Privacy Policy

Account data. When you sign up, we collect your business name, contact email, phone number, and state license number. This is required to provision your tenant and verify that you are a licensed cannabis operator.

Transaction data. We process and store sales transactions, inventory movements, customer profiles, and compliance events generated through the POS. This includes product details, quantities, prices, timestamps, and budtender IDs.

Compliance reporting data. To meet state traceability requirements, we generate structured reports for METRC, BioTrack, and Leaf Data systems. These reports contain sale and inventory data formatted to each regulator’s specification.

Analytics and usage data. We collect anonymized application usage metrics, error logs, and page interactions to improve performance and reliability. This data is not tied to individual customers or patients.

State regulators. We share transaction and inventory data with state traceability systems (METRC, BioTrack, Leaf Data) as required by law. This sharing is automated and scoped to the data fields each regulator mandates.

Service providers. We use third-party infrastructure providers for hosting, email delivery, and error tracking. All providers are bound by data-processing agreements that limit use to service delivery.

We do not sell data. We do not sell, rent, or trade your business data, customer lists, or transaction histories to advertisers, data brokers, or any other third parties.

Transaction records. We retain transaction and inventory data for as long as your state requires — typically 3 to 7 years depending on jurisdiction. After the retention period expires, records are securely purged.

Analytics data. Anonymized usage metrics are retained for 26 months, then deleted. This window allows us to track year-over-year trends without keeping identifiable records indefinitely.

Closed accounts. If you cancel your subscription, we retain compliance-critical data for the legally required period, then purge all remaining data within 90 days. You may request an earlier full deletion if your state allows it.

Export. You can export your full transaction history, inventory records, and customer data at any time from the admin dashboard. Exports are delivered as structured CSV or JSON files.

Deletion. You may request deletion of your account and associated data. We will comply within 30 days, subject to any legal hold or state retention requirement that prevents immediate deletion.

Compliance audits. Because cannabis operators are subject to state inspections, transaction data may be held beyond a standard deletion request if it is part of an open regulatory inquiry or audit.

In transit. All data between your devices and our servers is encrypted with TLS 1.3. API calls and web dashboard traffic are protected by modern cipher suites.

At rest. Databases and backups are encrypted using AES-256. Encryption keys are managed through a secure key-management service with strict access controls.

Audit logs. We maintain immutable audit logs of administrative actions, data exports, and compliance report submissions. These logs help detect unauthorized access and satisfy regulatory inspection requirements.