Privacy Policy

1. Information we collect

Account and company information

This may include your name, email address, profile details, role, company membership, country or location, contact information, and join or approval activity.

Farm and business records

Information entered by you or your company may include pond and production-cycle records, stocking, feeding, inventory, water quality, sampling, mortality, treatments, laboratory reports, harvests, assets, suppliers, buyers, finance records, marketplace listings, and team activity. Some records may identify employees, contractors, customers, or business contacts.

Orson AI information

We process the questions, prompts, files, feedback, and authorised farm context used to provide Orson AI chats, report extraction, risk insights, and harvest projections.

Subscription and payment information

We may receive your selected plan, billing period, company name, order identifier, amount, payment status, payment method category, and transaction timestamps. Midtrans processes the checkout and payment credentials. Shrimply does not ask you to send us passwords, one-time codes, or full card details.

Technical and usage information

We and our providers may collect IP address, browser and device details, operating system, app version, installation identifiers, notification tokens, pages viewed, clicks, referring pages, timestamps, crash or performance information, security events, and similar logs.

How information is collected

We collect information directly from you, automatically when you use the service, from authorised company members, and from providers involved in authentication, hosting, payments, support, analytics, and app distribution.

2. How we use information

• Provide, maintain, personalise, and improve Shrimply.
• Authenticate users and enforce company ownership, role, and access controls.
• Sync farm records and generate dashboards, reports, alerts, and projections.
• Manage subscriptions, confirm payment status, and provide billing support.
• Operate Orson AI using the authorised context needed for each request.
• Send service, security, approval, and account communications.
• Detect abuse, investigate incidents, troubleshoot errors, and protect the platform.
• Measure website and product use, including page views and download interactions.
• Comply with law, resolve disputes, and enforce our agreements.

3. Orson AI and automated processing

When you use Orson AI, Shrimply may send your prompt and relevant authorised farm records to Google’s Gemini services to generate a response. Uploaded laboratory reports may also be processed to extract or summarise information.

Orson is designed to help users connect patterns across pond history, growth, feeding, water quality, and other farm records. Its output supports human decisions and may be incomplete or incorrect. Shrimply does not use Orson output by itself to determine a person’s employment, credit, legal rights, or access to a company.

Only submit information that you and your company are authorised to use. Avoid including unnecessary personal or sensitive information in prompts and files.

4. When information is shared

We may disclose information only as reasonably needed in these circumstances:

• Within your company: to owners, managers, technicians, and other authorised members according to role permissions.
• At your direction: when you publish a marketplace listing or public company profile, invite a member, share a report, or otherwise choose to disclose information.
• Service providers: Google Firebase for authentication, databases, storage, cloud functions, notifications, and app integrity; Google Gemini for Orson AI; Vercel for website hosting; Midtrans for subscription payments; Meta business tools for website analytics and advertising measurement; and Google Play for Android distribution.
• Legal and safety reasons: where required by law or reasonably necessary to protect users, Shrimply, or the public.
• Business changes: in connection with a merger, financing, acquisition, reorganisation, or sale, subject to appropriate safeguards.

Each third-party provider handles information under its own terms and privacy notice. You can review the official notices for Firebase, Midtrans, and Vercel.

5. Storage and international processing

Shrimply uses cloud providers that may process information in Australia, Indonesia, the United States, and other locations where they or their subprocessors operate. For example, Firebase Authentication is operated from the United States, while other Firebase services may use global Google infrastructure.

We use local storage and session storage for features such as authentication persistence, language and currency preferences, and temporary Orson chat context. Meta Pixel may receive website interaction and device information after the site loads. Browser or device settings may let you limit storage and advertising tracking, although some service features may then work differently.

6. Retention and deletion

We retain information while an account or company is active and for as long as reasonably needed to provide the service, protect security, maintain backups, resolve disputes, and meet legal, tax, accounting, or payment obligations. Retention periods vary by record type and context.

Company owners can start a company-deletion request from company settings. Where a company has multiple owners or co-owners, all required approvers must agree before permanent company deletion. To request access, correction, or deletion of personal information that cannot be managed in the product, email us using the contact details below.

Deletion may not be immediate for encrypted backups, security logs, de-identified information, or records we must keep by law. We will isolate or remove such information when the applicable retention period ends.

7. Security

We use technical and organisational safeguards designed to protect information, including authentication, company-scoped access controls, role permissions, Firebase security rules, App Check, encrypted network connections, and restricted administrative access. No system is completely secure, so please use a strong password, protect your device, and contact us if you suspect unauthorised access.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing; withdraw consent; receive a portable copy; or complain to a privacy regulator. These rights may be limited where another person’s rights, company ownership, security, or legal obligations apply.

You can update some details in Shrimply. For other requests, email us with enough information to identify your account and request. We may verify your identity and authority before acting. We aim to respond within the period required by applicable law.

Shrimply is built for business and farm operations and is not directed to children. If you believe a child has provided personal information without appropriate authorisation, please contact us.

9. Changes to this policy

We may update this policy as Shrimply, our providers, or applicable requirements change. We will post the revised policy here, update the date above, and provide additional notice where a change materially affects how we handle personal information.