Privacy Policy
Last updated: June 17, 2026
Who we are
Indoor Food Grower is operated by a private individual based in Cyprus.
Data controller: Stephan Kulik 111 Chlorakas Avenue, Shop 9, Suite 546, 8220 Chloraka, Paphos, Cyprus Email: contact@indoorfoodgrower.com
If you have any questions about how we handle your personal data, you can reach us at contact@indoorfoodgrower.com.
What data we collect and why
1. Analytics data (Google Analytics 4)
We use Google Analytics 4 (GA4) to understand how visitors use this site — which articles are read, how long readers stay, what devices they use, and how they navigate between pages. GA4 is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
What is collected: Pages visited, time on page, approximate geographic region (country/city level), device type, browser type, referring source, session duration, and similar aggregated usage metrics. GA4 uses a first-party cookie (_ga) and related cookies to distinguish unique visitors across sessions. IP addresses are anonymized before storage.
Legal basis (GDPR): Consent (Article 6(1)(a) GDPR). We collect analytics data only after you have accepted cookies via our cookie consent banner. If you decline, no GA4 tracking is activated.
Data processor: Google LLC (a Google Ireland Ltd. subsidiary for EU users). Data may be transferred to the United States under Standard Contractual Clauses. Google’s privacy policy: https://policies.google.com/privacy
Retention: Analytics data is retained in GA4 for 14 months, after which it is automatically deleted.
2. Affiliate tracking data
When you click a product link on this site, you are redirected through our affiliate redirect system (/go/{program}/{product}) to the retailer. The retailer’s tracking system then sets its own cookies to attribute your purchase to us if you buy.
Affiliate networks and their processors:
| Affiliate network | Processor | Cookie duration |
|---|---|---|
| Amazon Associates | Amazon.com, Inc. | 24 hours |
| ShareASale (Lettuce Grow) | ShareASale.com, Inc. | 30 days |
| Impact Radius (Gardyn) | Impact Tech, Inc. | 30 days |
| Click & Grow (direct) | Click & Grow OÜ | 45 days |
| AC Infinity (direct) | AC Infinity Inc. | 30 days |
| Spider Farmer (direct) | Shenzhen Budding Commerce Co., Ltd. | 30 days |
| Mars Hydro (direct) | Shenzhen LG-LED Solutions Limited | 30 days |
| LetPot (direct) | LetPot Technology Co., Ltd. | 30 days |
Each of these processors operates under their own privacy policy when you visit their website. Clicking an affiliate link means you leave our site and are subject to the retailer’s privacy practices from that point forward. We receive only aggregate commission reports — we do not receive your name, email, address, or payment information from any affiliate network.
Legal basis (GDPR): Legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest is receiving attribution for sales we referred. The affiliate redirect itself does not set cookies on our domain; cookies are set only by the destination retailer on their domain.
3. Server logs
Our hosting infrastructure (Cloudflare Workers / Cloudflare Pages) automatically records standard server log data: IP addresses, request timestamps, URLs requested, HTTP status codes, referrer headers, and user-agent strings. These logs are used for security monitoring and diagnosing technical errors.
Legal basis (GDPR): Legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest is operating a secure, functioning website.
Retention: Cloudflare retains raw log data for up to 30 days. Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/
4. Data you send us voluntarily
If you contact us by email at contact@indoorfoodgrower.com, we receive your email address and any information you include in your message. We use this information solely to respond to your inquiry. We do not add you to any mailing list and we do not share your email with third parties.
Legal basis (GDPR): Contract or pre-contract measures (Article 6(1)(b) GDPR) where your inquiry relates to content on our site; or our legitimate interest (Article 6(1)(f) GDPR) in responding to general correspondence.
Retention: Email correspondence is retained for up to 2 years and then deleted.
Cookies
We use cookies for analytics (GA4) and the affiliate networks deposit cookies on their domains when you follow a link. For a full breakdown of cookies used on this site, see our Cookie Policy.
Your rights (GDPR)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under GDPR and applicable data protection law:
- Right of access (Art. 15 GDPR): You can request a copy of the personal data we hold about you.
- Right to rectification (Art. 16 GDPR): You can ask us to correct inaccurate data.
- Right to erasure (Art. 17 GDPR): You can ask us to delete your data, subject to legal retention obligations.
- Right to restriction of processing (Art. 18 GDPR): You can ask us to restrict how we use your data in certain circumstances.
- Right to data portability (Art. 20 GDPR): You can request your data in a machine-readable format.
- Right to object (Art. 21 GDPR): You can object to processing based on legitimate interests.
- Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent (e.g., analytics cookies), you can withdraw consent at any time by adjusting your cookie preferences in our cookie banner.
To exercise any of these rights, contact us at contact@indoorfoodgrower.com. We will respond within 30 days. If we cannot fulfil a request, we will explain why.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for our establishment is the Office of the Commissioner for Personal Data Protection (Cyprus), https://www.dataprotection.gov.cy. You may also contact the supervisory authority in your own EU member state.
International data transfers
Google Analytics 4 may transfer data to the United States. Google operates under Standard Contractual Clauses approved by the European Commission for this purpose. Cloudflare similarly operates under approved transfer mechanisms. We select processors who comply with GDPR transfer requirements.
Children’s privacy
This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at contact@indoorfoodgrower.com and we will delete it promptly.
Changes to this policy
When we make material changes to this policy, we update the “Last updated” date at the top. Continued use of the site after a policy update constitutes acceptance of the revised policy. For significant changes, we will add a notice on the homepage for at least 30 days.
Contact
Stephan Kulik 111 Chlorakas Avenue, Shop 9, Suite 546, 8220 Chloraka, Paphos, Cyprus Email: contact@indoorfoodgrower.com