Privacy

Privacy Policy

For the LWV GCU app, GCU Cloud and the GCU Manager.

Effective November 11, 2026

1. What this policy covers

Legacy West Ventures Inc., a California corporation (“LWV”, “we”, “us”), makes the GCU, a greenhouse control unit, and the software that works with it. This policy covers:

• LWV GCU, our app for Android and iPhone, which sets up and controls GCUs;
• GCU Cloud, our online service at gcu.legacywestventures.com;
• the GCU Manager, a server we install and run at a customer's site.

It explains what information each one collects, why, who else handles it, how long it is kept and how to delete it.

2. What we collect and why

Your account

When you create an account in the app, GCU Cloud keeps:

• your name and email address (your email address is also your username);
• your farm or company name, if you give one;
• your password, stored only as a salted one-way hash, never as the password itself;
• your phone's time zone at sign-up, which becomes your site's time zone;
• if you turn on two-step sign-in, the secret your authenticator app uses;
• your role on the site, when the account was made and when you last signed in.

We use these to sign you in, to show times in your time zone, and to email you invitations, password resets and the alerts you set up.

A GCU Manager login is created by the site's administrator. It holds a username, name, email address and password hash, and is kept on that GCU Manager.

Your site

Your site is the farm or facility your GCUs belong to. For it we keep its name and time zone and, if you enter them, the company name, the site address, a postal code for weather and the names of your pods. We use them to label your pods and show the right times. With the GCU Cloud subscription, the address or postal code is also used to show the outdoor weather (section 5).

What your GCU reports

Once a GCU is connected to the internet, it reports to GCU Cloud, or to your site's GCU Manager:

• sensor readings, such as temperature, humidity, CO₂, light and leaf wetness;
• what each output is doing, and its settings, schedules, automation rules and grow program;
• its alert rules, including the email addresses its alerts go to;
• its firmware version, the name of the WiFi network it uses (never the WiFi password), its address on your local network and its WiFi signal strength.

We use this to show, chart and control your rooms, to send alerts, to keep the GCU's firmware up to date and to help you when you contact support. A GCU reports the same way on the Bluetooth plan, so we can keep its firmware up to date and see that it is healthy. A GCU without WiFi sends nothing to our servers: the app talks to it over Bluetooth.

What you add

• Crop records: cultivar, plant count, dates, stages, harvest weights and notes.
• Photos you add to a pod's album, with your note, when the photo was taken and who added it.
• Grow programs you save.
• Your answers to “Was this useful?” on photo notes and insights.

Activity and security records

We keep a log of sign-ins, account changes and the changes people make to GCUs: who changed what, and when. For sign-ups and failed sign-ins it includes the internet (IP) address the request came from. We use this log to protect accounts and so your team can see who changed what. When an account is deleted, its name, email address and IP address are removed from this log; the record of what happened, and when, stays.

On your phone

The app keeps a few things on the phone itself: which server you use, your sign-in, a copy of your site and its units so the app works with no internet, the GCUs paired with this phone, the passwords the app set on your GCUs (in the phone's secure storage), and photos waiting to upload. Deleting the app removes them.

What we do not collect

We do not collect your location, contacts, messages, browsing history, payment card details or advertising identifiers. The app contains no analytics, crash-reporting or advertising tools, does not use the microphone and does not send push notifications.

3. Bluetooth, location, camera and your network

Bluetooth

The app uses Bluetooth only to find GCUs near you and talk to them: to pair using the PIN printed on the GCU's label, to set up its WiFi and its GCU Cloud connection, to read it and to change its settings. The WiFi password you type goes from the app to your GCU over the encrypted Bluetooth link, and nowhere else.

Location

The app does not read your location. Android 11 and older require the Location permission before any app can scan for Bluetooth devices, so on those phones the app asks for it for that reason only; it does not read or store where you are. On Android 12 and later, and on iPhone, the app does not ask for location. The site address in section 2 is only what you type.

Camera and photos

The app opens the camera or your photo library only when you choose to add a photo, and you pick one photo at a time. It asks the phone for the picture only, not details such as where it was taken, saves it at upload size and sends it to the pod's album. It does not look at the rest of your photo library.

Your local network

When your phone and a GCU are on the same WiFi, the app can talk to the GCU directly. That traffic stays on your own network and does not reach our servers. It is not encrypted, so use it on a network you trust. Bluetooth and the connections to GCU Cloud and the GCU Manager are always encrypted.

4. AI features

Some GCU Cloud and GCU Manager features use AI models from OpenAI:

• Help assistant: the question you type, with a summary of your site's GCUs and their current readings.
• AI Insights: each night, a summary of each room's readings, how its equipment ran and its grow program.
• Photo analysis: a photo, earlier photos of the same spot, your note and the room's conditions since the last photo.

Photo analysis and AI Insights run only on sites where they are turned on. On GCU Cloud, none of these features runs on the Bluetooth plan. We send OpenAI what each feature needs, never your password or your email address. GCU Cloud also asks OpenAI not to store it. OpenAI does not use what is sent through its API to train its models. The AI only writes notes and answers: it cannot change a setting or switch anything on or off.

5. Who else handles your information

These companies handle your information so that we can provide the service:

Your GCU also gets the time from public time servers and downloads firmware updates from GitHub. Neither receives your account details or what your GCU reports.

If a site's administrator connects an outside system to its GCU Manager's data interface, that system can read the site's pods and readings. That is the site's choice.

We may also disclose information when the law requires us to.

6. No selling, no ads, no tracking

We do not sell or rent your information, and we do not share it for advertising. The app shows no ads, contains no advertising or analytics tools and does not track you across other apps or websites. On the web, GCU Cloud and the GCU Manager set one cookie, to keep you signed in.

7. Who can see your site's data

The people on your site see its data according to their role: viewer, operator or admin. LWV staff can see every site, so we can set up units, answer support questions and keep the service running.

8. How long we keep it

• Sensor readings: up to five years, then deleted automatically.
• Your account, your site, photos, crop records, settings and the activity log: for as long as your account and site exist, unless you or your site's administrator delete them sooner.
• A GCU that moves to another site: none of the old site's readings, photos or crop records go with it. They are deleted from that GCU's record.
• Backups: deleted data can remain in our database backups until those backups expire on their regular schedule.

9. Deleting your account

You can delete your GCU Cloud account at any time, in either of two ways:

• In the app: Settings → Delete account.
• On the web: gcu.legacywestventures.com/delete-account.

What is deleted:

• Always: your login, that is your name, email address and password.
• If you are the only member of a site you created through the app's sign-up: that site as well, with its history of readings and its photos. Its GCUs are released, so they can be set up again by you or by a new owner.
• If your site has other members: the site and its records carry on for them. Only your login is removed, and your email address comes off the site's alert emails.
• Our security log: your name, email address and IP address are removed from it. The record of what happened, and when, stays.

You can also email support@legacywestventures.com and ask us to delete your account. A GCU Manager login is removed by the site's administrator, or by us on request.

To clear a GCU itself, use Factory reset in the app (Settings → This GCU). It erases the GCU's WiFi details, cloud login and settings. To clear your phone, delete the app.

10. Security

• The app talks to GCU Cloud and the GCU Manager only over HTTPS, and both websites use HTTPS. A GCU Manager is reached through our gateway and then over an encrypted tunnel to the site.
• Each GCU connects to GCU Cloud over an encrypted connection with its own login.
• Bluetooth uses secure pairing with the PIN printed on the GCU's label.
• Passwords are stored only as salted one-way hashes. Two-step sign-in with an authenticator app is available.
• Each site's data is kept separate from every other site's in our database.
• The passwords the app sets on your GCUs stay in your phone's secure storage.

11. Children

The LWV GCU app, GCU Cloud and the GCU Manager are business tools for growers. They are not directed at children, and we do not knowingly collect information from children under 13. If you believe a child has given us information, email support@legacywestventures.com and we will delete it.

12. Your choices

You can change your password and turn two-step sign-in on or off yourself. Your site's administrator can correct your name or email address, or you can ask us. Email support@legacywestventures.com to ask what we hold about you, to get a copy, or to have it corrected or deleted.

13. Changes to this policy

If we change this policy, we will post the new version on this page and update the effective date at the top.

14. Contact us