Privacy Policy

Who we are

Lilly is operated by Supertrained Inc. We are a United States company.

Privacy and support: team@supertrained.ai. That is a real inbox. We have not appointed a data protection officer.

What this policy covers

• The Lilly gardening app (Android private beta; iPhone waitlist).
• $27 ZIP-specific garden guides sold on this site, paid through Stripe. Supertrained Inc. is the merchant.
• This website, gardenwithlilly.com.

Advertising, when we run it, is aimed at people in the United States. The site is still reachable from elsewhere.

Information we collect

Website and waitlist

• Email address, and whether you asked for the Android beta or the iPhone waitlist.
• A short source tag on the form (which page you used), so we know which list to put you on.
• Server logs that hosting may keep for a short time (IP address, user agent, time) to run and secure the site.
• Your advertising choice in a cookie named lilly_consent, and a first-party visitor id cookie named lilly_vid so we can store that choice without an email. See Cookies.

$27 garden guides

• Checkout details Stripe needs to take payment (name, email, card or wallet handled by Stripe; we do not store full card numbers).
• Order details: which guide, amount, and any extras you add at checkout.
• Delivery email for the hosted guide, PDF, calendar file, and related files.

An adult buys the family guide. We do not ask for a child’s name or contact details at checkout.

Lilly app

• Account email and sign-in identifiers (including Sign in with Apple or Google Sign-in when you use those).
• Garden information you enter: spaces, plants, notes, care events, preferences.
• Optional location, if you grant it, so climate and weather-aware features can use where the garden actually is. You can decline location and use manual setup where the app offers it.
• If you use plant identify: the photo you submit for that request.
• If you use in-app chat: the question you type and the garden context needed to answer it.

Where production data lives

Production Lilly data lives in Supertrained’s US West backend (Supabase project lilly-native, region West US (North California), ref kwczpjshjekoymuecwce). Some development/beta builds may use a separate project. Waitlist and purchases on this website use the production backend.

Expo beta builds currently talk to a separate Supabase project. Do not assume a development build is writing to the production database.

How we use it

• Send the Android testing link or the iPhone “it’s ready” note.
• Take payment, deliver the guide files, and keep a record of the order.
• Create and run your Lilly account and garden.
• Answer support and privacy requests after we verify it’s you.
• Keep the site and app secure, and meet tax and legal duties.
• Measure advertising only when you have allowed advertising cookies, or, in California, until you opt out of sale/share. We do not load Google Ads tags before that.

Processors

These companies process personal information for us, to run Lilly and this site. We do not list vendors we do not use.

App features, when you use them

Sale, share, and advertising

We do not sell personal information for money.

Advertising measurement with Google (when enabled) can be “sharing” under the California CPRA. That is why this site has a Do not sell or share page, and why Google Ads tags load only after you accept advertising — or, for California, until you opt out.

We honor Global Privacy Control. The browser signal navigator.globalPrivacyControl is read in this site. The Sec-GPC request header is handled on the server.

Cookies

Essential: Stripe on buy pages, and the lilly_consent preference cookie. Advertising: Google Ads tags only after consent, or until a California opt-out. Details and a way to change the choice: Cookies.

Retention

• Waitlist addresses: until you ask us to remove you, or we close that list.
• Purchases: as long as we need them for delivery, tax, accounting, and fraud.
• App account and garden data: while the account is active; removed when you delete the account, subject to backups and any legal hold.
• Support and privacy-request mail: as long as we need it to handle the request and keep a record that we did.
• lilly_consent: 180 days, then the banner can ask again.

International transfers

We process personal information in the United States. Production Lilly data is in US West (North California). If you write to us from the EEA, UK, or Switzerland, your information is transferred to the US to provide the site, the guides, and the app.

We have not appointed an EU Article 27 representative.

GDPR rights

If the GDPR or UK GDPR applies to you, you can ask for access, correction, deletion, restriction, objection, and portability, and you can withdraw consent for advertising cookies. Use Your data or email team@supertrained.ai. We aim to respond within 30 days after we verify it’s you.

Lawful bases we rely on: contract (waitlist, paid guide, app account); legitimate interests (security, fraud, running a US website); consent (advertising cookies; optional app location and optional identify/chat features); legal obligation (tax and accounting).

You can complain to your local data-protection authority. We would rather fix the problem if you write to us first.

CPRA rights

If you are a California resident, you can ask for access, correction, deletion, and to opt out of sale or share. You can use an authorized agent. We will not discriminate against you for exercising these rights. Use Your data or Do not sell or share. California: 45 days after we verify it’s you, unless the law gives more time.

Categories we collect, depending on what you use: identifiers (email, account ids); commercial information (purchases); internet activity related to advertising measurement when that is enabled; geolocation (ZIP or optional app location); garden content you enter.

Children

Lilly and this site are not directed at children under 13. The $27 family guide is bought by an adult. We do not knowingly collect personal information from children under 13. If you think we have, email team@supertrained.ai and we will delete it.

Your choices

• Your data — access, correction, export, deletion, California opt-out.
• Do not sell or share — CPRA opt-out, including GPC.
• Cookies — change the advertising choice in this browser.
• App: delete the account in settings when that control is available, or ask us on Support.

Contact

team@supertrained.ai

We do not publish a phone number for these requests.

Changes

If this policy changes, we will update the effective date on this page. Material changes will be posted here before they apply.