Privacy Policy

1. Who we are

Katina Trava is a botanical studio and digital herbarium: an educational website about plants, their traditions and their place in modern naturopathy. The project is run by its founder, Katya. In this policy, “we”, “us” and “our” refer to Katina Trava as the operator of this website.

We respect your privacy and keep the data we collect to the minimum needed to run the website. This policy explains what we collect, why, and the choices you have.

2. What data we collect

Account data. When you create an account we collect:

• your e-mail address;
• your name, if you choose to provide it;
• your password, which is stored only in hashed form — we never see or store the password itself;
• if you sign in with Google: your Google account identifier, e-mail address and name, as provided to us by Google.

Favourites. The herbs you save to your favourites are linked to your account so that you can find them again.

Herbal Information Assistant. The questions you type into the assistant, together with the recent conversation history needed to understand your question, are sent to our server and then to the AI provider described in section 5 to generate an answer. We do not save your conversations in our database. Your chat history is kept only in your own browser (local storage) so that it is still there when you return, and you can clear it at any time by clearing your browser data.

Technical data. Like most websites, our server may record basic technical information such as your IP address, browser type, the pages you request and the time of the request. We use this only to keep the website secure and to fix problems.

We do not use advertising trackers, analytics services or social-media pixels on this website.

3. Cookies and local storage

We use a single strictly necessary cookie, herb_token, to keep you signed in. It is set only when you log in, is not accessible to scripts, and expires after 30 days or when you log out. We do not use advertising, tracking or analytics cookies, so no cookie consent banner is needed.

The Herbal Information Assistant stores your conversation history in your browser's local storage, as described above. This data never leaves your device unless you send a new message.

4. How and why we use your data

• to create and maintain your account and let you sign in;
• to remember your favourite herbs;
• to answer the questions you ask the Herbal Information Assistant;
• to keep the website secure, prevent abuse and fix technical problems;
• to reply to you when you contact us.

We do not sell your personal data, we do not share it with advertisers, and we do not use it for profiling or automated decision-making about you. We do not send marketing e-mails.

Where data protection law requires a legal basis, we rely on the performance of our agreement with you (providing your account and the services you request), on our legitimate interest in running a secure and reliable website, and, where applicable, on your consent.

5. Service providers and third parties

We share data only with the providers we need to run the website:

• OpenAI — the questions you ask the Herbal Information Assistant (and the recent conversation history) are processed by OpenAI's API to generate an answer. We do not send your name, e-mail address or account details with your question. According to OpenAI's API policies, data sent through the API is not used to train its models.
• Google — if you choose “Continue with Google”, Google handles the sign-in and shares your basic profile data (identifier, e-mail, name) with us. Google's own privacy policy applies to that process.
• Hosting — the website and its database run on a server located in the European Union (Finland).

Our website contains links to external services such as Instagram and Telegram. These services have their own privacy policies, and we are not responsible for how they handle your data.

6. How long we keep your data

We keep your account data and favourites for as long as your account exists. If you ask us to delete your account, we remove your account data and favourites from our database. Technical server logs are kept only for a short period needed for security and troubleshooting.

7. Your rights

Depending on where you live, you may have the right to:

• ask what personal data we hold about you and receive a copy of it;
• ask us to correct inaccurate data;
• ask us to delete your account and the data linked to it;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us using the details in section 11. We will respond within a reasonable time and in any case within the period required by law.

8. Security

The website is served over an encrypted connection (HTTPS). Passwords are stored only as salted hashes, and the sign-in cookie is protected against access by scripts. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data and keep access to it limited.

9. Children

This website is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time, for example when we add new features. The date at the top of the page shows when it was last changed. Significant changes will be announced on the website.

11. Contact

If you have questions about this policy or want to exercise your rights, you can reach us through the contact channels listed on our About page.