Privacy Policy — The Fresh Agent

1. INTRODUCTION

The Fresh Agent LLC ("The Fresh Agent," "we," "us," or "our") is committed to protecting the privacy and security of personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use our website at www.thefreshagent.co, our web and mobile applications, APIs, and all related services (collectively, the "Service" or "Platform"). This Policy applies to all users of our Service, including customers, subscribers, visitors, and Authorized Users, regardless of where you are located --- including users in the United States, Mexico, Canada, and the European Union. By using the Service, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with this Policy, please do not use the Service. This Privacy Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

2. DATA CONTROLLER / BUSINESS IDENTITY

The Fresh Agent LLC is the data controller (GDPR) and business (CCPA) responsible for processing your personal information under this Policy.

Company: The Fresh Agent LLC

Address: 463 W 17th St, Tucson, AZ 85701, United States

Privacy: privacy@thefreshagent.co

Legal: legal@thefreshagent.co

Website: www.thefreshagent.co

3. INFORMATION WE COLLECT

We collect information in three ways: information you provide directly, information collected automatically, and information from third parties.

3A. Information You Provide Directly

Account Registration: Name, business name, job title, email address, phone number, business address, and password when you create an Account.
Payment Information: Billing address, credit/debit card details, and bank account information (collected and processed by Stripe; we do not store full card numbers on our servers).
Profile Information: Business type, company size, produce categories of interest, operating regions, and other business profile information you choose to provide.
Customer Data: Any data, content, or information you upload, submit, or generate through the Platform in the course of using the Service.
Communications: Messages, emails, support requests, survey responses, and other communications you send to us.
Contract and Order Information: Information provided in connection with your subscription, Order Form, or enterprise agreement.

3B. Information Collected Automatically

Usage Data: Pages viewed, features used, searches performed, reports generated, time spent on the Platform, click patterns, and other interaction data.
Device and Technical Data: IP address, browser type and version, operating system, device type (desktop/mobile/tablet), screen resolution, language settings, and time zone.
Log Data: Server logs including access times, pages requested, referring URLs, and error logs.
Cookies and Similar Technologies: We use cookies, pixel tags, local storage, and similar technologies as described in Section 4.
Location Data: General location information derived from your IP address (country, state/province, city). We do not collect precise GPS location.
API Usage Data: API call logs, endpoints accessed, volume of requests, and error rates, if you use the Service's API.

3C. Information from Third Parties

Payment Processors: Stripe provides us with transaction confirmation, payment status, and limited payment method details (last 4 digits, card type, expiry).
App Stores: Apple App Store and Google Play Store provide us with subscription status, purchase confirmation, and limited account information when you subscribe through an App Store.
Market Data Providers: We receive publicly available market pricing data, produce availability data, and related information from the USDA Agricultural Marketing Service (AMS) and other government and public data sources. This data is freely available from its original sources (including marketnews.usda.gov). The Platform serves as a visualization and analytics tool that organizes and presents this public data in a user-friendly format. This data is used to power the Platform's analytics features, not to identify individuals.
Authentication Providers: If you sign in using a third-party authentication service (e.g., Google, Apple Sign-In), we receive your name, email address, and authentication token from that provider.

4. COOKIES AND TRACKING TECHNOLOGIES

4.1 Types of Cookies We Use. We use the following categories of cookies and similar technologies:

Essential/Strictly Necessary Cookies: Required for the Platform to function. These enable authentication, session management, and security features. You cannot opt out of these without also disabling the Service.
Functional Cookies: Remember your preferences and settings (e.g., language, dashboard layout, saved filters) to provide a personalized experience.
Analytics Cookies: Help us understand how users interact with the Platform, which features are used most, and where improvements are needed. We may use tools such as Google Analytics, Mixpanel, or similar services. These cookies collect aggregated, anonymized data.
Performance Cookies: Monitor Platform performance, uptime, and technical errors.
Marketing Cookies: Used on our public website to measure the effectiveness of marketing campaigns. We do not use marketing cookies inside the authenticated Platform.

4.2 Cookie Control. You can control cookies through your browser settings. Disabling certain cookies may impair Platform functionality. Users in the EU/EEA and UK will be presented with a cookie consent banner before non-essential cookies are set. We are implementing a GDPR-compliant cookie consent manager.

4.2A. Cookie Consent Implementation Status

For users in the European Union, European Economic Area, and United Kingdom: The Fresh Agent is committed to implementing a GDPR-compliant cookie consent manager. Until full implementation:

A basic cookie consent banner is displayed to EU/EEA/UK users before non-essential cookies are set.
Users may deny all non-essential cookies and still access the Service, though functionality may be limited (analytics and performance monitoring will not function).
Consent is recorded and stored for at least 24 months per GDPR requirements.
Users may withdraw or modify cookie consent at any time by contacting privacy@thefreshagent.co.

Until full implementation, EU/EEA/UK users may email privacy@thefreshagent.co to request modifications to their cookie consent.

4.3 Do Not Track. We respect Do Not Track (DNT) browser signals for our public website. DNT signals are not currently implemented within the authenticated Platform environment, as users are logged in and tracking is necessary for service delivery.

4.4 Analytics Providers. Our analytics providers may set their own cookies. We contractually require such providers to protect your data and use it only for purposes of providing analytics services to us.

5. HOW WE USE YOUR INFORMATION

5.1 Service Delivery. We use your information to:

Create and manage your Account;
Provide, operate, and maintain the Platform;
Process payments and manage your subscription;
Authenticate your identity and protect account security;
Deliver market data, analytics, and reports through the Platform;
Respond to your support requests and communications;
Send transaction-related communications (receipts, subscription renewals, payment confirmations).

5.2 Service Improvement. We use your information to:

Analyze usage patterns to improve Platform features and performance;
Develop new features and products based on user behavior and feedback;
Conduct internal research and analytics;
Create anonymized, aggregated industry benchmarking data;
Monitor and resolve technical issues and bugs.

5.3 Communications. We use your information to:

Send service-related notifications (outages, updates, security alerts);
Send marketing communications about new features, products, or promotions (with your consent where required, and with an easy opt-out mechanism);
Conduct surveys and gather feedback about the Service;
Send renewal reminders and subscription management communications.

5.3A. Email Communications and CAN-SPAM Compliance

The Fresh Agent uses email to communicate with you regarding your Account, subscription, and the Service, as well as to send marketing communications about new features, special offers, and product updates.

Email Types

Transactional Emails (Not Opt-Out): Order confirmations, subscription renewals, password resets, billing notices, support responses, and service announcements. You cannot opt out while maintaining your Account.
Marketing Emails (Opt-Out Available): Promotional emails about new features, special offers, webinars, case studies, and product updates. You may opt out at any time.
Administrative Emails: Updates to terms, privacy policy changes, service maintenance notices, and compliance-related communications. You may not opt out, but can request reduced frequency.

CAN-SPAM Act Compliance

All commercial email sent by The Fresh Agent complies with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.) and includes:

Clear Identification as Advertisement: Marketing emails identified as advertisements or promotions (typically with "[PROMOTIONAL]" in subject line)
Accurate Header Information: "From," "To," "Reply-To," and routing information accurately identify The Fresh Agent
Physical Address: Each email includes The Fresh Agent's address: The Fresh Agent LLC, 463 W 17th St, Tucson, AZ 85701, United States
Opt-Out Mechanism: Every marketing email includes "Unsubscribe" or "Manage Preferences" link or reply instructions
Honoring Opt-Out Requests: All opt-out requests are honored within 10 business days. After opting out, you will not receive future marketing emails, though transactional and administrative emails will continue
No Fee for Opt-Out: Opting out is free. The Company does not require personal information beyond email address
One-Click Unsubscribe: Marketing emails include a "List-Unsubscribe" header for one-click unsubscribe support

Email Frequency and Preferences

You can manage your email preferences by logging into your Account and adjusting Email Settings → Notification Preferences, clicking "Manage Email Preferences" in any marketing email, or emailing support@thefreshagent.co. Preference Options: All emails, transactional and administrative only, essential emails only (billing and security), or no emails (if legally possible). Marketing Email Frequency: Approximately 2-4 per month on average, but frequency may vary seasonally or when major new features are released.

International Email Compliance

In addition to CAN-SPAM, The Fresh Agent complies with international email regulations:

GDPR (EU/EEA): Marketing emails sent only to users who have opted in (double opt-in per GDPR Article 7(4))
CASL (Canada): Marketing emails to Canadian residents comply with Canada's Anti-Spam Legislation
Mexico (LFPDPPP): Emails are subject to LFPDPPP consent and data processing requirements

Reporting Email Abuse

If you receive spam or unsolicited emails from The Fresh Agent, report it immediately to support@thefreshagent.co or abuse@thefreshagent.co. Include the full email header and details. We will investigate and take corrective action.

5.4 Legal and Compliance. We use your information to:

Comply with applicable laws, regulations, and legal obligations;
Respond to legal process, court orders, or government requests;
Enforce our Terms of Service and other agreements;
Detect, investigate, and prevent fraud, abuse, and security incidents;
Protect the rights, property, and safety of the Company, our users, and others.

5.5 Lawful Basis for Processing (GDPR). For users in the EU/EEA, we process personal data on the following lawful bases:

Contract Performance: Processing necessary to provide the Service under our Terms of Service (e.g., Account creation, billing, service delivery).
Legitimate Interests: Processing for our legitimate business interests, including fraud prevention, product improvement, and security, where these interests are not overridden by your rights.
Legal Obligation: Processing necessary to comply with applicable law.
Consent: For marketing communications and non-essential cookies, where we have obtained your explicit consent. You may withdraw consent at any time.

We do not sell your personal information to third parties. We share your information only in the following circumstances:

6A. Service Providers (Sub-Processors)

We share information with trusted third-party service providers that help us operate the Service. These providers are contractually bound to protect your data and use it only for specified purposes:

Payment Processing: Stripe, Inc. (stripe.com) --- processes payments on our behalf. Stripe's Privacy Policy governs their handling of payment data.
Cloud Infrastructure: DigitalOcean, LLC --- hosts and stores Platform data on servers located in the United States.
Analytics: Analytics service providers (e.g., Google Analytics, Mixpanel) --- help us understand Platform usage.
Email Communications: Email service providers (e.g., SendGrid, Mailchimp, or similar) --- send transactional and marketing emails.
Customer Support: Support tools and ticketing systems used to manage support requests.
Market Data: USDA AMS and licensed produce market data providers --- supply Third-Party Data displayed in the Platform.
App Stores: Apple App Store and Google Play --- manage app distribution and in-app subscription billing.

6B. Business Transfers

If The Fresh Agent LLC is involved in a merger, acquisition, sale of assets, financing, or corporate restructuring, your information may be transferred as part of that transaction. You will be notified via email and/or prominent notice on the Platform before your information is transferred and becomes subject to a different Privacy Policy.

6C. Legal Requirements

We may disclose your information when we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation, court order, or government request; (b) enforce our Terms of Service or protect Company rights; (c) protect the safety of any person; or (d) respond to a national security or law enforcement request. Where legally permitted, we will notify you of such requests.

6D. Aggregated and De-Identified Data

We may share anonymized, aggregated, de-identified information that cannot reasonably be used to identify you (e.g., industry pricing trends, platform usage statistics) with third parties for research, marketing, analytics, and other business purposes.

We may share your information with third parties when you explicitly consent to such sharing.

7. DATA RETENTION AND DELETION

7.1 Active Accounts. We retain your personal information for as long as your Account is active and as necessary to provide the Service.

7.2 After Account Closure — By Data Category

Customer Data (Business Intelligence / Market Data Queries): Retained for 30 days after closure during which you may export via email at support@thefreshagent.co. After 30 days, permanently deleted using secure deletion protocols. For GDPR users requesting data portability, export window extends to 90 days. Account Information & User Profile Data: Retained for up to 7 years after closure for tax compliance, accounting, fraud prevention, and legal dispute resolution. You may request earlier deletion by contacting privacy@thefreshagent.co. Payment Records: Retained for 7 years as required by IRS regulations (26 USC 6001) and state tax codes. Data includes transaction amount, date, last 4 digits of payment method, and billing address only. Communications & Support Tickets: Retained for up to 3 years after last communication for customer service quality assurance and dispute resolution. Anonymized, Aggregated, and De-Identified Data: Retained indefinitely. Data is considered "anonymized" when irreversibly de-identified through removal of all direct identifiers, aggregation to group level (n ≥ 5), or differential privacy techniques. Usage Logs & Derived Analytics: Retained for 12-24 months. After 12 months, logs are aggregated and de-identified. Machine learning models are retrained without your data within 60 days of account closure. Backups and Disaster Recovery: Backup copies may be retained for up to 90 days after deletion for disaster recovery purposes. After 90 days, all backup copies of deleted data are purged.

7.3 Legal Holds and Litigation

If The Fresh Agent is involved in litigation or regulatory investigation, we may retain information beyond standard retention periods as required by law. You will be notified where legally permitted.

7.4 Deletion Requests. Subject to legal retention obligations, you may

request deletion of your personal information as described in Section 10 (Your Rights).

8. DATA SECURITY

8.1 Security Measures. We implement commercially reasonable technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

Encryption in transit using TLS/HTTPS for all data transmitted to and from the Platform;
Encryption at rest for sensitive data stored in our systems;
Access controls and authentication requirements for all personnel accessing personal data;
Role-based access controls limiting employee access to only the data necessary for their job function;
Regular security reviews and vulnerability assessments;
Secure development practices including code review for security vulnerabilities;
Monitoring for unauthorized access attempts and anomalous activity.

8.2 No Absolute Security. Despite these measures, no security system is completely impenetrable. We cannot guarantee the absolute security of your information. In the event of a security breach, we will notify you as required by applicable law.

8.3 Your Responsibility. You are responsible for maintaining the security of your Account credentials and for any activity that occurs under your Account. Use a strong, unique password and do not share your credentials. 8.4 Data Breach Notification — State-Specific Requirements. In the event of a confirmed data breach involving personal information, we will notify affected individuals as required by applicable law. Notification timelines vary by jurisdiction:

GDPR (EU/EEA): Within 72 hours of discovery to the relevant Data Protection Authority, and without undue delay to affected data subjects.
California: Without unreasonable delay, as required by Civil Code § 1798.82.
Arizona: As required by A.R.S. § 18-552, without unreasonable delay but not to exceed 60 days.
Other U.S. States: Without unreasonable delay and in accordance with applicable state law.
Canada: Notification required as soon as feasible for breaches likely to cause significant harm.
Mexico: Without unreasonable delay to the data holder and, in cases of high risk, to INAI.

Breach notifications will include: (a) the nature of the breach; (b) the categories of personal information affected; (c) the approximate number of individuals affected; (d) the likely consequences of the breach; (e) the measures taken to address the breach; (f) contact information for our Privacy contact; and (g) resources available to affected individuals.

8.5 Payment Security. We do not store full credit card numbers. Payment card data is handled directly by Stripe, which maintains PCI DSS compliance. We store only the last four digits, card type, and expiration date for display purposes.

8.6 Artificial Intelligence and Automated Processing

Current AI/ML Implementation

The Fresh Agent currently uses the following AI and machine learning technologies:

Anomaly Detection: Automated monitoring systems that identify unusual account activity using statistical and ML-based anomaly detection.
Usage Analytics: Aggregated anonymized usage pattern analysis to identify popular features and areas for improvement. Uses only de-identified data.
Data Quality Monitoring: Automated validation to detect outliers or errors in USDA market data. Does not target individual users.
Email Classification: Basic text classification to categorize support tickets by topic for routing and prioritization.

No Personal Data Training

8.6 Artificial Intelligence and Automated Processing. We may use automated tools, including artificial intelligence and machine learning technologies, to analyze aggregated and de-identified usage patterns for the purpose of improving Platform features, detecting anomalies, and enhancing data quality. We do not use your personal information or Customer Data to train third-party AI models. If we introduce AI-powered features that process your personal data in new ways, we will update this Privacy Policy and notify you in accordance with Section 13.

8.7 Incident Response. We maintain a documented incident response plan that includes procedures for identifying, containing, investigating, and remediating security incidents. In the event of a confirmed data breach affecting your personal information, we will, where appropriate and as permitted by law, provide information about the nature of the incident and steps you can take to protect yourself.

9. INTERNATIONAL DATA TRANSFERS

9.1 Data Location. The Fresh Agent LLC is based in the United States. Your personal information is processed and stored on servers located in the United States.

9.2 EU/EEA Users. If you are located in the European Union or European Economic Area, your personal data will be transferred to the United States, which is not subject to an EU adequacy decision. We rely on the following transfer mechanisms to ensure an adequate level of protection:

Standard Contractual Clauses (SCCs): We use EU Commission-approved Standard Contractual Clauses in our agreements with service providers that receive personal data from EU/EEA residents.
Data Processing Addendum: Enterprise customers in the EU/EEA may request our GDPR-compliant Data Processing Addendum by contacting legal@thefreshagent.co.

9.3 Mexican Users. Transfer of personal data of Mexican residents to the United States is conducted in compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). You may contact us at privacy@thefreshagent.co to exercise your ARCO rights (Access, Rectification, Cancellation, Opposition) as provided under Mexican law.

9.4 Canadian Users. We handle personal data of Canadian residents in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. You may contact our Privacy contact to exercise your rights under PIPEDA.

9.5 UK Users. For users in the United Kingdom, we comply with the UK GDPR and Data Protection Act 2018. UK-to-US data transfers are conducted using the UK International Data Transfer Agreement (IDTA) or EU SCCs with a UK Addendum.

10. YOUR PRIVACY RIGHTS

Depending on where you are located, you may have the following rights with respect to your personal information. To exercise any of these rights, contact us at privacy@thefreshagent.co.

11A. COPPA COMPLIANCE (CHILDREN UNDER 13)

This Service is not directed to, and we do not knowingly collect personal information from, children under the age of 13 ("COPPA-Protected Children") as defined by the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq. If a parent or guardian believes a child under 13 has provided personal information to us, please contact us immediately at privacy@thefreshagent.co. Upon discovery that personal information from a COPPA-Protected Child has been collected without parental consent, we will delete such information promptly and at no cost. We do not condition a child's participation in online activities on the provision of more personal information than is reasonably necessary to participate in the activity.

10A. Rights for All Users

Right to Access: Request a copy of the personal information we hold about you.
Right to Correction: Request correction of inaccurate or incomplete personal information.
Right to Deletion: Request deletion of your personal information, subject to our legal retention obligations.
Right to Data Portability: Request your personal information in a structured, machine-readable format.
Right to Opt Out of Marketing: Unsubscribe from marketing emails at any time using the unsubscribe link in any email, or by contacting us. You will still receive service-related communications.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Right to Restrict Processing: Request that we restrict processing of your personal data in certain circumstances.
Right to Object: Object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Right Not to Be Subject to Automated Decision-Making: We do not make solely automated decisions that produce legal or similarly significant effects on you.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority (DPA) if you believe we have violated GDPR. We encourage you to contact us first so we can resolve the issue.

Response Time: We will respond to verifiable requests within thirty (30) days (or within the timeframe required by applicable law). For complex or numerous requests, we may extend this period by an additional thirty (30) days with notice.

10C. California Residents (CCPA/CPRA)

California residents have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: Request disclosure of: (a) categories of personal information collected; (b) categories of sources; (c) purposes for collection; (d) categories of third parties with whom we share information; (e) specific pieces of personal information collected.
Right to Delete: Request deletion of personal information we have collected, subject to exceptions.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. If this changes, we will provide a "Do Not Sell or Share My Personal Information" link.
Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted by CPRA.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a CCPA/CPRA request, contact us at privacy@thefreshagent.co or by mailing us at our address above. We will verify your identity before processing your request. Authorized agents may submit requests on your behalf with written authorization.

10D. Mexican Users (LFPDPPP --- ARCO Rights)

Mexican residents have ARCO rights under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares:

Access (Acceso): Request access to your personal data and how it is being processed.
Rectification (Rectificación): Request correction of inaccurate or incomplete data.
Cancellation (Cancelación): Request deletion of your personal data when it is no longer necessary or when consent is revoked.
Opposition (Oposición): Object to the processing of your personal data for specific purposes.

To exercise ARCO rights, contact us at privacy@thefreshagent.co. We will respond within 20 business days as required by Mexican law.

10E. Canadian Users (PIPEDA)

Canadian residents may access their personal information, request corrections, and withdraw consent to certain uses of personal information (subject to legal and contractual restrictions). Contact us at privacy@thefreshagent.co with PIPEDA requests. We will respond within 30 days.

11. CHILDREN'S PRIVACY

The Service is designed for and directed to business users and is not intended for use by persons under the age of 18. We do not knowingly collect personal information from persons under 18. If we become aware that we have collected personal information from a person under 18, we will delete such information promptly. If you are a parent or guardian and believe your child under 18 has provided personal information to us, please contact us immediately at privacy@thefreshagent.co.

12. THIRD-PARTY LINKS AND INTEGRATIONS

The Platform may contain links to third-party websites, data sources, or integrated services. This Privacy Policy applies only to The Fresh Agent Platform. We are not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policies of any third-party services you access through the Platform, including:

Stripe (payments): stripe.com/privacy
Apple App Store: apple.com/legal/privacy
Google Play: policies.google.com/privacy
USDA Agricultural Marketing Service: ams.usda.gov

13. CHANGES TO THIS PRIVACY POLICY

13.1 Updates. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.

13.2 Notification. We will notify you of material changes by: (a) sending an email to your registered address; and/or (b) posting a prominent notice on the Platform, at least thirty (30) days before the changes take effect. For changes required by law, we may provide shorter notice.

13.3 Continued Use. Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree, you must discontinue use of the Service and may cancel your subscription.

13.4 Version History. The effective date at the top of this Policy indicates when it was last updated. We encourage you to review this Policy periodically.

The Fresh Agent LLC does not sell, rent, or share your personal information with third parties for their own marketing purposes or for cross-context behavioral advertising. If our practices change, we will update this Policy and provide appropriate opt-out mechanisms as required by applicable law.

15. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

The Fresh Agent LLC

463 W 17th St, Tucson, AZ 85701, United States

Privacy inquiries: privacy@thefreshagent.co

Legal inquiries: legal@thefreshagent.co

Website: www.thefreshagent.co

For GDPR-related inquiries from EU/EEA residents, you may also contact your local data protection authority (DPA). A list of EU DPAs is available at: edpb.europa.eu/about-edpb/board/members_en For LFPDPPP-related inquiries from Mexican residents, you may contact the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) at: inai.org.mx © 2026 The Fresh Agent LLC. All rights reserved. Effective Date: March 12, 2026 | www.thefreshagent.co