Privacy Requests

The short version

You can ask us what we have about you, ask us to change it, ask us to delete it, ask us to hand it over in a portable file, or ask us to stop using it for something specific. We do it by email. We reply within 45 days. We don't charge. We don't make you fill out a form.

Email hello@rowandbed.com with the subject Privacy request. Include what you want us to do and the email address on your Row & Bed account. We handle it from there.

1. What you can ask for

These rights are available to every Row & Bed customer, regardless of which state you live in. Some states give you additional rights — see section 6.

• Access. Ask us to send you a copy of the personal information we have about you.
• Correct. Ask us to fix anything that's wrong.
• Delete. Ask us to remove your account and the data tied to it.
• Export. Ask us to hand over your garden data in a portable file (JSON or CSV) so you can take it somewhere else. The in-app data export at Settings → Data is the fastest path; email us if you'd prefer we do it.
• Opt out of marketing email. One-click unsubscribe at the bottom of any marketing email. Or email us and we'll take care of it. Transactional emails (receipts, renewal reminders, account changes) continue while your subscription is active.
• See your consent record. Ask us to send you a copy of your signup consent record — the date you accepted the Terms and Privacy Policy, the versions in effect at that time, and whether you opted out of the arbitration clause.

2. How to make a request

Email hello@rowandbed.com. Use the subject line Privacy request.

Include:

• The email address on your Row & Bed account (so we can find you).
• What you'd like us to do — access, correct, delete, export, opt out, see consent record, or something else.
• If you're correcting something, what you want it to say.
• If you're appealing a previous denial, a quick note saying so.

You don't need a form. You don't need to cite a statute. Plain language works.

3. How we confirm it's really you

To protect your data from someone pretending to be you, we verify requests before we act on them.

For most requests, the verification is simple: we reply to the email address on your account. If that email replies back and confirms the request, we treat it as verified. If the request came from a different email address, we'll ask you to send the same request from the email on file before we act.

For deletion requests, or any request involving an account that's been inactive for a while, we may ask for one additional confirmation step (for example, clicking a one-time link we email you) before we proceed.

We don't ask for your password, Social Security number, or government ID. If someone claiming to represent us ever asks for those, it's not us.

4. How long it takes

We respond within 45 days of receiving a verified request. For most requests — access, correction, opt-out — the response is much faster than that. Deletion and export may take the full window, because we coordinate across our database, file storage, and backups.

If your request is complicated and we need more time, we can take one additional 45 days, as permitted by CCPA/CPRA and equivalent state laws. If we need the extension, we'll email you before day 45 to explain and give you a revised timeline.

If your state's law requires a shorter response window than 45 days for a specific type of request, we honor that shorter window.

Every request gets a written confirmation when we're done.

5. What we do with each kind of request

5.1 Access

We send you a file containing: your account info, your ZIP and derived location data, your garden content (beds, plants, notes, photos), your consent record, your support history with us, your Stripe customer reference (but not your card number — we don't have it), and a summary of the usage events PostHog has associated with your account.

5.2 Correct

We update the field(s) you identified. We confirm back to you that the change is done.

5.3 Delete

We remove your personal data from active systems within 30 days. Some data lives in backups for up to 90 days after that, at which point the backup cycle overwrites it. We may retain:

• A record of the deletion request itself, for audit purposes, without your personal identifiers.
• Transaction records we're required to keep for tax and accounting purposes, typically without identifying customer data once those records are closed.
• Information we need to enforce our Terms, defend legal claims, or comply with law.

If you submitted any corrections to our variety, pest, or disease library, the correction itself stays in the library (we cannot unbuild an improved fact). The correction is no longer tied to you after deletion.

5.4 Export

The fastest path is the in-app data export at Settings → Data, which gives you a JSON file of your garden content. If you'd prefer we handle the export, or you need a CSV, email us and we'll put it together.

5.5 Opt out of marketing email

One-click unsubscribe at the bottom of any marketing email removes you from all future marketing. Transactional email (account and billing) continues as long as your subscription is active. If you want to close your account entirely, use the delete path.

5.6 See your consent record

We send you the relevant row from our consent log — date, Terms and Privacy Policy versions, auto-renewal acknowledgment, arbitration acknowledgment, and whether you've opted out of arbitration under Terms §14.5.

6. State-specific rights

If you live in a state with its own comprehensive privacy law — including but not limited to California, Colorado, Connecticut, Utah, Virginia, and others as more states pass laws — that law may give you additional rights beyond the ones listed in section 1. Common additions include:

• Opt out of "sale" or "sharing" as defined by state law. We don't sell or share your information in those senses today, but if you want an opt-out on file we'll record one.
• Opt out of "targeted advertising." We don't engage in targeted advertising as defined by state law. If you want an opt-out on file we'll record one.
• Limit use of sensitive personal information. We don't process what's classified as sensitive PI under these laws (we don't collect SSN, health data, precise geolocation, etc.).
• Appeal a denied request. See section 7.

To exercise any of these, email us as described in section 2 and mention the state you live in.

7. Appeals

If we deny a request — for example, because we couldn't verify it was really you, or because a specific exception under law applies — we'll tell you why in writing and give you a way to appeal.

To appeal: reply to our denial email, or send a new email to hello@rowandbed.com with the subject Privacy appeal. Explain why you think the decision should be reconsidered.

We respond to appeals within 45 days (or the window required by your state's law, whichever is shorter).

If we still deny the appeal and you live in a state with an attorney-general consumer-complaint process, we'll include contact information for that office in our response so you can take the matter further.

8. Authorized agents

You can authorize someone else — a family member, an attorney, or a service — to submit a privacy request on your behalf. We'll need written proof of their authorization (for example, a signed letter, a power of attorney, or a verification step we conduct directly with you) before we act on their request. Email us and we'll walk through it.

9. Cost

Free. We don't charge a fee for any of the requests listed above, regardless of how many you make.

10. If something's not working

If you emailed us and haven't heard back within 5 business days, email again to hello@rowandbed.com with the subject Privacy request follow-up. Sometimes things end up in a spam folder or get overlooked. We'd rather you bug us twice than give up.

If you live in a state with a privacy-enforcement office and you want to take a complaint there, those offices are public. California's is at cppa.ca.gov. Your state attorney general's office is the next step in most other states.

11. Related pages

• Privacy Policy — what we collect, how we use it, who we share it with.
• Terms of Service — the agreement between you and us.
• Refund Policy — 30-day no-questions-asked on first purchase.