Poultry Log Privacy Policy

Last updated: October 5, 2026

Data Controller & Roles (EU GDPR & UK GDPR)

PoultryLog is operated by Hywel LLC, a limited liability company formed in South Carolina, United States (6650 Rivers Ave Ste 100, Charleston, SC 29406, United States), email: [email protected]. For your account profile, billing, and platform security, PoultryLog acts as a Data Controller under the EU General Data Protection Regulation (EU GDPR) and UK GDPR. For the operational farm, house, flock, worker, and compliance records you enter, you (the farm operator/grower) are the Controller and PoultryLog acts as your Data Processor under Article 28 GDPR.

Grower Ownership of Farm Data

You own your farm data. PoultryLog holds and processes your operational, compliance, and financial records solely to provide the service to you. We never sell your farm or personal data.

Information we collect

We collect account details such as name, email address, login credentials, billing details, workspace information, farm records, uploaded files, notes, and support communications that you choose to provide while using Poultry Log.

Personal data collected includes: account holder and worker names, email addresses, optional phone numbers, encrypted password hashes (bcrypt), farm names and addresses, session/security logs, billing identifiers, and operational flock records, uploaded certificates (such as Salmonella and post-mortem reports), and financial entries associated with an identifiable grower.

Lawful Bases for Processing (Article 6 GDPR)

Under EU GDPR and UK GDPR Article 6(1), we process personal data on the following lawful bases:

Contract (Article 6(1)(b) GDPR): To create and manage your PoultryLog account, record daily flock/house data, sync offline entries, generate performance alerts, and provide customer support.
Legal Obligation (Article 6(1)(c) GDPR): To comply with statutory accounting, tax, and regulatory record-keeping obligations.
Legitimate Interests (Article 6(1)(f) GDPR): To protect platform security, prevent brute-force login abuse, maintain encrypted offsite database backups, and diagnose application errors.
Consent (Article 6(1)(a) GDPR): To share your linked farm data with a named poultry processor/integrator when you enter their processor code and tick the consent box, and for optional marketing analytics cookies (Google Analytics). You may withdraw consent at any time.

How we use information

We use this information to operate the service, secure accounts, process billing, provide customer support, improve product performance, communicate important service updates, and comply with legal obligations.

Optional Google Analytics loads only after you allow analytics. You can change your choice using Analytics privacy. We measure public tools and completed signup, first-record, enquiry and paid-purchase outcomes without sending names, email addresses or farm record contents. Processor enquiry contact details are stored to answer your request; they are not sent to Analytics.

Processor Network Sharing & Right to Unlink

A poultry processor or integrator never sees your farm data by default. Sharing occurs only when you actively enter the processor code in PoultryLog and tick the explicit consent box. Once linked, the processor can view your linked farm overview, house/week comparisons, compliance records, and exchange messages/documents with you. You can unlink your farm and withdraw consent at any time in PoultryLog Settings, which immediately stops live sharing.

How information is shared

We do not sell your personal information. We may share data with service providers that help us run the platform, such as hosting, authentication, payment, email, storage, and analytics vendors, and when required by law or to protect the service.

Sub-processors & Service Providers

We use carefully selected sub-processors to operate PoultryLog:

Primary Application & PostgreSQL Database Hosting: Contabo, Lauterbourg, France, European Union (live application server and PostgreSQL database).
Cloudflare R2: Private object storage for uploaded flock documents/certificates and encrypted offsite database backups (configured location preference: Eastern North America (ENAM)).
Resend: Transactional email delivery (account verification, password resets, and processor message notifications).
Stripe: Subscription payment processing and billing administration.
PostHog: Product diagnostics and feature reliability analytics.
OpenRouter & OpenAI (ChatGPT): Optional AI Farm Assistant, voice note transcription, and optional user-linked ChatGPT connector when explicitly invoked by you.
Google Analytics: Website marketing analytics, disabled by default and loaded only after explicit user consent.

International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom to a country without an adequacy decision (such as the United States for certain cloud sub-processors), we rely on the European Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA) alongside technical encryption safeguards.

Data retention

We keep account and workspace information for as long as your account remains active and as needed to provide the service, resolve disputes, enforce agreements, and meet legal, security, or financial recordkeeping requirements.

When you deactivate your account in Settings, your account enters a 30-day grace period during which you can sign back in with your password to cancel deletion. After 30 days, our automated erasure worker permanently deletes your sole-owned operational farm, house, flock, daily log, and uploaded document records, and scrubs your personal identifiers. Financial records (expenses and income) are retained in an anonymised form with personal notes and vendor details removed where required for statutory tax compliance. Encrypted database backups in Cloudflare R2 and local storage roll off automatically within 30 days after deletion.

Security

We use reasonable administrative, technical, and organizational safeguards to protect your information, but no system is completely secure and we cannot guarantee absolute security.

Technical safeguards include HTTPS/TLS encryption in transit, bcrypt password hashing, login rate limiting (5 attempts per 15 minutes), CSRF protection, strict workspace tenant isolation, private authenticated object storage for uploaded files, and nightly SHA-256 verified offsite backups.

Your Data Subject Rights (EU & UK GDPR)

You may update account details, manage workspace content, and contact us to request account-related assistance. Depending on your jurisdiction, you may also have rights to access, correct, delete, or export certain personal information.

Right of Access & Data Portability (Articles 15 & 20): You can download a complete machine-readable JSON export of your profile and farm records at any time from Settings -> Export My Data.
Right to Rectification (Article 16): You can update or correct your profile and farm records directly in the app.
Right to Erasure / "Right to be Forgotten" (Article 17): You can schedule permanent deletion of your account and sole-owned farm records from Settings -> Deactivate Account (subject to the 30-day cancellation grace period).
Right to Restriction & Right to Object (Articles 18 & 21): You may request restriction of processing or object to processing based on legitimate interests.
Right to Withdraw Consent (Article 7(3)): You can unlink from a processor or withdraw analytics consent at any time without affecting prior lawful processing.
Right to Lodge a Complaint (Article 77): You have the right to lodge a complaint with your supervisory authority, such as the UK Information Commissioner's Office (ICO, https://ico.org.uk) or the Irish Data Protection Commission (DPC, https://www.dataprotection.ie) or your local EU authority.

Connected ChatGPT access

PoultryLog is operated by Hywel LLC. When you connect PoultryLog to ChatGPT, Auth0 handles the connection sign-in. PoultryLog links the authenticated identity to the PoultryLog account and workspace you authorize. Requests are checked against your current PoultryLog access and connection permissions.

When you ask ChatGPT to use PoultryLog, the service returns the requested, authorized records to ChatGPT. Depending on the request, these may include farm, house and flock information, operational logs and notes, financial records, tasks, compliance records, or grower information shared with an authorized processor. Information returned to ChatGPT is also subject to OpenAI's applicable terms, privacy policy, and your ChatGPT account settings.

PoultryLog retains account-link records, request diagnostics, and operation receipts used to authorize access, prevent duplicate changes, and investigate errors. Operation receipts may include the proposed changes and the resulting record details. Disconnecting the connection in PoultryLog Settings revokes future access through that link. It does not delete farm records, operation receipts, or information already returned to a ChatGPT conversation. General PoultryLog retention and privacy-request practices still apply.

Contact

For support, account questions, or requests concerning your personal data, contact [email protected].

To exercise any of your GDPR rights or request our Article 28 Data Processing Agreement, contact [email protected] or write to Hywel LLC, 6650 Rivers Ave Ste 100, Charleston, SC 29406, United States.