Privacy Policy

1. Scope of this policy

This policy explains how CannaCtrl, Inc. ("CannaCtrl", "we", "us") handles personal information. It covers two different situations, and the distinction matters:

• Our website and sales process — where we decide how information is used. Here we act as a controller (a “business” under California law).
• The CannaCtrl platform used by our customers — where a licensed cannabis business decides what data to collect from its own customers, and we process it on their behalf. Here we act as a processor (a “service provider”).

If you are a consumer who shopped at, or received a delivery from, a dispensary that uses CannaCtrl, that dispensary — not CannaCtrl — controls your information. Please direct your requests to them; we will support them in responding.

2. Information we collect on this website

When you browse this website, we collect a limited amount of information:

• Usage and device information through analytics — pages viewed, approximate location derived from IP address, browser and device type, referring site, and how you move through the site. We use two analytics providers, described below.
• Booking information, if you schedule a demo — your name, email address, any details you type into the booking form, and the meeting time. This is collected by Calendly on our behalf.
• Server and security logs generated by our hosting provider, which may include IP address and request metadata.

This website has no contact forms, newsletter signup or account creation. We do not ask you to submit personal information anywhere except the demo booking flow, and we set no cookies of our own.

3. Information we collect as a customer or prospect

If your business evaluates or subscribes to CannaCtrl, we collect business contact details (name, work email, phone, company, role), records of our correspondence and calls, account and configuration details, support requests, and billing information necessary to invoice you. Payment card details are handled by our payment processor, not stored by us.

4. Customer Data in the platform

Our customers use CannaCtrl to run their businesses, and in doing so submit data about their own staff and retail customers — for example purchase history, loyalty records, delivery addresses, and identity verification records captured at checkout or at the door.

We process that data only to provide and support the Services, on our customer's documented instructions, as described in our Terms of Service and any data processing agreement. We do not sell it, and we do not use it to build our own marketing profiles.

5. How we use information

• To operate, secure, maintain and improve our website and the Services.
• To respond to enquiries, schedule and conduct demos, and provide onboarding and support.
• To administer subscriptions, invoicing and collections.
• To understand which parts of our site are useful, in aggregate, so we can improve them.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To comply with legal obligations and enforce our agreements.

6. Cookies and analytics

We use Google Analytics 4 (measurement ID G-GT35HBTZ7S) on every page of this website. It sets cookies and collects usage information as described above so we can understand traffic and improve the site. Google processes this data as described in its own privacy policy.

We also use Vercel Web Analytics, provided by our hosting platform, to measure page views and performance. It is cookieless — it does not set cookies, and it does not track you across other websites.

We do not use cookies of our own, and we do not run advertising or retargeting pixels on this site.

You can opt out of Google Analytics using Google's browser opt-out add-on, or by blocking cookies in your browser. Blocking them will not affect your ability to use this site — nothing here requires cookies to function.

If you book a demo, Calendly sets its own cookies within its booking interface, governed by Calendly's privacy policy.

7. Who we share information with

We do not sell personal information. We share it only with service providers who help us operate, and only for that purpose:

• Google — website analytics.
• Vercel — website hosting and cookieless page analytics.
• Calendly — demo scheduling.
• Our cloud hosting and infrastructure providers — website and platform delivery, logging and backups.
• Payment processors and financial institutions — subscription billing.
• Professional advisors, such as legal and accounting, under confidentiality obligations.

We may also disclose information where required by law or valid legal process, to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets — in which case we will give notice before your information becomes subject to a different policy.

8. Data retention

We keep website analytics data for the retention period configured in our analytics account, and business contact records for as long as needed for the relationship and a reasonable period afterwards.

Customer Data in the platform is retained for the duration of the subscription and made available for export for at least thirty (30) days following termination, after which it may be deleted in the ordinary course, subject to legally required retention — note that cannabis regulations often require operators to retain certain records for a set number of years.

9. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the data, including encryption in transit, access controls and least-privilege permissions, and logging. No system is perfectly secure, and we cannot guarantee absolute security.

If we become aware of a breach affecting your personal information, we will notify you and any affected customers as required by applicable law.

10. Your privacy rights

Depending on where you live, you may have the right to request access to the personal information we hold about you, correction of inaccurate information, deletion, a portable copy, and to opt out of certain processing. You also have the right not to be discriminated against for exercising these rights.

To make a request, email privacy@cannactrl.com. We will verify your identity before acting, and respond within the timeframe required by applicable law.

California residents: we do not sell personal information, and we do not knowingly share it for cross-context behavioural advertising. Analytics data may be considered “sharing” under some interpretations of California law; you can opt out using the browser controls described above.

If your request concerns data held by a dispensary using our platform, we will refer you to that business, which controls the data, and assist them in responding.

11. International visitors

We operate in the United States and process information there. If you access the site from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

12. Age restrictions

This website is intended for cannabis industry professionals and is not directed to children. The CannaCtrl platform is provided to licensed businesses, whose own customers must meet the minimum age required by applicable law. We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction through this website.

13. Changes to this policy

We may update this policy as our practices or the law change. We will revise the effective date above, and for material changes we will provide additional notice by email or in the product.

14. Contact us

Privacy questions and requests: privacy@cannactrl.com. Postal: CannaCtrl, Inc., Los Angeles, CA.