Legal

Privacy Policy

Effective July 10, 2026 · Operated by RPFS, Inc. (DBA Rare Plant Daddy)

Botanisun is a software platform for the specialty-plant trade — plant and pricing intelligence, a supplier directory, sourcing and invoice-request tools, inventory and export tools (including connected sales channels such as TikTok Shop), and laboratory operations software — operated by RPFS, Inc. (“Botanisun,” “we,” “us”). This policy explains what personal data we collect, how we use and protect it, how long we keep it, and the choices and rights you have. We collect only what we need to run the service, we do not sell personal data, and we process and store data exclusively in the United States.

This policy is AI-drafted and has not yet been reviewed by an attorney. It will be reviewed before Botanisun's first revenue, fundraise, or Ring-2 gate — whichever comes first.

1. Who we are

Botanisun is operated by RPFS, Inc., a company registered in Arizona, United States, with its registered address at 1441 E Germann Rd, Chandler, AZ 85286. For any privacy question or request, contact us at jarid@rareplantdaddy.com.

2. Data we collect

We collect the following categories of data:

Account data — email, name, password (handled by our auth provider), phone (encrypted at rest), country, notification preferences.
Business profile data — company details, addresses, credentials you upload (e.g., licenses, resale certificates — stored encrypted), tax-relevant identifiers you provide.
Connected sales-channel data — when a seller authorizes Botanisun to connect a sales channel (such as TikTok Shop, via that channel’s official authorization flow), we access the seller’s own shop, product, inventory, order, and fulfillment data through the channel’s API, using the scopes the seller grants.
Buyer fulfillment data — to generate shipping labels for a seller’s orders, we access the order’s recipient details (name and shipping address). We use this solely to produce the carrier label and tracking for that order.
Usage data — pages viewed, features used, device/browser info, IP address, via product analytics (PostHog) and error monitoring (Sentry). We do not sell this data.
Communications — messages you send through the platform (buyer–supplier threads are mediated and may be automatically screened for policy violations such as contact-info exchange), support requests, and emails you send us.
Payment data — processed by Stripe; we never store card numbers.
Supplier/business contact data (B2B) — we process publicly available business contact information (e.g., a nursery’s public website, business listings) to operate our supplier directory and, on behalf of vendors, business-to-business outreach. Legal basis: legitimate interest in B2B commerce. Businesses may opt out of outreach at any time and we maintain suppression lists honoring opt-outs.
Operational & log data — limited technical logs needed to run, secure, and troubleshoot the service.
Early-access applications — name, email, persona, and an optional note submitted through our founding-beta application page, used solely to review applications and contact applicants about the beta. Deleted on request like everything else.

We do not request or retain payment card numbers, government identifiers, or any personal data beyond what is described above.

3. How we use data

We use personal data to provide and improve the Services:

Synchronize a seller’s catalog, inventory, and orders across their sales channels.
Generate carrier shipping labels and tracking for the seller’s orders.
Reconcile sold quantities back into the seller’s inventory to prevent oversell.
Operate intelligence features (pricing, demand indicators, name-matching) and the supplier directory.
Send transactional messages and, with consent where required, product updates.
Prevent fraud and abuse, and secure, maintain, and support the platform.
Comply with law.

AI processing disclosure: content you submit (e.g., price lists, messages, images) may be processed by third-party AI models (Anthropic) to power features like document parsing and assistants. By default, Anthropic does not use data submitted through its commercial API to train its models.

Training our own plant-identification and valuation models: separately from the third-party AI processing above, if you opt in (a distinct, revocable choice available at signup and anytime in Settings — never required to create or use an account), we may use plant photos and collection data you submit — individually and combined with other collectors’ data — to train and improve our own machine-learning models, including plant identification and valuation models. This is off by default. We record the exact version of this consent choice you agreed to, and any upload you make while opted in is tagged with that version so we always know which of your content this consent covers. Turning the setting off in Account → Settings stops any future use of your data for training; it does not remove data already incorporated into a model that was trained before you turned it off. Photos and collection data uploaded before you ever opted in are never used for training unless you separately opt in and re-upload or the setting is on at the time of a later upload.

We do not use personal data for advertising or automated decision-making about you, and we never sell or rent personal data.

4. Sales-channel platform data

Data we access from a connected sales channel is used strictly to operate that seller’s own account in accordance with the channel’s platform terms and developer policies. We access it only with the seller’s authorization, limit our use to the purposes above, and delete it as described below. We do not combine one seller’s channel data with another’s, and connections are isolated per seller.

6. How we protect data

We encrypt data in transit using TLS 1.2 or higher and encrypt sensitive data at rest — OAuth access and refresh tokens are encrypted with AES-256-GCM. Access to production systems and personal data follows least-privilege and is restricted to authorized personnel; multi-factor authentication is enforced on all critical accounts. Our systems run on managed US-region cloud infrastructure with network isolation, role-scoped access, audit logging, and rate limiting. No system is perfectly secure; we will notify affected users of breaches as required by law.

7. Where data is stored

All personal data is stored and processed exclusively in the United States (AWS us-west-1 via Supabase). We do not transfer personal data outside the United States. Where EU/UK data protection law applies to a user, that storage constitutes a transfer to the US; Standard Contractual Clauses apply via our processors’ data processing agreements.

8. Data retention & deletion

Account data is retained while your account is active. Behavioral event data has limited retention (90 days after subscription end). Financial and compliance records are retained as required by law. Backups are encrypted with limited retention.

Buyer recipient data is retained only as long as necessary to fulfill the associated order and reconcile the seller’s records. When a seller disconnects a channel or ends their relationship with us, we revoke and delete that seller’s access tokens and purge the seller’s stored order and recipient data from our systems.

9. Your rights & choices

Training consent: opt in or out of letting us use your photos and collection data to train our plant-identification and valuation models anytime in Account → Settings. Off by default; see Section 2 for how this works and its limits.
Export: request a machine-readable copy of your data in-app (Account → Export Data) or by email.
Deletion: request account deletion in-app; a 30-day window applies during which you can cancel by logging in; afterward personal data is deleted or irreversibly anonymized, except records we must retain (e.g., billing). A seller can also revoke Botanisun’s access to a connected channel at any time from that channel’s settings, which stops further data access.
Correction, objection, restriction: contact us at the address in Section 1. EU/UK residents may also lodge complaints with a supervisory authority. We honor applicable rights under GDPR, UK GDPR, and US state privacy laws (e.g., access/deletion; we do not sell or “share” data for cross-context behavioral advertising).

10. Cookies

We use necessary cookies (authentication, security) and analytics cookies (PostHog). You can control non-essential cookies through your browser settings.

11. Children’s privacy

The Services are for users 18 and older and are not directed to children. We do not knowingly collect personal data from children.

12. Incident notification

We maintain an incident response process. In the event of a suspected or confirmed data breach affecting personal data, we will notify affected users and any connected sales channel without undue delay, and any governmental or regulatory authority where legally required.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced in-app or by email, and the effective date above revised, at least 14 days before taking effect.

14. Contact us

RPFS, Inc. (DBA Rare Plant Daddy)
1441 E Germann Rd, Chandler, AZ 85286, United States
jarid@rareplantdaddy.com