Privacy & GDPR¶

Kamerplanter is built on the principle of Privacy by Design. You have full control over your personal data: you can export, correct or have it deleted at any time. All data subject rights under GDPR Art. 15–21 are available as self-service features.

For Technical Users / Self-Hosters¶

This section is aimed at technical users and self-hosters. All GDPR features described below are available as REST endpoints under /api/v1/privacy/. Some of them are also directly usable in the graphical interface (see the relevant sections below); a few endpoints — email change, objection, granting/revoking consent with a click, lifting a restriction, export status/download — are currently reachable only via the API. A logged-in session (bearer token) is required, except for GET /api/v1/privacy/policy.

curl -X POST https://<your-instance>/api/v1/privacy/export \
  -H "Authorization: Bearer <your-access-token>"

Opening Privacy Settings¶

Here's how to open the privacy area:

1. Click your profile picture or initials in the top right
2. Click Privacy in the menu

The privacy area has four tabs: Consents, Data Export, Delete Account and Restrict Processing.

Exporting Your Data (GDPR Art. 15 & 20)¶

You have the right to know what data the system has stored about you and to receive it in a machine-readable format.

Requesting a Data Export¶

1. Navigate to Privacy > the Data Export tab
2. Click Request Export
3. The interface confirms the request with its current status

The export then runs asynchronously in the background (takes 1–5 minutes depending on data volume); the resulting download link is valid for 72 hours.

The export contains all data the system knows about you: - Profile data (name, email, settings) - All created plants, locations, tasks and harvests - Care reminders and confirmation history - Sensor data (if you have any) - Consent history

Changing Your Email Address (GDPR Art. 16)¶

You have the right to have your data corrected.

The new email becomes active once confirmed — all active sessions are ended.

Restricting Processing (GDPR Art. 18)¶

You can restrict the processing of your data for certain purposes — for example if you dispute the accuracy of your data or consider the processing unlawful.

1. Navigate to Privacy > the Restrict Processing tab
2. Enter the affected data scope (e.g. sensor_data, harvest_records, treatment_records) and choose a reason
3. Click Restrict

The created restriction then appears in the Active Restrictions list on the same tab. During a restriction the affected data is no longer actively processed.

Managing Consents (GDPR Art. 7)¶

No optional consent is needed for the core functions of the system. However, some additional features require your agreement.

Types of Consent¶

Revoking Consent¶

The Consents tab in the privacy area shows an overview of all processing purposes with your current status (Granted / Not granted) and, for required consents, a Required label.

Photo Identification (plant_identification)¶

Plant recognition by photo sends your image to Pl@ntNet (CIRAD/INRIA, France/EU) for analysis. Consent is required because the photo briefly leaves the Kamerplanter instance.

What happens when you revoke:

• All camera buttons are immediately hidden
• New photo requests are rejected with HTTP 403 (Full mode) or blocked in the browser (Light mode)
• Your identification history is retained (it contains no photos, only results)
• You can grant consent again at any time

Data flow when consent is active:

All EXIF metadata is removed before transmission to Pl@ntNet (GPS coordinates, camera model, capture time).

Cloud-Based Pest Detection (pest_detection_cloud)¶

Pest detection by photo sends your image — depending on the operator's configuration — either to a self-hosted recognizer (no consent required) or to the Kindwise plant.health cloud service. This consent is only required when the cloud adapter is active. As with plant identification, the photo is stripped of EXIF metadata before sending and is not stored permanently.

AI Access to Your Plant Data (ai_tenant_data_access)¶

The AI Assistant answers plain knowledge questions without this consent. As soon as an answer is meant to use your specific plant context — for chat, future tip cards, the tip of the day, and "why?" explanations — this consent is required.

Only master values are transmitted: scientific plant name, current phase, substrate, EC/pH readings, and aggregated counters (e.g. "3 overdue tasks"). Your name, e-mail address, and free-text notes from your plant diary are never transmitted.

AI Processing via Cloud Provider (ai_cloud_processing)¶

Required in addition to the previous consent when your instance uses an external cloud provider (e.g. Anthropic, OpenAI) instead of a locally run model (Ollama) for the AI Assistant — this is decided by the platform operator. Cloud providers may involve a third-country data transfer. Local providers do not need this consent.

AI Disease Diagnosis (plant_diagnosis)¶

Analyses your leaf photo to produce a suspected-cause list for diseases and nutrient deficiencies — distinct from Pest Detection. Unlike plant identification and cloud-based pest detection, this analysis runs exclusively self-hosted on your own Kamerplanter infrastructure: there is no cloud adapter, and your photo never leaves the instance. Consent is still requested because a photo of yours is processed. As with pest detection, the photo is stripped of EXIF metadata before processing and is never stored permanently — only a SHA-256 fingerprint is retained for traceability. Every result is explicitly only a hypothesis; a treatment is never triggered automatically.

Objecting to Processing (GDPR Art. 21)¶

You can object to the processing of your data for certain purposes where processing is based on legitimate interest.

The system reviews the objection. For processing based on GDPR Art. 6(1)(f) (legitimate interest), processing will cease unless compelling legitimate reasons are present.

Deleting Your Account (GDPR Art. 17)¶

You have the right to erasure of your data.

Deletion Process¶

1. Navigate to Privacy > the Delete Account tab
2. Click Delete Account
3. For accounts with a local password login, enter your current password in the confirmation dialog (to authorize the deletion). This step is skipped for accounts that sign in exclusively through an external provider (Google, GitHub, Apple …).
4. In the confirmation dialog, click Yes, Delete Account

The same action can also be triggered directly via the API: POST /api/v1/privacy/erasure starts the deletion (for local accounts with the password field), GET /api/v1/privacy/erasure/{erasure_key} returns the status (see For Technical Users / Self-Hosters).

What happens next:

Immediately:
- Soft-delete of the account (status: deleted)
- All active sessions are terminated
- You can no longer log in

Personal data (GDPR Art. 17):
- Anonymised immediately or deleted after 90 days

Legally protected data (GDPR Art. 17(3)(b)):
- Harvest documentation and IPM treatment records:
  Are anonymised (user reference removed),
  the data itself is retained (CanG, PflSchG)

After 90 days:
- Hard-delete of all remaining personal data

Photos and Attachments (Object Storage)¶

Kamerplanter stores photos and files through a storage adapter configured by the platform operator. As a user, the following points are relevant to you:

EXIF Data¶

When uploading photos, the backend removes all EXIF metadata by default before storing the file. This includes:

• GPS coordinates (location where the photo was taken)
• Camera model and serial number
• Timestamp (from the EXIF header)

The operator may enable EXIF retention per category — this will be noted in the instance's privacy notice when enabled.

Photos and Account Deletion¶

When you delete your account, the system distinguishes between two photo types:

Files are retained because they belong to the plant record and may be subject to statutory retention obligations (CanG, PflSchG). Your name is no longer linked to the photos after anonymization.

Tenant Deletion¶

When a tenant is deleted (by the platform admin or on request), all binary data for that tenant is completely removed from storage — regardless of the backend in use (local-fs or S3). This is done by deleting all objects with the prefix t/{tenant_key}/. The result is documented in the audit log.

Data Portability (GDPR Art. 20)¶

Your data export includes all stored attachments as a ZIP archive. The archive contains:

• All files in the relative folder structure of the storage schema
• A manifest.json with the mapping attachment_id → file path → metadata

Data Retention and Retention Periods¶

Kamerplanter stores different data categories with different retention periods:

Sensor Data Downsampling¶

Sensor data is automatically compressed in stages:

0–90 days:       Raw data (every measurement)
90 days–2 years: Hourly aggregates (Min/Max/Avg)
2–5 years:       Daily aggregates (Min/Max/Avg)
After 5 years:   Automatic deletion

IP Anonymization¶

IP addresses are generally only stored in plain text for 7 days. After that they are anonymized to the /24 subnet (the last 8 bits set to 0), so that individual assignment is no longer possible.

Sensor Data and Privacy (DPIA)¶

Certain sensor data can allow inferences about presence patterns (CO₂ concentration, motion detectors, manual overrides). A Data Protection Impact Assessment (DPIA) has been carried out for such data. The key measures:

• Sensor data is fundamentally not shared with other tenants or third parties
• The platform operator can only view sensor data after an explicit support request and with your consent
• Aggregated statistics (without personal reference) may be used for system improvement — you can disable this in the consents

Frequently Asked Questions¶

See Also¶

• Account & Sign-In
• Tenants & Gardens
• AI Assistant