SborGoIn short
- Records about people and orders belong to the farm: the farm is their operator, and SborGo processes them on the farm’s behalf.
- We do not sell data, show ads or embed advertising trackers. This website sets no cookies.
- Exporting your own data is always available. A farm can be deleted in the app, and the deletion can be cancelled within 30 days.
- We answer personal data requests within 15 days.
Sections: operator · who is responsible · purposes and legal bases · recipients · transfers abroad · retention · your rights · security
1. Operator and contacts
The SborGo service (the mobile app and the api.farmplatform.by server) helps farms record harvest intake, earnings and payouts, orders and deliveries. The service is provided by:
- Owner: Alexey Sergeevich Zabolotsky, an individual
- Email for requests: alexeyzabalotckibusiness@gmail.com
“We” means the party named above. Terms of use and invoice payment are in the terms of service.
2. Who is responsible
The farm is the operator of its people and orders data. The farm administrator decides whom to add, what to record and why. The farm is therefore the operator of the personal data of its foremen, couriers, pickers and order recipients, and we are an authorized person (processor) processing that data on the farm’s behalf and instructions (Article 7 of Law 99-Z). The instruction is part of the terms of service.
We are the operator of farm administrators’ account data, invoicing and payment reconciliation data, technical logs and diagnostics, and correspondence with us.
If you are a farm employee or an order recipient, please contact the farm first about your data. If you cannot reach the farm, write to us: we will forward your request to the farm and help fulfil it.
3. Purposes, data and legal bases
For each purpose we list the data needed and the legal basis. We do not rely on consent; if a farm needs consent for some processing, the farm obtains it.
3.1. We are the operator
Administrator account and running the service. Data: administrator email and name, login, password stored as a strong hash, farm name and code, sign-in sessions. Basis: contract — the terms of service accepted at registration (processing under a contract with the data subject, Article 6 of Law 99-Z).
Plans, invoices and payment reconciliation. Data: farm billing details, contact person name and email, invoices, payment records, invoice email log. Invoices are emailed to the farm administrator and paid by bank transfer; the app shows no invoices or prices and takes no payments, and we never receive card numbers. Basis: contract (Article 6 of Law 99-Z) and accounting obligations under legislative acts.
One-time free trial. Data: a SHA-256 hash of the administrator email and a farm marker. Basis: contract — the term that the trial is granted only once.
Security, support and crash diagnostics. Data: IP addresses, request times and results, server error logs, platform operator action audit. Automatic crash reporting from the app is not enabled. Basis: the operator’s duty to protect personal data (Article 17 of Law 99-Z) and the contract — the service cannot be kept working without it.
Requests to us. Data: sender address and message content. Basis: the duty to handle requests and data subject applications (Article 14 of Law 99-Z, legislation on citizens’ and legal entities’ appeals).
3.2. The farm is the operator, we are the processor
Work records. Data: names, logins and roles of foremen, couriers and pickers (they are not asked for email), password hashes, picker internal numbers and QR identifiers, picker phone if entered by the farm, shifts, intake weights, rates, earnings, payouts and reversals with author and reason. Basis is set by the farm; usually employment or civil-law relations with the worker (Article 6 of Law 99-Z).
Orders and delivery. Data: recipient name, phone and address, delivery coordinates entered manually, goods, amounts, customer payment mark, assigned courier and statuses. Basis is set by the farm; usually its contract with the buyer.
Offline work. Data: installation and operation identifiers, app version, operation times. Some work data is stored in a local database on the device until it is sent to the server.
4. Camera, location and device
With your permission, the camera reads a picker QR code. Camera frames are not uploaded or stored as photos. There is no facial recognition or biometric collection.
The service does not request device GPS location, contacts, microphone or advertising identifiers. Delivery coordinates entered manually are order data, not courier tracking.
5. Recipients
- Farm users within their role: administrators and foremen see data within their permissions, pickers only their own, couriers their assigned orders.
- Hosting provider — provides infrastructure for running the service and storing data.
- Mail delivery provider for invoices and notices — Resend: receives the recipient address and message content.
- Cloudflare R2 — private temporary storage of ZIP archives containing the data requested by the user for export.
- Google (Gmail) — the mailbox that receives requests sent to us.
- A map app when a courier taps “Open in maps”: it receives the order address and coordinates; its provider’s policy applies.
- The recipient of an export chosen by the user when sharing a file.
- Public authorities — only under a binding lawful request and to the extent necessary.
Providers processing data for us are engaged on terms that require them to keep it confidential and protect it at least as well as described in this policy. Data processed on a farm’s behalf is shared with these providers with the farm’s consent given in the terms. We make no other transfers, never sell data and never share it for advertising.
6. Transfers abroad
Data may be processed outside the Republic of Belarus when using hosting, object storage and email providers. Transfers abroad take place on the grounds provided by Article 9 of Law 99-Z.
Hosting and mail providers are international companies; their access to data and storage of emails may take place in states without adequate protection, such as the USA. Risks: you may lack equivalent rights and remedies there, and local authorities may access the data under local law. Such transfers take place where necessary to perform a contract with you (Article 9 of Law 99-Z) or on the instructions of the farm, which as operator determines their basis. We transfer only the data without which the service or correspondence cannot work.
7. Retention and backups
During export, the ZIP archive is temporarily placed in private storage provided by Cloudflare R2. The server deletes it when the download completes, fails or is cancelled. If the process crashes, a lifecycle rule schedules deletion of remaining objects once they are 1 day old. Incomplete uploads are also automatically aborted after 1 day.
Records are kept while the farm uses the service. After the administrator confirms farm deletion, sign-in closes; the administrator can cancel within 30 days. A nightly job then permanently deletes intake records, shifts, statements, payouts, orders, pickers and their QR codes, all farm user accounts, invites, subscription, invoices and the email log. An anonymized farm marker remains so the farm code is never reissued.
Accounting documents for paid invoices that we must keep by law are kept outside the service for the statutory periods.
After farm deletion, the hash of the administrator email (so the trial is not granted again) and the platform operator action audit (security and incident investigation) are kept. These records are retained while necessary to prevent repeat free trials and investigate security incidents. These records do not restore farm data.
Technical logs are retained while needed to diagnose errors and maintain service security. Correspondence is kept while needed to reply and for statutory periods.
Private database backups are used for disaster recovery and kept for no more than 30 days from the backup date; deleted records may remain in a backup until it expires. Backups are not used for ordinary work; after a restore, deletion requests are applied again. If creating a new backup temporarily fails, cleanup pauses to protect the last usable copy; we fix the failure and remove expired copies.
Disabling an employee account does not itself erase farm records.
8. Your rights and how to use them
Under Law 99-Z you can:
- withdraw consent where processing is based on it (Article 10);
- obtain information about processing of your data and require its correction if incomplete, outdated or inaccurate (Article 11);
- learn to whom your data was provided during the last year (Article 12);
- require us to stop processing and delete data where there is no basis for it (Article 13);
- complain to the National Personal Data Protection Center of the Republic of Belarus (cpd.by) and appeal its decision in court.
How to apply. Under the law, an application is submitted in writing or as an electronic document. It states your full name, residential address, date of birth, identification number (if it was used in processing), the substance of the request and your signature (Article 14 of Law 99-Z). For simple questions and account deletion an email to alexeyzabalotckibusiness@gmail.com or the deletion page is enough. Contact us at this email to arrange submission of a written application; an ordinary email does not replace a signed electronic document where required by law.
Response time. We provide information about processing within 5 working days and answer and fulfil other requests within 15 days of receipt, unless legislative acts provide otherwise. Any refusal is explained.
In the app. An administrator exports farm data and can delete the farm in “More → Farm data”. An employee sees their data and can ask for account deletion in “More → My data”. Pickers can export their own intake and payouts. Exporting your own data is available on every plan and under any restriction.
Earnings and payout records involve the rights of the farm and other people, so an employee request does not automatically erase statements: the farm decides as operator. If deletion is limited by law or others’ rights, we explain what is kept and why.
Do not send passwords, QR codes, bank details or identity documents: if needed, we will suggest a safe way to confirm it is really you.
9. Security
We use role- and farm-based access control, password hashing, encrypted transport (HTTPS), backups and audit of important actions. No system eliminates every risk. We report personal data protection breaches to the National Personal Data Protection Center as and when Law 99-Z requires, and notify the farm without delay of a breach affecting its data.
10. Policy changes
This policy describes current features. It is updated before any new data category or processing starts; material changes are emailed to farm administrators. The current version is always at farmplatform.by/en/privacy. The service is for farm work and is not intended for children.