Privacy notice

1. In short

• mio.farm is run by Falkasete AS in Norway. When you buy from a farm, the farm also receives the details it needs and is responsible for how it uses them.
• We process only what is needed to run your account, your purchases and memberships, and the sign-up lists you choose to join.
• Card payments are handled by Stripe and go to the farm's own Stripe account. Your card details never reach mio.farm.
• Our database is in the EU (Frankfurt, Germany). We do not sell personal data and do not use advertising trackers.
• Analytics (Microsoft Clarity) runs only if you say yes to it.
• You can download your data and delete your account yourself, from your account page.

2. Who is responsible for your data

Falkasete AS, org. nr. 988 195 154, Skreddarstuva 141, 4160 Finnøy, Norway (“mio.farm”, “we”) is the controller for the personal data processed to run mio.farm: accounts and profiles, the website and marketplace, the service fee, interest sign-ups and the demand map, feedback, and security logs.

The owner of Falkasete AS also runs a farm, Falkasete, which sells on mio.farm like any other farm. When you buy from that farm, it receives the same details as any other farm, as described in section 3, and uses them only to serve your purchase or membership.

We have not appointed a data protection officer. Questions about privacy go to post@mio.farm.

3. Farms as independent controllers

When you buy from a farm, apply for a share, join a waitlist or sign up for a work day, the farm receives your name, your email address, what you bought, your pickup point or delivery choice, and any note you write to the farm. If something is posted to you, the farm also receives your postal address.

The farm is an independent controller for this data. It decides how to use it to run your membership or purchase and to meet its own legal duties, such as bookkeeping. The farm must use your data only for that purpose and in line with data-protection law. What a farm does with your data outside mio.farm, for example in its own email, accounts or payment records, is the farm's responsibility.

For data a farm holds about you, contact the farm. Its contact details are on the farm's page.

4. What data we process

Your account

Your email address, display name, whether you are a member or a farmer, your country and language, and when the account was created. If you sign in with a password, it is stored only in hashed (scrambled) form by our sign-in provider; nobody at mio.farm can read it.

Signing in with Google (optional)

If you choose to sign in with Google, Google confirms who you are and tells us your email address, and may also send your name and profile picture. Google learns that you signed in to mio.farm. We never receive your Google password or access to your Google account. You can always use an email address and password instead.

Your profile

What you add to your profile, such as your display name, country and language.

Purchases, memberships, applications and waitlists

What you bought (a share, products or a place at an event), from which farm, your pickup point or delivery choice, the season, the price, the service fee, the payment status and any refund. For a share: its status (requested, confirmed, active, declined or cancelled). The name and email address you gave, any note you wrote to the farm, and when. If something is posted to you, your postal address, which you enter on the payment page.

Only write in the note what the farm needs to know. If you choose to mention allergies or other health information, it is shared with that farm only.

Payments

You pay by card in a payment form provided by Stripe. The payment is made to the farm's own Stripe account: the farm is the seller and receives the price. mio.farm receives only its service fee of 6 % of the price (with a small minimum per currency), which is shown as its own line before you pay and is paid by you, the buyer.

Your card number, expiry date and security code are entered directly with Stripe. They never reach mio.farm or the farm. Stripe receives the amount and currency, your email address, your card details, your postal address if something is posted to you, and the technical information it needs to process the payment and prevent fraud, such as your IP address and device information. From Stripe, mio.farm and the farm receive a reference to the payment, its amount and its status, never your full card number.

For some purposes, such as preventing fraud and meeting its own legal duties against money laundering, Stripe acts as an independent controller. Stripe's own privacy policy applies to that: stripe.com/privacy.

Work-day sign-ups

Which work day you signed up for, with the name and email address you gave, and when you signed up.

Season wishes and votes

Your votes on what a farm should grow, and suggestions you make or support. When you vote, your browser creates a random voting key so that each person votes once; the key is stored in your browser and sent with your vote. If you are signed in, your vote is also linked to your account. Suggestions are shown publicly on the farm's page with your display name.

Interest sign-ups and the demand map

When you use “Get notified” or “Raise your hand”: your email address, country, what you are (for example someone who wants to eat from a local farm, a farmer, a landowner or a grower), your language, and which form you used. You tick a box to agree before your email is stored.

If you raise your hand on the map, we also store the point you clicked, rounded to about 100 metres, and a place name: the town you typed, or the nearest place name looked up for that point.

The public map never shows your name, email or exact point. It shows only green dots grouped to about 10 kilometres, with a count of how many people raised their hand there.

Feedback

If you are signed in and send a note with the feedback button, we store your note, your name and email address, the page you were on, your browser type, screen size and language. A picture of your screen is attached only if you tick “Attach a screenshot”. It is never offered on account or farm-management pages.

Account events (security log)

A record of security-relevant events on your account, such as data exports and account deletion, with the time. Our sign-in provider also keeps its own log of sign-ins, which includes your IP address.

Technical data

When your browser loads mio.farm, the servers it contacts (see section 7) receive your IP address and basic browser information, as part of how the internet works.

To suggest a language, the site looks up which country your IP address belongs to, once per browser session. Only the country code is kept, and only in your browser for that session.

5. Why we use it, and our legal basis

To provide the service you asked for (contract)

We use your account, profile, purchase, membership, work-day and voting data to run your account, to let you buy from a farm and hold a share, to pass your purchase or application to the farm, to process your payment through Stripe, to let you sign up for work days and take part in your farm's season planning, and to send you emails about your account, purchases and memberships. Signing in with Google is your choice and is used only to sign you in. The legal basis is that this is necessary to perform our agreement with you, or to take steps you asked for before an agreement (GDPR Article 6(1)(b)).

Bookkeeping (legal obligation)

We keep records of payments and of our service fee as the Norwegian Bookkeeping Act (bokføringsloven) requires (GDPR Article 6(1)(c)).

Interest sign-ups and the demand map (consent)

We use interest sign-ups to tell you when farms near you open, and to show on the demand map where people are waiting for a farm. The legal basis is your consent (GDPR Article 6(1)(a)). You can withdraw your consent at any time, with the unsubscribe link in every email or by writing to us (see section 9). Withdrawing does not affect what was done before.

Security and improving the service (legitimate interest)

We keep the account-event log, limit how often some actions can be repeated, protect accounts against misuse, and read the feedback you send us to improve mio.farm. The legal basis is our legitimate interest in keeping accounts and data safe, in being able to document data exports and deletions, and in improving the service (GDPR Article 6(1)(f)). You may object to this (see section 9).

Analytics (consent)

If you say yes in the cookie question, we use Microsoft Clarity to understand how the site is used and to improve it. The legal basis is your consent (GDPR Article 6(1)(a)), which you can change at any time (see section 10).

Votes without an account

If you vote on a farm's season planning without being signed in, we use only the random voting key from your browser. The legal basis is our and the farm's legitimate interest in hearing what the community wishes to be grown (GDPR Article 6(1)(f)).

Other legal obligations

We process data where the law requires it, for example to answer requests about your rights (GDPR Article 6(1)(c)).

We do not sell personal data, do not use it for advertising, and do not make automated decisions about you that have legal or similarly significant effects.

6. Who can see your data

• The farm you buy from, apply to or join sees your purchase, application and membership details and your sign-ups for its work days, as described in section 3. Other farms do not see them.
• Other visitors see only totals (such as how many members a farm has, or how many places on a work day are taken), the grouped dots on the demand map, and your display name next to a suggestion you make on a farm's season planning.
• mio.farm administrators at Falkasete AS can see data when needed to run and support the service.
• Our service providers (section 7) process data on our behalf, under data processing terms that limit their use of it.
• Stripe receives the payment information described in section 4.
• Public authorities only where the law requires us to share data.

7. Where your data is stored, and our service providers

• Supabase — our database, sign-in and server functions. The servers are in the EU, in Frankfurt, Germany.
• Bunny.net (BunnyWay d.o.o., Slovenia) — hosts the website and delivers its files and images through its content delivery network.
• Stripe (Stripe Payments Europe, Limited, Ireland) — card payments, paid to the farm's own Stripe account.
• Amazon Simple Email Service (Amazon Web Services) — sends emails from mio.farm, from the EU region in Frankfurt, Germany (eu-central-1).
• Google — sign-in with Google, only when you choose to use it.
• Microsoft Clarity — analytics, only if you say yes. Microsoft may process this data outside the EEA, including in the United States.
• cdnjs (Cloudflare) — delivers the script that makes the screenshot for feedback, only when you tick “Attach a screenshot”.

Other services your browser contacts

Some parts of the pages are loaded from other services. When that happens, your browser sends them your IP address and basic browser information:

• Google Fonts (Google), for the typefaces.
• Public code libraries from unpkg.com and cdn.jsdelivr.net, for the map and sign-in code.
• Map images from Esri and OpenStreetMap, for the maps. If you raise your hand on the map, the point you clicked is sent to OpenStreetMap's place-name service (Nominatim) to find the nearest place name.
• A translation service and a country lookup shared by the sites in the HerbWoman family, for the language choice. If that country lookup does not answer, the site asks the public service ipwho.is instead.
• Flag images from herbwoman.com, and on the front page a workshop announcement loaded from askur.b-cdn.net.

We aim to keep personal data inside the EU/EEA. Where a provider may process data outside the EEA, such as Stripe, Google, Microsoft, Amazon Web Services, Cloudflare or Supabase, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses, as set out in that provider's data processing terms.

8. How long we keep it

• Account and profile: until you delete your account.
• Purchases, payments and service-fee records: 5 years from the end of the financial year in which the purchase was made, as the Norwegian Bookkeeping Act requires. After you delete your account, they are kept only for that purpose. The farm keeps its own records under its own bookkeeping rules.
• Memberships, applications and work-day sign-ups: while your account exists. When you delete your account, they are anonymised as described in section 9.
• Interest sign-ups and raised hands: until you unsubscribe, withdraw your consent or delete your account.
• Analytics (Microsoft Clarity): 13 months.
• Feedback: until you delete your account.
• Account events: when you delete your account, your identity is removed from all your account events. What remains is only the type of event and its time.
• Backups: deleted data may remain in our database provider's backups for a limited time before they are overwritten.
• Farms keep their own records outside mio.farm as their own legal obligations require, for example bookkeeping rules.

9. Your rights

You have the right to access, correct and delete your data, to receive it in a portable format, to restrict our processing, and to object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time. Using your rights is free. Write to post@mio.farm.

Download your data

On your account page, “Download my data” gives you a file (mio-farm-my-data.json) with your account email, profile, memberships, work-day sign-ups, votes, interest sign-ups and account events. For security, this can be done a limited number of times per day. You can also ask us for a copy.

Correct your data

You can change your display name on your account page. For anything else, ask us, or ask the farm for data it holds.

Delete your account

On your account page, “Delete my account” deletes your account yourself. You confirm with your password and by typing a confirmation word. Deletion cannot be undone.

Deleted: your login and sign-in sessions, your profile, your votes, and your interest sign-ups and raised hands.

Anonymised and kept, because farms need the totals for planning: your memberships and work-day sign-ups (your name, email address and link to your account are removed). Your account events are kept without any link to you. Payment records are kept for bookkeeping, as described in section 8.

The note you wrote to a farm, and your display name on suggestions you made on a farm's season planning, are not yet removed automatically when you delete your account. Write to post@mio.farm and we will remove them.

If you own a farm on mio.farm, you must first hand over or close the farm before you can delete your account.

Deleting your account does not delete data the farm keeps outside mio.farm. Ask the farm directly for that.

Withdraw consent and object

Every email about interest sign-ups has an unsubscribe link. To withdraw your consent in another way, or to object to our processing, write to post@mio.farm. To change your choice about analytics, see section 10.

How we answer

We answer within one month. We may ask you to confirm who you are before we act on a request.

10. Cookies and storage in your browser

Necessary storage

mio.farm stores a few small items in your browser that the site needs in order to work. These are used only for functions you use, and are not used to track you:

• your sign-in session, so that you stay signed in;
• your language choice, and a short-lived copy of translations so that pages load faster;
• your answer to the analytics question, stored as a cookie named hwc_v1 for 12 months and in your browser's storage;
• your voting key and your own votes, so that you can only vote once;
• small reminders, such as whether you have already answered the language suggestion or the offer to install the app, and how many times you have visited, so the install offer is not shown on your first visit.

When you pay, Stripe's payment page may set its own cookies to prevent fraud. They are needed for the payment and are covered by Stripe's privacy policy.

Analytics — only with your consent

The first time you visit, we ask whether we may use analytics. Only if you answer yes do we load Microsoft Clarity, and we then tell Clarity that you have consented. Clarity records how pages are used, such as clicks, scrolling and mouse movement, and masks what you type. Clarity sets its own cookies, such as _clck and _clsk. Clarity is never loaded on account or farm-management pages.

If you answer “Only essential”, Clarity is not loaded. Your answer is remembered either way. We use no advertising trackers.

Change your choice

You can change your answer at any time. The button below removes your answer and Clarity's cookies on mio.farm, and reloads the page so that the question is asked again. You can also clear this site's data in your browser settings.

11. Children

mio.farm is not meant for children to use on their own. You must be at least 18 years old to buy or to apply for a share in your own name.

12. Changes to this notice

We will update this notice when we change how we process personal data. The date at the end of this page shows the current version. If a change matters for you, we will tell you by email before it takes effect.

13. Contact and complaints

For data a farm holds about you, contact the farm. Its contact details are on the farm's page.

If you think we process your data unlawfully, you may complain to a data protection authority. We would be grateful for the chance to put things right first, but you do not have to contact us before you complain.

• Norway: Datatilsynet, www.datatilsynet.no
• Iceland: Persónuvernd, www.personuvernd.is