Privacy policy
tree·canopy — operated by Aurenia Group Limited
Effective date: 12 May 2026
Version: 1.0
Who we are
tree·canopy is a voice-first arboricultural survey application. It is operated by Aurenia Group Limited, a corporation incorporated under the Canada Business Corporations Act (corporation number 726662166), with registered office at 3 Old Lochview Court, Fall River, NS B2T 1J1, Canada ("we", "us", "our").
We are the data controller for personal data collected when you create an account, contact us, or visit our website at treecanopy.app.
When you use tree·canopy to conduct surveys on behalf of your clients, we act as your data processor — your clients' data belongs to you. That relationship is governed separately by our Data Processing Agreement.
As a controller not established in the UK that offers services to UK-based users, we are subject to UK GDPR by virtue of Article 3(2). We are in the process of designating a UK Representative under UK GDPR Article 27. UK data subjects and the Information Commissioner's Office may contact us directly at privacy@treecanopy.app in the meantime; we will update this section once the appointment is finalised.
Contact for data matters:
Email: privacy@treecanopy.app
Post: Data Protection, Aurenia Group Limited, 3 Old Lochview Court, Fall River, NS B2T 1J1, Canada
What data we collect and why
1. Account and profile data
What: Name, email address, professional role, company or practice name, preferred units (metric / imperial), profile photo if uploaded.
Why: To create and maintain your account, authenticate you, and personalise the application.
Lawful basis: Performance of a contract (UK GDPR Article 6(1)(b)). You cannot use tree·canopy without an account.
Retention: For the life of your account, plus 90 days after deletion to allow for recovery requests.
2. Survey and field data
What: GPS coordinates of survey sites, tree location pins, BS 5837 field data (species, dimensions, condition, category, RPA calculations), voice recordings and transcripts, tree photos, site polygons, generated PDF reports, and any free-text notes entered during a survey.
Why: To provide the core service — storing your survey data, generating reports, and syncing between your devices.
Lawful basis: Performance of a contract (UK GDPR Article 6(1)(b)).
Important: You are the controller of this data. Your client sites, tree data, and reports are yours. We process them only on your instruction. See the DPA for the full processor terms.
Retention: Retained for the life of your subscription. On account deletion, you have 30 days to export. After that, all survey data is permanently deleted from live systems within 90 days and from backups within 180 days.
3. Voice recordings and AI processing
What: When you use the voice capture feature, your recording is transmitted to Google LLC (via the Vercel AI Gateway) for speech-to-structured-data processing. The structured output (BS 5837 field values) is then processed by Anthropic PBC (Claude) to draft report narrative text. We do not store the raw audio after processing.
Why: To power the core voice-first feature of the product.
Lawful basis: Performance of a contract (UK GDPR Article 6(1)(b)).
Note on AI: Google LLC and Anthropic PBC act as our sub-processors. Under our agreements with both, your data is not used to train their general AI models. Requests are processed transiently and not retained by sub-processors beyond the time needed to return a response.
4. Species identification data
What: Tree photos you submit for species identification are sent to the Pl@ntNet API (operated by INRIA, France). Pl@ntNet receives the image and returns species suggestions with confidence scores. We do not transmit any personally identifying information alongside photos.
Why: To provide the AI species suggestion feature.
Lawful basis: Performance of a contract (UK GDPR Article 6(1)(b)).
Note: Pl@ntNet is an EU-based academic service and processes data within the EU. Their own terms apply to image submissions.
5. Payment and billing data
What: Subscription plan, billing period, transaction history, and subscription status. For Solo and Practice tiers purchased via in-app purchase (iOS App Store / Google Play), payment details are handled entirely by Apple or Google — we never see your card details. For Enterprise customers billed via Stripe Invoice, Stripe processes your payment details directly.
Why: To manage your subscription and process payments.
Lawful basis: Performance of a contract (Article 6(1)(b)); legal obligation for financial record-keeping (Article 6(1)(c)).
Retention: Transaction records retained for 7 years to comply with UK financial regulations (HMRC requirements).
6. Usage and analytics data
What: Page views, feature interactions, session duration, device type, operating system, and crash reports. We use PostHog for product analytics. Data is pseudonymised and aggregated where possible.
Why: To understand how the product is used, fix bugs, and improve features.
Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)) — we have a legitimate interest in improving our product. We balance this against your privacy: we collect no advertising-grade profile data, and you can opt out of analytics in your account settings.
Retention: Aggregated analytics data for 24 months; raw session data for 90 days.
7. Contact and support data
What: Name, email address, and the content of any message you send via our contact form or to hello@treecanopy.app.
Why: To respond to your enquiry.
Lawful basis: Legitimate interests (Article 6(1)(f)) — responding to inbound enquiries is a legitimate business interest.
Retention: 3 years from last contact, unless you request earlier deletion.
Our sub-processors
We use the following third-party processors. Each is bound by data processing agreements consistent with UK GDPR requirements.
| Processor | Country | Purpose | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. | US (EU-region data) | Database and file storage | EU/Frankfurt region; standard contractual clauses |
| Vercel Inc. | US | Web hosting and edge functions | UK IDTA / standard contractual clauses |
| Google LLC | US | Voice-to-structured-data (Gemini Flash) | UK IDTA / standard contractual clauses |
| Anthropic PBC | US | Report narrative drafting (Claude Haiku) | UK IDTA / standard contractual clauses |
| INRIA (Pl@ntNet) | France (EU) | Species identification API | EU adequacy — no transfer |
| RevenueCat Inc. | US | Subscription management | UK IDTA / standard contractual clauses |
| Stripe Inc. | Ireland / US | Enterprise payment processing | EU adequacy (Ireland); UK IDTA for US entity |
| Zoho Corporation | US / India | Transactional email (SMTP) | UK IDTA / standard contractual clauses |
We will notify you of any material changes to this list via email at least 14 days before a new sub-processor goes live. You may object to a new sub-processor within that 14-day window by contacting privacy@treecanopy.app.
International transfers
Several of our sub-processors are based in the United States. Where personal data is transferred outside the UK, we rely on one or more of the following safeguards:
- UK International Data Transfer Agreement (IDTA): The UK's standard contractual mechanism for international transfers post-Brexit.
- EU Standard Contractual Clauses (SCCs) with UK Addendum: Where a processor already holds EU SCCs, we apply the UK Addendum.
- EU adequacy decisions: Where data is processed within the EU (e.g., Supabase Frankfurt, Stripe Ireland, Pl@ntNet France), no transfer mechanism is required.
Your survey data is stored exclusively in the EU/Frankfurt Supabase region. It does not leave the EU for storage, only for transient AI processing (voice, report drafting) which is covered by IDTAs as above.
Your rights under UK GDPR
You have the following rights in relation to personal data we hold about you as controller:
| Right | What it means |
|---|---|
| Access | Request a copy of the data we hold about you. |
| Rectification | Ask us to correct inaccurate data. |
| Erasure | Ask us to delete your personal data ("right to be forgotten"). |
| Restriction | Ask us to stop processing your data in certain ways while a dispute is resolved. |
| Portability | Receive your account and survey data in a machine-readable format (CSV and JSON exports available directly in the app). |
| Object | Object to processing based on legitimate interests (including analytics). |
| Withdraw consent | Where we rely on consent, withdraw it at any time without affecting prior processing. |
To exercise any of these rights, email privacy@treecanopy.app. We will respond within one calendar month. No fee is charged for legitimate requests.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) (the supervisory authority for UK data subjects): ico.org.uk | 0303 123 1113. You may contact our UK Representative in the first instance if you prefer.
Cookies
treecanopy.app uses minimal cookies:
- Strictly necessary: Session authentication cookie (Supabase Auth). Cannot be disabled without breaking sign-in.
- Analytics: PostHog first-party analytics script. Can be opted out in account settings or by declining in the cookie banner on first visit.
We do not use third-party advertising cookies or sell data to advertisers.
Children
tree·canopy is intended for professional use by adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us at privacy@treecanopy.app and we will delete the account.
Changes to this policy
We may update this policy when our processing changes. Material changes (new data categories, new sub-processors, changed lawful bases) will be notified by email at least 14 days before they take effect. Minor clarifications will be noted with a revised version date above.
Continued use of tree·canopy after a notified change constitutes acceptance of the updated policy.
Aurenia Group Limited — 3 Old Lochview Court, Fall River, NS B2T 1J1, Canada — privacy@treecanopy.app