How HortiHub handles data from the public site and mobile app

This policy applies to HortiHub, including the public website, authenticated portal, and mobile application used in the platform commercial and operational routines.

HortiHub is a B2B platform designed for the relationship between suppliers, internal teams, and invited clients for orders, communications, and financial reconciliation.

The data processed depends on the user flow involved. In general, HortiHub may process:

• registration and identification data, such as name, email, phone number, user role, and account, client, or supplier identifiers;
• operational data, such as orders, commercial history, messages, notification preferences, and payables or receivables records;
• files uploaded by the user, including financial receipts, file name, content type, and size;
• technical data required for authentication, session handling, language preference, device identification, and notification delivery.

The app requests camera access only when the user chooses to take a photo of a payment receipt in the payables flow.

The same flow also allows the user to attach an existing file from the device. Uploaded images and files are used to register and reconcile financial credits linked to an open debit.

• the camera is not used in the background or for continuous capture;
• the uploaded receipt may be made available to the supplier responsible for reconciling that payment record;
• the user may deny or revoke camera permission in the device settings at any time.

When notifications are enabled, the app may register a push token and an installation identifier so that operational alerts and service communications can be delivered.

The public website may store a technical cookie to remember the selected language. In the app, session data, language choice, and some technical identifiers may be stored locally using platform-provided mechanisms.

• push delivery depends on operating system permission;
• if permission is denied or removed, the device registration may be canceled;
• local storage supports authenticated sessions, selected language, and the basic service experience.

Data handled by HortiHub may be used to authenticate users, keep sessions active, display orders, messages, and billing information, enable receipt uploads, and support financial reconciliation.

We may also use data for security, auditing, operational support, prevention of misuse, contractual performance, and compliance with legal or regulatory obligations.

Sharing only happens to the extent necessary to run the service and the contracted flows.

• with the supplier, client, or team linked to the same operational flow, including for orders, billing, messages, and uploaded receipts;
• with infrastructure, hosting, storage, notification, and technical support providers needed to operate HortiHub;
• with partners, integrations, or vendors related to billing, invoicing, or legal obligations, when applicable;
• with authorities or third parties when required by law, valid order, or legitimate defense of rights.

HortiHub uses authentication mechanisms, session tokens, role-based and scope-based access segregation, and secure on-device storage features when available.

No connected environment is completely risk-free. Users should also protect their credentials, keep their device under control, and avoid improper account sharing.

We keep data while the account and commercial relationship remain active and for as long as needed for support, auditing, security, contractual performance, and compliance with legal obligations.

Financial receipts may remain linked to operational history during the applicable retention period and may later be purged from storage after that period expires.

• local session data may be cleared when the user signs out, removes the app, or clears local storage;
• push tokens and technical identifiers may be removed when the device is unregistered or permission no longer exists;
• deletion, review, or anonymization requests depend on the type of data involved and the legal or contractual obligations in force.

Users may update registration data through available channels, change language, stop using the camera, disable notifications on the device, and request clarification about data processing.

Requests for correction, review, or deletion may require identity and contractual relationship validation before they are fulfilled.

HortiHub is intended for business operations and was not designed as a child-directed service.

This policy may be updated to reflect product changes, legal requirements, or operational adjustments. When that happens, the update date on this page will be revised.

For privacy questions, requests, or concerns, contact admin@hortihub.com.br.