Privacy Policy

Cannabis Sourcerer helps dispensaries, brokers and licensed cultivators source, sell and deliver plants. This policy explains what information we collect across our products, how we use it, who we share it with, and the choices you have. It applies to the procurement workspace, the cultivator portal, the field app, the platform and the customer shop, and to this website.

1. What we collect

Information you give us

• Account details — your name, business name, email address, phone number, business address, and a password (stored only as a one-way hash we cannot reverse).
• Business information — your plant inventory, availability lists and price lists you upload or enter, crop and production records, cultivator licence or resale certificate numbers you choose to provide, pickup days and hours.
• Your customers and suppliers — the names, phone numbers, email addresses, addresses and pricing tiers of the businesses and people you sell to or buy from, when you add them or invite them.
• Orders and quotes — what was ordered, by whom, at what price, pickup and delivery details, notes, and payment status.
• Messages — availability emails and text messages you send through the platform, replies your customers send to your texting number, and support tickets you file (including any screenshot you attach).
• Photos — pictures of crops, plants and staged orders taken in the field app or attached to an order.

Information collected automatically

• Usage and device information — the pages and features you use, the build number, browser type, screen size and approximate location derived from your IP address, and the times you sign in. We use this to keep the service working and to diagnose problems you report.
• Location — the field app can use your device's location, with your permission, to attach a position to a crop count or delivery. You can decline; the feature still works without it.

Information from others

• From a business you deal with — if a cultivator adds you as a customer, or a broker adds you as a cultivator, we hold the contact details they entered for you.
• From our service providers — delivery status of emails and texts (delivered, bounced, undelivered), and payment outcomes from our payment processor.

2. How we use it

• To provide the service: showing availability, placing and fulfilling orders, issuing quotes, invoices and pull sheets, and routing deliveries.
• To send the messages you ask us to send — availability emails, order-ready notices, pickup reminders — to the people you choose.
• To keep your account secure, prevent fraud and abuse, and verify that requests come from you.
• To support you: answering tickets, diagnosing bugs (a ticket records the page and build you were on), and telling you about changes to the service.
• To improve the product, using usage information in aggregate. We do not build advertising profiles.
• To meet legal obligations, and to bill you for your subscription.

3. Who we share it with

We share information only as needed to run the service, and never sell it.

If Cannabis Sourcerer is acquired or merges with another company, your information may transfer with it; we will tell you before that happens and this policy will continue to apply until it is changed with notice.

4. Your data and other businesses on Cannabis Sourcerer

Every business has its own workspace. Your customer list, your orders, your prices, your outbox and your pick sheets are visible only inside your workspace. Other businesses on the platform cannot see them, and we test for that continuously.

Two things are shared by design, because they are the point of the platform: a cultivator's published availability and prices are visible to the procurers who search the shared catalogue, at the price the cultivator sets for that channel; and a cultivator's customer shop is visible to the customers that cultivator has invited by QR code, and to nobody else. A customer sees only the cultivators whose code they scanned.

If you opt in to yield benchmarking, your production figures contribute to medians shown to other growers. Only medians across several growers are ever shown, never an individual's figures, and you can opt out at any time.

5. Text messages

Cultivators can text their customers through the platform — availability links, order-ready notices with a photo, and pickup reminders. We send texts only to people who have agreed to receive them: by turning on texts in the customer shop, or because the cultivator has confirmed the customer's consent. Message and data rates may apply.

Reply STOP to any message to stop receiving texts from that cultivator. Reply START to opt back in. Texting STOP to one cultivator's number affects only that cultivator. We keep a record of opt-ins, opt-outs and delivery status, as carriers require. Texts are sent from a phone number assigned to the cultivator; replies go to that cultivator.

We do not sell or share phone numbers or opt-in status with third parties for their own marketing. Mobile information is shared only with our texting provider to deliver the messages you asked for. The full program terms — what you receive, how often, and how to stop or get help — are in our Text Message Program Terms.

6. Photos

Photos of crops and staged orders are stored with the record they belong to. When a cultivator sends an order-ready text with a photo, that photo is served at an unguessable link so the customer's phone can display it; the link is not listed anywhere and does not identify the customer. Please don't include people's faces or documents in order photos.

7. Cookies and sessions

We use a small number of first-party cookies to keep you signed in and to remember the workspace you're in. They are marked HttpOnly and, on our production sites, Secure. We do not use advertising or cross-site tracking cookies. The field app and customer shop store a session on your device so they work when the yard has no signal; signing out clears it.

8. How long we keep it

• Account and business records — for as long as your account is open, and for a reasonable period afterwards to close out orders, invoices and disputes, unless you ask us to delete sooner.
• Orders, invoices and payment records — as long as tax and accounting rules require, typically seven years.
• Messages and delivery logs — long enough to show what was sent to whom and honour opt-outs; texting consent and STOP records are kept as carriers require.
• Support tickets — until resolved and for a period afterwards to spot recurring problems.
• Usage logs — a short rolling window, unless needed to investigate a security incident.

When you close your account, we remove or anonymise personal information that we don't have to keep, and the businesses you dealt with keep their own records of the transactions between you.

9. Security

Information is encrypted in transit and at rest. Passwords are hashed. Sessions are signed and expire. Each workspace is isolated from every other, and we test that isolation as part of every release. Incoming messages from our texting provider are cryptographically verified before we act on them. Access to production systems is limited to the people who need it. No system is perfectly secure; if we learn of a breach affecting your information, we will tell you and the authorities as the law requires.

10. Your choices and rights

• See and change your information — most of it is in your account, Settings and customer records, where you can edit it directly.
• Notifications — turn email and text notices on or off per cultivator in the customer shop; reply STOP to any text.
• Location — control it in your device's settings; the field app asks before using it.
• Export — inventory, orders and customers can be exported to spreadsheets from the apps; ask us for anything else.
• Delete — contact us to close your account and delete personal information we are not required to keep.
• Someone else's records about you — if a cultivator or broker holds your contact details in their workspace, they are the ones who entered them; we will help you reach them or, where we can, correct or remove the information ourselves.

Residents of California, Texas, Virginia, Colorado, Connecticut and other states with privacy laws have the right to know, access, correct and delete personal information, and to opt out of its sale or sharing. We do not sell or share personal information for cross-context advertising. To exercise a right, contact us using the details below; we will verify your identity and respond within the time the law allows. We won't treat you differently for exercising a right.

11. Children

Cannabis Sourcerer is a business tool for adults. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

12. Changes to this policy

When we change this policy in a way that matters, we will post the new version here with a new effective date and, for significant changes, tell account owners by email before it takes effect.

13. Contact

Questions, requests, or concerns about privacy: hello@cannabissourcerer.com. You can also write to Cannabis Sourcerer, Attn: Privacy, at the business address listed on our contact page.