Privacy Policy
Last updated: 5 September 2026
HavAcrop Farms Private Limited ("Havacrop," "we," "us," or "our") operates havacrop.com and its associated brand Locaroots (together, the "Site"). This Privacy Policy explains what personal information we collect through the Site, how we use it, who we share it with, and the choices and rights available to you. By using the Site, you agree to the practices described in this Policy.
Who We Are
Havacrop is an Urban Food Infrastructure company that designs, builds, and operates urban farm infrastructure for developers, institutions, government bodies, and communities. Locaroots is Havacrop's consumer-facing brand, connecting the farms, produce, and communities Havacrop's infrastructure supports.
This Policy applies to any information collected through havacrop.com, including pages operated under the Locaroots brand.
Information We Collect
Information You Provide Directly
When you submit a Farm Conversation or General Inquiry form on the Site, we collect the information you choose to enter, which may include: your name, organization or project name, city, email address, phone number, the type of site or nature of your inquiry, a site location or address (if you use the optional map-based location field), and any message or details you provide.
Information Collected Automatically
Like most websites, our servers and hosting provider (Vercel) automatically log standard technical information when you visit the Site, such as your IP address, browser type, device type, and pages visited. We use this information only for security, diagnostics, and understanding overall Site usage — not to identify individual visitors.
When Analytics is permitted, Google Analytics and Microsoft Clarity collect pseudonymous technical and interaction information used to measure visits and improve Site usability. The Site does not activate Meta Pixel, LinkedIn Insight Tag, or other advertising and marketing technologies. The analytics providers and visitor controls are described in the supplementary sections below and in the Cookie Policy.
Information From Third-Party Services
If you use the Site Location field on our Farm Conversation form, your search queries and selected location are processed by Google Maps/Places (operated by Google LLC) to provide address suggestions and map display. Google's own privacy policy governs how Google itself handles this data; we only receive and store the address and coordinates you confirm.
How We Use Your Information
We do not use the information you submit through our forms for unrelated marketing without your consent, and we do not sell your personal information to any third party.
- To respond to your inquiry and have a conversation about your project, partnership, or question.
- To route your inquiry internally to the right team at Havacrop or Locaroots.
- To improve the Site, our forms, and our communications with visitors.
- To meet legal, accounting, or regulatory obligations.
- To protect the security and integrity of the Site.
How We Share Your Information
We do not sell your personal information. We share it only in the following circumstances:
- With service providers who help us operate, secure, and understand the Site and respond to inquiries — including Vercel (hosting), Sanity (content management, which does not receive form submissions), Google (Maps/Places and Analytics), Microsoft (Clarity), Cloudflare (Turnstile form protection), Upstash (temporary verification and rate-limit records), and Resend (transactional email delivery). Each provider processes data only as needed to provide its service to us.
- If required by law, regulation, legal process, or governmental request.
- To protect the rights, property, or safety of Havacrop, our visitors, or the public, where permitted by law.
- In connection with a merger, acquisition, financing, or sale of assets, in which case this Policy would continue to apply to your information.
Cookies and Tracking Technologies
The Site uses strictly necessary cookies or similar storage required to operate requested functionality and protect the inquiry forms. It also uses Google Analytics and Microsoft Clarity when Analytics is permitted under the regional and visitor-choice rules described below. Advertising and marketing technologies are not active. You can review or change optional Analytics through Cookie Preferences.
Data Retention
We retain the information you submit through our forms for as long as reasonably necessary to respond to your inquiry, maintain a record of the conversation, and meet our legal and accounting obligations. You may request that we delete your information earlier, as described in "Your Rights" below.
Data Security
We use reasonable administrative and technical safeguards designed to protect the information you share with us, including encrypted (HTTPS) transmission of all data submitted through the Site. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
To the fullest extent permitted by applicable law, Havacrop's financial liability in the event of a data breach, unauthorized access, or other security incident is limited as described in the "No Liability for Data Breach or Security Incidents" section of our Terms & Conditions. Havacrop will meet any breach-notification or other obligation mandated under applicable law, including India's Digital Personal Data Protection Act, 2023, which cannot be limited by this Policy.
Your Rights
Depending on your location and applicable law (including India's Digital Personal Data Protection Act, 2023), you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate or incomplete information.
- Request erasure of your information, subject to our legitimate need to retain records.
- Withdraw any consent you've given, without affecting the lawfulness of processing before withdrawal.
- Register a grievance regarding how we've handled your information.
Children's Privacy
The Site is intended for businesses, institutions, and adults evaluating urban farm projects, partnerships, or related inquiries. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.
International Data Transfers
Some of our service providers (including Google, Microsoft, Cloudflare, Upstash, Resend, and Vercel) may process or store data on servers located outside India. Where this occurs, we rely on those providers' safeguards and contractual commitments to protect your information consistent with applicable law.
Third-Party Links
The Site may link to third-party websites, including LinkedIn and Locaroots-related channels. We are not responsible for the privacy practices of any third-party site, and we encourage you to review their policies directly.
Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, the Site, or applicable law. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this page periodically.
Contact Us and Grievance Officer
If you have questions about this Policy, or wish to exercise any of the rights described above, please contact us at:
- Email: contact@havacrop.com
- Grievance Officer: Havacrop Compliance Team
- Address: HavAcrop Farms Private Limited, Mumbai, Maharashtra, India
Governing Law
This Policy is governed by the laws of India. Any disputes arising from this Policy will be subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra.
Cookies, Google Address Search, and Your Choices
The Site uses necessary technologies to operate, remember your cookie preference, protect its inquiry forms, and provide functionality you explicitly request. It also uses Google Analytics and Microsoft Clarity as optional analytics technologies to understand aggregate website use and improve usability. Havacrop does not currently activate advertising or marketing technologies.
When you use the Site Location field or location-pin tool, Google Maps/Places processes the address or location information you enter or select, together with technical information needed to provide the service. Havacrop treats this processing as necessary to provide the address-search and location feature you have requested. A Farm Conversation site location must be confirmed through a Google address suggestion, your current location, or the map pin; you can contact Havacrop by email instead if you do not want to use this feature.
We store your cookie preference for one year. Visitors in the European Economic Area, United Kingdom, Switzerland, Brazil, and any location that cannot be determined reliably must actively allow Analytics before Google Analytics or Microsoft Clarity loads. Elsewhere, Analytics may be enabled on arrival where permitted, but you can disable it at any time through Cookie Preferences. A browser Global Privacy Control signal is treated as an Analytics opt-out. Havacrop does not use Analytics to activate advertising or personalized marketing.
Contact Form Verification and Security
The inquiry forms may require a six-digit email verification code before submission. When email verification is enabled and you request a code, or whenever you submit an inquiry, Cloudflare Turnstile processes security signals such as your IP address, browser or device information, and the site origin to distinguish legitimate visitors from automated traffic. Turnstile does not receive the content you type into the inquiry form. Havacrop treats this processing as necessary to protect the forms and the people who use them.
Resend processes your email address to deliver any email verification code requested and the inquiry emails. Upstash Redis temporarily stores keyed inquiry rate-limit counters for 24 hours. When email OTP verification is enabled, it also stores the verification-code hash for 10 minutes and code-request counters for one hour. A successful email-verification token is signed, bound to the email, form type, and form session, and expires after 30 minutes. Havacrop does not store the plaintext verification code in Redis. When email OTP verification is disabled, email format and domain checks continue to apply, together with the other form-security controls described here.