Privacy Policy
How Budfront collects, uses, shares and protects personal information, and the choices you have.
Who we are
Budfront is operated by [Company legal name] (“Budfront,” “we,” “us” or “our”), located at [Mailing address]. Budfront provides websites, online ordering, branded apps, marketing tools and compliance features to state-licensed cannabis retailers (“dispensaries”).
Scope of this policy
This policy explains how we handle personal information in two different roles:
- When Budfront decides how information is used. This covers visitors to our marketing website, people who request a demo or contact us, and the dispensary owners and staff who use the Budfront dashboard. This policy is the main notice for that information.
- When we process information for a dispensary. When you shop on a dispensary’s website or app that runs on Budfront, we process your information as a service provider on that dispensary’s behalf. The dispensary decides how that information is used and is responsible for giving you its own privacy notice. If you have questions about a dispensary’s practices, or want to exercise your rights for that information, please contact the dispensary directly. We will help them respond.
Information we collect
Information you give us
- Contact details, such as your name, email address, phone number, business name, state and number of locations when you request a demo, subscribe to our newsletter or contact us.
- Account information for dispensary owners and staff, such as login credentials, role and preferences.
- Business information a dispensary shares with us to set up its services, such as license details, menus, pricing, hours and branding.
- Communications, including messages you send our support team and your feedback.
Information collected automatically
- Device and usage data, such as IP address, browser type, pages viewed, links clicked, referring pages and the date and time of your visit.
- Approximate location derived from your IP address, used for things like showing the nearest store and confirming that you’re in a market we serve.
- Cookies and similar technologies, described in Cookies and analytics.
Shopper information we process for dispensaries
To power a dispensary’s storefront, we may process the following on the dispensary’s behalf:
- Name, contact details and account information
- Order history, pickup and delivery details, and loyalty points
- Marketing preferences and consent records
- Age and identity verification data, such as date of birth and images of a government-issued ID
- Medical patient information, such as medical card numbers and expiration dates, where a dispensary serves registered patients
We treat ID images, dates of birth and medical card details as sensitive information. We use them only to provide the services the dispensary requested, such as verifying age, applying purchase limits and patient pricing, and keeping required records. We never use them for advertising.
Information from others
We may receive information from dispensaries, from the point-of-sale and other systems they connect to Budfront, and from service providers that help us with things like analytics and fraud prevention.
How we use information
- To provide, set up, maintain and support our services
- To respond to demo requests, questions and support requests
- To send service messages, such as account notices, security alerts and billing information
- To send marketing communications where permitted, with an easy way to opt out
- To help dispensaries verify ages, apply purchase limits and meet their record-keeping obligations
- To understand how our website and services are used, and to improve them
- To protect the security of our services and prevent fraud and abuse
- To comply with law and respond to lawful requests
We may create aggregated or de-identified information that can’t reasonably be used to identify you, and use it to improve our services and understand industry trends.
How we share information
Budfront does not sell personal information. [Owner to confirm before publishing: update this section, and add any required opt-out options, if Budfront ever sells personal information or shares it for targeted advertising.]
We share information only in these situations:
- With dispensaries. Shopper information is shared with the dispensary you order from, since it is their customer relationship.
- With service providers who help us operate, such as hosting, messaging, payments, analytics and customer support providers. They may use the information only to perform services for us.
- With your direction or consent, for example when a dispensary connects an integration it has chosen.
- For legal reasons, when we believe in good faith that disclosure is required by law, subpoena or other legal process, or is needed to protect the rights, property or safety of Budfront, our customers or others.
- In a business transfer, such as a merger, acquisition, financing or sale of assets, subject to standard confidentiality protections.
Cookies and analytics
We use cookies and similar technologies to keep you signed in, remember your preferences (including that you’ve confirmed your age), keep our services secure and understand how our website is used. Some cookies are set by analytics providers that help us measure traffic and performance.
On our marketing website, we measure visits with Vercel Web Analytics, which doesn’t use cookies. Messages you send through our website forms are delivered to us by our form provider, Web3Forms, and newsletter sign-ups are stored with our email provider, Resend.
You can control cookies through your browser settings. If you block certain cookies, parts of our website or a dispensary’s storefront, such as the age gate or checkout, may not work properly.
Texts and emails
We send marketing emails and texts only where we have the required consent. You can opt out of marketing emails using the unsubscribe link in any email, and out of texts by replying STOP. Message and data rates may apply. Even if you opt out of marketing, we may still send you service messages about your account or orders.
Texts and emails you receive from a dispensary are sent on that dispensary’s behalf. Opting out of one dispensary’s messages doesn’t opt you out of messages from other dispensaries.
How long we keep information
We keep personal information for as long as we need it for the purposes described in this policy, including providing our services, meeting legal, tax and accounting requirements, resolving disputes and enforcing our agreements. For shopper information we process for a dispensary, we follow that dispensary’s instructions, subject to any records the law requires to be kept. When information is no longer needed, we delete it or de-identify it.
How we protect information
We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls and logging. Learn more on our Security page. No system is completely secure, so we can’t guarantee absolute security. Our services are hosted in the United States.
Your choices and rights
You can ask us to:
- Tell you what personal information we have about you, and give you a copy
- Correct information that’s inaccurate
- Delete your information
- Stop sending you marketing messages
Depending on where you live, state privacy laws may give you additional rights, such as the right to limit how sensitive information is used or to appeal a decision we make about your request. We will honor rights that apply to you as required by law, and we won’t discriminate against you for exercising them.
To make a request, email privacy@example.com. We may need to verify your identity before responding. If your request is about information we process for a dispensary, we may direct you to that dispensary or forward your request to them.
Age requirements
Our services are intended for adults 21 and older and, where applicable, registered medical patients who meet the age requirements of their state. Our services are not directed to children, and we do not knowingly collect personal information from anyone under 21 except as permitted for registered medical patients and their caregivers under applicable law. If you believe someone underage has provided us information, please contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. When we do, we’ll change the “Last updated” date at the top of this page. If we make material changes, we’ll give you notice, for example by email or a notice on our website, before the changes take effect.
Contact us
If you have questions about this policy or our privacy practices, contact us:
- Email: privacy@example.com
- Mail: [Company legal name], Attn: Privacy, [Mailing address]