Privacy Policy

Effective date: September 14, 2026 · Operational clarification: October 18, 2026 · Document version: privacy_v2_2026_09_14

This Privacy Policy describes how H.C. Schmieding Produce Company, LLC ("Schmieding," "we," "us," or "our") processes information in connection with Schmieding Farm Compliance (the "Service"). Schmieding Farm Compliance is a business compliance platform created by H.C. Schmieding Produce Company, LLC in 2026.

The Service includes the public website, customer portal, farm portal, storage warehouse portal, admin portal, and the mobile Field App used by farm and storage warehouse accounts. When you accept this Policy at activation or later in the product, we record that acceptance against your user account and, where applicable, your organization.

Who we are

The Service is operated by H.C. Schmieding Produce Company, LLC, 2330 N. Thompson St, Springdale, AR 72764-1709. For privacy questions, email support@schmiedingfarmcompliance.com or call 800-643-3604.

Account types this Policy covers

• Customer accounts — buyer organizations using the customer portal to view network status, report packets, and related compliance records. Customers do not enroll in the farm or warehouse SMS program unless separately agreed.
• Farm accounts — grower organizations using the farm portal and Field App to submit field reports, certifications, and site records.
• Storage warehouse accounts — warehouse organizations using the same portal and Field App, scoped to storage sites rather than field production.
• Schmieding administrators — personnel who provision accounts and review submissions.
• Public visitors — people who use contact or application forms on the website.

Information we process

Depending on your role and how you use the Service, we may process:

• Account information such as name, email address, organization name, role (customer, farm, or storage warehouse), account identifiers, and authentication credentials.
• Contact information such as business phone numbers used for account security, mobile access, and transactional notifications you opt into.
• Organization and site information needed to provision access, including farm locations or warehouse sites, commodities, and related operational details.
• Compliance reports and documents submitted through the website or Field App (for example field or warehouse reports, photographs, audits, GAP certificates, and supporting evidence).
• Network and quality-related business records associated with connected customers, growers, and warehouses, including records generated in the ordinary course of produce transactions.
• Device and security information such as enrolled mobile numbers, device binding or activation status, multi-factor authentication status for administrators, legal-acknowledgment records, SMS consent records, security event logs, and IP or browser metadata captured at consent.
• Usage information such as application interaction logs, diagnostic data, and technical metadata needed to operate and secure the Service.

How we use information

Where enabled, location permission provides site or report location context. Device-unlock authentication is handled by your operating system; we do not receive fingerprint or face templates. Operational data may also come from authorized order systems and plant-receiving records shared with us. Timeline labels reflect recorded events and available evidence, not continuous vehicle GPS tracking.

We use information to:

• Operate customer, farm, and storage warehouse portals, the admin portal, and the Field App.
• Authenticate users, verify phone possession, and protect accounts.
• Enable compliance reporting, document workflows, and related business operations between Schmieding, growers, warehouses, and customers.
• Record and retain per-account acknowledgments of this Privacy Policy, the Terms, and, for farm and warehouse users who enroll, SMS program language.
• Send one-time verification messages and, where separately consented, recurring transactional SMS notifications to farm and storage warehouse users.
• Provide support, investigate misuse, and maintain the security and integrity of the Service.
• Meet legal, audit, food-safety, and recordkeeping requirements.

How we share information

We share information only as needed to operate the Service and our produce business. That includes:

• Connected organizations — for example, a customer may see report packets and compliance status for farms or warehouses linked to them in the network.
• Service providers that host or process data on our behalf, as described below.
• Legal and safety disclosures when required by law, to protect rights and security, or in connection with a corporate transaction involving Schmieding.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not share SMS opt-in data or consent records with third parties for their marketing or promotional use.

Service providers

We use selected service providers to host and operate the Service. These currently include Google Cloud / Firebase (application hosting, authentication, databases, storage, and related cloud services), Microsoft (email and productivity tooling used in operations), and Twilio (SMS verification and transactional messaging for farm and warehouse accounts). Providers process information only as needed to deliver their services to us. Processing is primarily in the United States.

SMS messaging and consent

Farm and storage warehouse accounts may enroll a business phone for one-time verification codes and, separately, for optional recurring transactional SMS. Phone numbers and consent records are stored per user account and associated organization for compliance and dispute resolution. Customer portal accounts are not enrolled in this SMS program unless a separate written agreement says otherwise.

• Message frequency varies.
• Message and data rates may apply.
• Reply STOP to opt out of recurring notification messages.
• Reply HELP for assistance.
• One-time authentication messages (including Twilio Verify codes) are managed separately from recurring notification consent.
• Communications providers such as Twilio may process data only as necessary to provide the communication service.

Public documentation of enrollment consent language is available on the SMS Enrollment and Consent page.

Cookies and similar technologies

The Service uses cookies and similar technologies as needed to keep you signed in, remember display preferences such as light or dark theme, and protect the Service. We do not use the public website for third-party advertising networks.

Security

We apply administrative, technical, and organizational measures designed to protect information, including access controls, authenticated sessions, role-based portal authorization, and security logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Retention

We limit retention by record type and purpose. Our approved schedule below separates your personal login from shared business and compliance records. These are operational retention rules, not a claim that every record is legally required for seven years. Applicable law and documented legal holds may change the handling of particular records.

• Sealed Load Quality reports and matched Plant Quality evidence: seven calendar years from the original report submission. Month and year views do not reset that clock.
• Confirmed cancellation history: seven years from receipt. Unmatched plant-source files: 30 days under the unmatched-source policy.
• Consent and legal-acknowledgment evidence: a seven-year retention target. Security logs: a one-year retention target. Original record dates govern; approval, re-import, or retry does not create a new retention period.

Backup copies, mailbox records, and messaging-provider records have separate retention cycles. Their deletion and restoration safeguards must be verified before personal-account cleanup is marked complete; we do not represent unverified provider deletion as completed. Holds restrict routine disposal until released. When retained copies are no longer needed, they are deleted or de-identified under the applicable process. Recorded deletion instructions must be reapplied when backups are restored.

Your choices

Account holders may update certain profile information through the portals where available. Any activated individual user, including the primary user or a staff user, may request deletion of their own login in the signed-in portal or app. The request is reviewed and processed by an SFC master administrator. Submitting it does not erase data or immediately end access; it may be withdrawn before approval. Approval ends that user's website and enrolled mobile access, not the organization or other users' accounts. For access, correction, or deletion requests outside the app, or if you cannot sign in, email support@schmiedingfarmcompliance.com. Field App users can start deletion from Profile → Delete account, or use Account deletion. Recurring SMS notification consent may be withdrawn by replying STOP where supported. Withdrawal of SMS notifications does not close the underlying farm or storage warehouse account.

If a U.S. state privacy law applies to you, including California, you may contact us at the same address to request access, correction, deletion, or a copy of personal information, subject to legal and recordkeeping exceptions that apply to a food-safety and commercial compliance platform. We will not discriminate against you for exercising those rights.

Confirmed account deletion blocks authenticated access while eligible personal data is removed. Other registered accounts remain intact. Shared reports, consent evidence, security records, processor records and backups are retained only where a documented purpose and retention period apply, including any specific legal hold. Retained data does not keep a deleted account active. We delete or de-identify records when that period expires, and reapply deletion instructions if backups are restored. Local app data is cleared when a device detects confirmed deletion; an offline device cannot be remotely cleared immediately. Previously exported copies cannot be recalled.

Children

The Service is a business platform for authorized adult personnel. It is not directed to children under 18, and we do not knowingly collect personal information from children.

Changes to this Policy

We may update this Policy as the Service evolves. The effective date and document version above identify the current text. Material changes will be reflected on this page. Continued use of the Service after an update, or a new in-product acknowledgment, constitutes acceptance of the revised Policy where permitted by law.

Contact

Privacy contact: support@schmiedingfarmcompliance.com

Related documents: Terms and Conditions · SMS Enrollment and Consent