Privacy Policy

Effective date: [EFFECTIVE DATE]

This Privacy Policy explains how [COMPANY LEGAL NAME] ("Canopy Ledger," "we," "us," or "our") collects, uses, and shares information through our marketing website (the "Site") and our Canopy Ledger software platform (the "Service").

Canopy Ledger is business-to-business software for licensed cannabis businesses. We do not sell, handle, or transport cannabis, and we do not sell personal information.

1. Our Role: Controller vs. Processor

• Site visitors, demo requests, and account administration. For information we collect directly through the Site and for managing customer accounts and billing, we decide how the information is used and act as the business (under U.S. state privacy laws) or controller (under the GDPR).
• Customer Data in the Service. Our customers enter business records into the Service, such as strains, plants and clones, batches, inventory package lots, sales, custom fields, and custom scripts ("Customer Data"). Customer Data may include personal information (for example, employee names or customer details a business chooses to record). For Customer Data, we act as a service provider or processor on behalf of our customer, and we process it only according to our customer's instructions and our agreement with them. Our customer is responsible for its own privacy practices. If you have questions about personal information a cannabis business has entered into the Service, please contact that business directly. We will assist our customers in responding to such requests as required by our agreements and applicable law.

2. Information We Collect

2.1 Account-request and demo-request forms

When you ask for an account or a demo on the Site, we collect:

• your name;
• your business name;
• your email address and, if you choose to give it, your phone number;
• the state in which your business operates;
• your license type (for example, cultivation, processing, or retail); and
• any note you choose to include.

We use this information to review your request, contact you about it, and set up your account. The request is delivered to our business email inbox, which is hosted by Google, and we send you a confirmation email through [EMAIL SENDING PROVIDER].

2.2 Account information

When a customer signs up for and uses the Service, we collect information about the account and its Users, such as names, business email addresses, and roles of employees you add; the operator name recorded on changes; company name; account settings; and communications with us. If we bill through a payment processor, payment information is collected and processed by that processor, [PAYMENT PROCESSOR]; we do not store full payment card numbers. [OWNER: no payment processor is integrated in the product today; see legal-review.md on Stripe's cannabis restrictions.]

2.3 Customer Data

As described in Section 1, we host and process Customer Data on behalf of our customers to provide the Service.

2.4 Information collected automatically

When you visit the Site or use the Service, we and our providers may automatically collect:

• device and browser information (such as browser type, operating system, and screen size);
• IP address and approximate location derived from it;
• pages viewed, links clicked, referring URLs, and timestamps; and
• technical logs used for security, troubleshooting, and performance monitoring.

2.5 Cookies and analytics

In the Service, we set a first-party preference cookie that remembers your display theme and, when the demo is protected by a shared access password, a strictly necessary first-party cookie (canopy_demo, 30 days) that remembers you entered it. The Service does not use analytics or advertising cookies. [OWNER: describe any cookies on the marketing Site and whether it shows a cookie banner.] See our Cookie Policy for details.

3. How We Use Information

We use information to:

• respond to demo requests and communicate with you about Canopy Ledger;
• provide, operate, maintain, and secure the Service;
• create and manage accounts, authenticate Users, and process payments;
• provide customer support;
• understand how the Site and Service are used and improve them;
• send service-related notices (such as security alerts, billing, and changes to our terms);
• send marketing communications where permitted by law (you can opt out at any time);
• detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service and Acceptable Use Policy; and
• comply with legal obligations and enforce our agreements.

We use Customer Data only to provide the Service to the customer, as described in our agreement with that customer.

4. How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers and subprocessors that help us operate the Site and Service, under contracts that limit their use of the information (see Section 5).
• At a customer's direction, for example when a customer exports its data.
• Legal and safety reasons, when we believe in good faith that disclosure is required by law, subpoena, or court order, or is necessary to protect the rights, property, or safety of us, our customers, or others. Where legally permitted, we will notify the affected customer before disclosing Customer Data in response to a legal demand.
• Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
• With your consent.

5. Subprocessors

We currently use the following subprocessors to host and operate the Service:

We may update this list as our providers change. [Optional: Customers may subscribe to notices of subprocessor changes by emailing [CONTACT EMAIL].]

6. Data Retention

We keep information only as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law:

• Demo-request data: kept for as long as needed to respond and follow up, and then for up to [DEMO DATA RETENTION PERIOD, e.g., 24 months] unless you become a customer or ask us to delete it sooner.
• Account data: kept for the life of the account and for a reasonable period afterward for billing, tax, legal, and dispute-resolution purposes.
• Customer Data: kept for the duration of the customer's subscription. After termination, it is available for export for [DATA EXPORT WINDOW, e.g., 30] days and then deleted from active systems, with deletion from backups following our normal backup cycle, as described in our Terms of Service. Customers are responsible for keeping any records they are legally required to retain.
• Logs and analytics: kept for limited periods consistent with security and operational needs.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including encryption in transit and at rest as provided by our hosting providers' default configurations, access controls, and running customer scripts in a separate isolate with memory and time limits (see the Security page for those limits and what the isolation does not guarantee). See our Security page for more detail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Choices

• Marketing emails: use the unsubscribe link in any marketing email or contact us.
• Cookies: manage your preferences through our cookie banner or settings link, and your browser settings. See our Cookie Policy.
• Account information: account administrators can update certain information within the Service.

9. U.S. State Privacy Rights

Depending on where you live, laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and similar laws in other states may give you rights regarding your personal information. Subject to legal exceptions, these may include the right to:

• Know / access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to;
• Delete personal information we collected from you;
• Correct inaccurate personal information;
• Opt out of the sale of personal information, sharing for cross-context behavioral advertising, and certain profiling. We do not sell or share personal information as those terms are defined under these laws;
• Limit the use of sensitive personal information. We do not use sensitive personal information for purposes that require offering this right;
• Data portability, to receive certain information in a portable format; and
• Non-discrimination: we will not discriminate against you for exercising your rights.

Categories of personal information collected in the past 12 months: identifiers (such as name, email, IP address); commercial information (such as subscription and billing records); professional or employment-related information (such as company name, state of operation, and license type); and internet or network activity (such as Site usage and analytics data). Sources, purposes, and recipients are described in Sections 2–5.

Global Privacy Control: Where required by law, we treat a Global Privacy Control (GPC) browser signal as a valid request to opt out of sale or sharing for that browser.

How to exercise your rights: email us at [CONTACT EMAIL] with the subject "Privacy Request." We will verify your request using information we already have about you. You may use an authorized agent, who must provide proof of authorization. If we deny your request, you may appeal by replying to our response with "Appeal" in the subject line, and we will respond within the time required by law.

Customer Data: if your information is in the Service as part of a customer's Customer Data, please direct your request to that business. We will help our customers respond.

10. Visitors from the European Economic Area, United Kingdom, and Switzerland (GDPR)

The Service is designed for U.S. state-licensed businesses, but if you visit the Site from the EEA, the United Kingdom, or Switzerland, the following applies to personal information for which we are the controller.

Legal bases. We process personal information on these bases:

• Contract: to provide the Service and manage accounts;
• Legitimate interests: to respond to demo requests, operate and secure the Site and Service, and improve our offerings, where those interests are not overridden by your rights;
• Consent: for non-essential cookies (such as analytics) and certain marketing, which you can withdraw at any time; and
• Legal obligation: to comply with applicable laws.

Your rights. You may have the right to access, correct, delete, restrict, or object to processing of your personal information, to data portability, and to withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with your local data protection authority.

International transfers. Our servers and subprocessors are located primarily in the United States. When we transfer personal information from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or other lawful transfer mechanisms.

Contact. To exercise your rights, email [CONTACT EMAIL]. [If required: our EU/UK representative is [EU/UK REPRESENTATIVE DETAILS].]

11. Children

The Site and Service are intended for businesses and for adults at least 21 years old. We do not knowingly collect personal information from anyone under 21, and we do not knowingly collect personal information from children under 13. If you believe a minor has provided us with personal information, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and notify customers by email or through the Service, and Site visitors by posting a notice on the Site, before the changes take effect.

13. Contact Us

[COMPANY LEGAL NAME] [BUSINESS ADDRESS] Email: [CONTACT EMAIL]