: name, email address, and password. For paid plans, billing information is collected by our payment processor. In classroom use, no student names or personal profiles are required (see Section 8).
• Crop and plant photos you upload for AI diagnosis, and any notes or questions you add.
• Garden and diagnosis records you create in the Services.

2.2 Information collected automatically

• Technical and usage data: device, operating system, browser, IP address, and interactions with the Services, used for security, troubleshooting, and operation.
• Location data: approximate location for location-based insights, only if you enable it. Location is off by default for student accounts and is never required for core diagnosis features.
• Cookies: essential cookies to keep you signed in and remember preferences; see our Cookies Policy.

You agree that information you provide is true and complete, and will let us know if it changes.

3. How and Why We Use Information

Under PIPEDA we identify our purposes and limit collection and use to what those purposes require. We use personal information to:

• provide the Services — analyze uploaded photos, generate diagnoses and treatment recommendations, and maintain your garden and diagnosis history;
• create and secure your account and authenticate you;
• respond to support requests and send service-related communications;
• maintain the safety, security, and reliability of the Services; and
• comply with law and enforce our terms.

Consent and authority. For individual users we rely on your consent, which you may withdraw at any time (subject to legal or contractual limits) by contacting us or closing your account; withdrawal may prevent us from providing some Services. For school-board deployments, the school board provides the authority and, where required, the consent for students to use the Services (see Section 8).

4. How the AI Diagnosis Works and What Happens to Your Photos

When you upload a photo, it is processed by an artificial-intelligence models to identify the crop and any likely issue and to generate recommendations. To do this, the photo and related prompt are sent to our AI processer: Microsoft Azure AI Foundry.

No training on student data. We do not use student personal information or student-submitted content — in identifiable, de-identified, or aggregated form — to train, fine-tune, or improve AI or machine-learning models, and we contractually require our AI provider not to retain or train on this data. For individual users, uploaded content is used to deliver your results and is not used to train third-party public models.

5. When We Share Information

We do not sell personal information and do not share it for advertising or cross-context behavioural advertising. We share personal information only with service providers who help us operate the Services, under contracts limiting their use to providing services to us:

We maintain a current list of sub-processors that handle student data and notify boards of material changes. We may also disclose personal information to professional advisors, to complete transactions you authorize, to comply with law or legal process, to protect rights and safety, or in connection with a business transaction (subject to continued protection) — in each case consistent with applicable privacy law.

6. Where Your Information Is Stored

Student data — Canadian residency. For school-board deployments, student personal information is stored and processed in Canada. We will not transfer student personal information outside Canada without the board’s written authorization.

Individual users. Personal information of individual users may be processed by our providers in Canada. Where information is processed outside your province or country, it is subject to the laws of that jurisdiction; we apply the protections in this Policy and require comparable protection by contract.

7. Retention, Security, and Breach Notification

Retention. We keep personal information only as long as needed for the purposes above or as required by law. Indicatively, account information is retained while your account is active and for 90 days after closure; uploaded photos and diagnosis history are retained as long as your account is active unless you delete them sooner. We may keep de-identified or aggregated information to operate and secure the Services (subject to the student-data limits in Section 4).

Security. We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, and logging. No method of transmission or storage is completely secure, but we work to protect your information and respond quickly to incidents.

Breach notification. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the appropriate authorities as required by law. For school-board deployments, we will notify the school board without undue delay and within 72 hours of confirming a breach affecting student personal information.

8. If You Use Crop Help Through a School

This Section governs use by students and educators through a school or school board and reflects the ECNO Student Digital Privacy Standard. It adds to — and, where different, prevails over — the general rules above for student personal information.

8.1 The board is the custodian; we are the service provider

When a school board licenses Crop Help, the board is the custodian of student personal information under applicable Ontario legislation, and STEM Minds acts as a service provider processing that information only to deliver the Services, only as instructed by the board, and under the board’s agreement. The board provides the authority and, where required, the consent for students to use the Services. Individual parental consent under the U.S. COPPA regime (Section 9) does not apply to board-authorized educational deployments, which are governed instead by the board agreement and Ontario law.

8.2 Student data protections

• Purpose limitation: student personal information is used solely to deliver the Services — not for advertising, not for sale, and not to train AI models (Section 4).
• Ownership: student-submitted content (including photos and work) and student records are owned by the student/board; any content licence in our Terms does not apply to student content.
• Canadian residency: student personal information is stored and processed in Canada (Section 6).
• Data minimization: we collect only what the educational activity requires; no student names or profiles are required, and location is off by default for student accounts.
• Retention & return: on termination of a board agreement we delete or return student personal information within 30 days and provide an export on request.
• Sub-processors: we keep a current list of sub-processors that handle student data (Section 5) and notify the board of material changes.
• Breach notice: 72-hour notice to the board (Section 7).

8.3 Account setup options

Boards may choose shared class accounts (a small number of shared logins with a common password and shared quota, tied to no individual student identity — the lowest-data option, for supervised in-class use) or per-student accounts (individual logins, typically via the board’s single sign-on or roster, allowing individual export or deletion). Either way, the student-data protections in this Section apply.

9. Children’s Privacy (U.S. COPPA)

This Section applies to individual users in the United States. The U.S. Children’s Online Privacy Protection Act (COPPA) concerns personal information from children under 13. Outside a board-authorized school deployment (Section 8), the Services are not directed to, and we do not knowingly collect personal information from, children under 13 in the United States without verifiable parental consent. A parent or guardian who believes we have collected such information may contact us at info@stemminds.com and we will delete it. Where COPPA-covered information is collected under an authorized school arrangement, we act on the school’s authority as permitted by COPPA’s school-consent provisions and limit use to the educational purpose.

10. Your Privacy Rights

Subject to applicable law, you may: access the personal information we hold about you and request a copy; correct inaccurate information; delete your account and associated data; and withdraw consent or object to certain processing. Students and parents should direct requests relating to school use to their school board as custodian, and we will support the board in responding. To exercise a right directly with us, use Section 11. You may also complain to the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner of Ontario, and — in the U.S. — to applicable regulators.

11. Changes and How to Contact Us

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where a change is material or affects student data, notify affected users or boards.

Contact