Privacy Policy

1. Who we are

STEM Turnkey is a brand of ESA Organics, Inc.(“ESA Organics”, “we”, “us”, or “our”), a Florida-based business and the parent operator of the turnkey K-12 AgTech STEM curriculum and farm-to-cafeteria vertical-farming infrastructure marketed under the STEM Turnkey name. This Privacy Policy applies to stemturnkey.com and any related sub-domains (collectively, the “Site”). By using the Site you acknowledge the practices described below.

2. Information we collect

We collect only what is necessary to respond to inquiries, deliver program information, and operate the Site securely. Specifically:

2.1 Information you submit to us

• Lead form data: full name, work email, school or district name, job title (e.g., Principal, CTE Director, Superintendent, Educator), student enrollment band, school type (public, private charter, independent private, faith-based), program goals, and optional free-text notes you choose to include.
• AI chat conversations:messages you type into our on-site AI chat assistant, along with the assistant’s replies. These conversations are stored locally in your browser’s localStorage and are also transmitted to our AI provider (Anthropic) so that responses can be generated.
• Email correspondence: if you reply to a confirmation message or email us directly, we retain the message and any attachments.

2.2 Information collected automatically

• Request metadata: IP address, browser user-agent string, and approximate geolocation derived from your IP. These are used for spam prevention, abuse mitigation, and aggregate traffic analysis.
• Analytics events (if enabled): when we enable our analytics provider (Plausible Analytics), we receive cookieless, anonymized page-view and outbound-link event data. Plausible does not use cookies and does not collect personal information.
• Local browser storage: small key-value entries used to remember your chat history and UI preferences (e.g., dismissed banners). This data never leaves your device except as described above for AI chat.

3. How we use information

We use the information we collect to:

• Respond to consultation, eligibility, and grant-funding inquiries submitted through the lead form.
• Send program materials, blueprint documents, and follow-up correspondence you have requested.
• Power the AI chat assistant and improve its accuracy on school-program questions.
• Maintain Site security, detect fraudulent submissions, and prevent abuse.
• Comply with legal obligations (subpoenas, tax records, regulatory requests).

We do not sell, rent, or trade your personal information. We do not use lead-form data for advertising profiles, and we do not share email addresses with third-party marketing networks.

4. Third-party service providers

To operate the Site we rely on a small number of trusted infrastructure vendors. Each is bound by its own privacy commitments:

• Anthropic, PBC— provides the Claude AI model that powers our on-site chat assistant. Chat messages are transmitted to Anthropic to generate replies. See Anthropic’s privacy policy at anthropic.com/legal/privacy.
• Resend — handles transactional email delivery for lead notifications and confirmations. See resend.com/legal/privacy-policy.
• Vercel Inc. — hosts the Site, terminates TLS, and serves static assets. See vercel.com/legal/privacy-policy.
• Plausible Analytics (when enabled) — cookieless, EU-hosted, privacy-friendly analytics provider. See plausible.io/privacy.

We do not authorize any of these providers to use your data for their own independent marketing purposes.

5. Data retention

• Lead form submissions: retained for up to 24 months from the date of submission, after which they are archived or deleted. If you become a customer, contractual records may be retained longer to comply with Florida record-keeping and tax-reporting requirements.
• AI chat conversations: retained on our infrastructure for up to 30 days. Local browser copies persist until you clear your browser’s site data.
• Server access logs: retained for up to 90 days for security auditing.
• Analytics events:aggregated indefinitely; raw event records are retained per Plausible’s default retention schedule.

6. Your rights

Depending on where you reside, you may have certain rights regarding your personal information. We honor these rights for all visitors regardless of jurisdiction.

6.1 GDPR (European Economic Area / United Kingdom)

If you are located in the EEA or UK, the General Data Protection Regulation grants you the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data (the “right to be forgotten”).
• Restrict or object to specific processing activities.
• Request a portable, machine-readable copy of your data.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

Our lawful bases for processing are: (a) legitimate interests (responding to your inquiry and operating the Site securely), (b) consent (for optional analytics where applicable), and (c) contract performance (when you become a customer).

6.2 CCPA / CPRA (California)

California residents have the right to know what personal information we collect, request deletion, request correction, opt out of any “sale” or “sharing” of personal information, and not be discriminated against for exercising those rights. STEM Turnkey does not sell or share personal information as those terms are defined under the CCPA/CPRA.

6.3 How to exercise your rights

To submit a request, email us at privacy@stemturnkey.com with the subject line “Privacy Request”. We will respond within 30 days (or 45 days for CCPA requests, with notice if an extension is required).

7. Children’s privacy (COPPA)

Our Site is directed to school administrators, educators, district leadership, and other adult decision-makers — not to children under 13. We do not knowingly collect, store, or use personal information from children under 13. If you believe a child under 13 has submitted personal information through the Site, please email privacy@stemturnkey.com and we will promptly delete it. Schools that ultimately deploy our hardware and curriculum in classrooms remain responsible for any direct student data collection that occurs in their environment under FERPA and applicable state student-privacy laws.

8. Security

We use industry-standard technical and organizational safeguards to protect your information, including TLS encryption in transit, encrypted storage at rest with our infrastructure providers, access controls, and the principle of least privilege for team members. Only personnel who need access to a specific category of data in order to respond to your inquiry, deliver requested materials, or support a contracted deployment are granted that access, and access is revoked when no longer required.

Our infrastructure providers (Vercel for hosting, Resend for email delivery, and Anthropic for AI inference) maintain SOC 2 Type II or equivalent attestations and operate hardened, segmented networks. Production secrets and API keys are stored in encrypted environment variables, never committed to source control, and rotated on a schedule and immediately upon suspected exposure.

No internet transmission or storage system is 100% secure; however, we work continuously to maintain a high standard of protection and to disclose any material breach to affected parties without undue delay as required by Florida Statutes § 501.171 (Security of Confidential Personal Information) and any other applicable federal or state notification laws.

9. Categories of data subjects

The personal information we handle relates to the following categories of people:

• Prospective customers — school administrators, CTE directors, superintendents, principals, district procurement leads, grant writers, and similar adult stakeholders who fill out the lead form or engage the AI chat.
• Email correspondents — anyone who emails us directly or replies to an automated message we have sent.
• Site visitors — anyone who loads a page on the Site, whose IP address and request metadata are temporarily processed for security and aggregate analytics.

We do not knowingly process personal information about students under 13 through the Site (see Section 7).

10. International data transfers

STEM Turnkey is based in the State of Florida, United States. If you are accessing the Site from outside the U.S., your information will be transferred to and processed in the United States. By submitting information through the Site you consent to this transfer. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms with sub-processors.

11. Cookies and similar technologies

The Site uses only strictly necessary first-party storage (browser localStorage) to remember your chat history and UI preferences. We do not use advertising cookies, cross-site tracking pixels, or third-party fingerprinting tools. Our analytics provider, Plausible, is cookieless by design. You can clear local storage at any time through your browser settings.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, new features, or legal requirements. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be announced via a banner on the Site or email to active contacts. Continued use of the Site after a change constitutes acceptance of the revised policy.

13. Governing law

This Privacy Policy is governed by the laws of the State of Florida, United States, without regard to its conflict-of-law principles. Any disputes arising out of this policy will be resolved as set forth in our Terms of Service.

14. Contact us

Questions, requests, or concerns about this Privacy Policy can be sent to:

See also our Terms of Service.