Patterns
Data Processing Terms
Last updated September 29, 2026
Patterns is operated by Grow Jungles Inc., a nonprofit organization (EIN 84-3803196). Questions: privacy@wildpatterns.co.
These terms apply when an institution (a university, research institute, nonprofit or agency) uses Patterns for its camera-trap program. They form part of the Terms of Service.
1. Roles
The institution is the controller of the photos, locations, station records, identifications and member details in its workspaces (“Institution Data”). Grow Jungles Inc. is the processor and processes Institution Data only to provide Patterns and on the institution's documented instructions, which are these terms and the institution's use of the product settings.
2. What is processed
- Camera-trap photos and videos of wildlife, including endangered species, with capture times.
- GPS coordinates of camera stations and photos.
- Identifications, reviews, names and comments made by the institution's team.
- Names, emails, roles and affiliations of the institution's members.
3. Cross-institution matching
Coat patterns from Institution Data are compared against the same-species catalog of all institutions so that the same animal can be recognised across study areas. Match suggestions may show other institutions an individual's catalog code, name and a reference image. Exact coordinates are never shown to other institutions.
4. Confidentiality
Grow Jungles Inc. limits access to Institution Data to people who need it to run, support or secure Patterns and who are bound by confidentiality.
5. Security measures
- Encrypted connections (HTTPS, TLS 1.2 or later) for the app and file storage.
- File storage with public access disabled; photos are served through expiring signed links.
- GPS metadata removed from photos when they are served.
- Location generalization by role: exact for administrators and uploaders, ~1 km for scientists, ~11 km for citizen scientists.
- Role-based access scoped to each institution's workspaces.
- Passwords stored as bcrypt hashes; single-use, one-hour password-reset links.
- Application secrets kept in Azure Key Vault.
- An audit log of significant actions.
- Database backups kept for 35 days; deleted files recoverable for 30 days; geo-redundant file storage.
6. Sub-processors
The institution authorizes these sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Hosting, PostgreSQL database, file storage, secret storage | United States |
| Azure Communication Services | Service emails (invitations, password resets) | United States |
| Stripe | Institutional billing | United States |
| Optional Google sign-in | United States | |
| OpenAI | Optional written summaries from sighting facts (no photos or coordinates) | United States |
We will update this list and notify organization admins by email at least 30 days before adding a new sub-processor. An institution may object in that time; if we cannot resolve the objection, it may end its licence.
7. Assistance and requests
We will help the institution respond to requests from individuals to access, correct, export or delete their information, and pass on any request we receive directly about Institution Data.
8. Security incidents
If we become aware of a breach affecting Institution Data, we will notify the institution's organization admins without undue delay and within 72 hours, describing what happened, the data involved, and the steps taken, and we will keep them updated.
9. Export and deletion
Institutions can export their records at any time from the research-data and export tools in Patterns. When a licence ends, the institution may request an export within 30 days; after that we delete Institution Data from active systems. Deleted files remain in recoverable storage for up to 30 days and database backups for up to 35 days before they are overwritten. Earlier deletion is available on request to privacy@wildpatterns.co.
10. Contact
Data-protection questions and requests: privacy@wildpatterns.co.