Privacy policy

1Who we are

Cultivar is software for cannabis businesses: a back office for buying, stock, orders and customers, an online store, a delivery app for drivers, and menu emails. In this policy, “we” and “us” mean the company that provides Cultivar.

Cultivar is in private beta and is offered only to businesses in the United States. This policy explains what personal information we handle, why, who else handles it, and what you can ask of us. For questions about it, use the Contact page.

2Who this policy covers

You are in one of three groups, and different parts of this policy apply to each.

• Website visitors. You read this website or sent the request-access form. We decide what is collected and why, and we answer for it.
• Business users. You own or work at a business that uses Cultivar and you sign in to it. For your account details we decide what is collected, and we answer for it.
• A shop’s customers, drivers and suppliers. You ordered from, deliver for or sell to a business that runs on Cultivar. That business decides what it collects about you and what it does with it. We store and handle that information for the business, on its instructions, as its service provider. The law calls the business the “business” or “controller” and calls us its “service provider” or “processor”.

A shop’s online store, even when it runs on Cultivar, is the shop’s own. It carries the shop’s own privacy policy, and that policy is the one that tells you what the shop does with your information. This policy does not replace it.

This policy does not cover other companies’ websites or services that ours may link to.

3What we collect

If you visit this website. The website sets no cookies and runs no analytics or advertising scripts. If you send the request-access form we receive what you typed: your name, your shop’s name, your work email, and your answers about what you run on today and how many locations you have. With the request we store a scrambled form of your internet address, which cannot be read back into the address, and a short description of your browser. We use those two only to spot repeat and automated submissions. As with any website, the company that hosts ours receives your internet address and browser details in order to send you the page, and may keep them in its logs.

If you write to us. We receive whatever you send, including your email address and anything in your message.

If you work at a business that uses Cultivar. We hold:

• your name, email address, username and, if you add one, your profile photo;
• the business and locations you belong to, your role and what it lets you do, and when you were invited and joined;
• what you do in the product. Each stock movement, note and payment confirmation records who made it and when, because that record is the point of the product;
• the cookie that keeps you signed in. Your password is handled by our sign-in provider and is stored in a scrambled form. We cannot read it.

The records a business keeps in Cultivar. A business enters, imports or collects these, and we hold them for it. They can include personal information about:

• Its customers. Name, email address, phone number, delivery addresses and delivery notes. Orders: what was ordered, when, for how much, how it was paid for and whether payment was received. Notes and pictures the shop’s staff attach. Discount codes used. Whether the customer is marked as having agreed to marketing email, and whether they have unsubscribed. For each menu email: whether it was delivered, opened or clicked, or bounced. If the customer opens an account on the shop’s online store, their sign-in. If they turn on phone alerts, the address their browser gives for sending those alerts and which alerts they chose.
• Its drivers. Name, email address, phone number, driver’s licence number and expiry date, a label for the vehicle, whether the driver is active, when the driver app was last used, which orders the driver took and completed and when, and cash recorded as collected.
• Each delivery. The name of the person who received it, whether an ID was checked and what kind, the time, and any cash collected. If the shop uses them, a signature or a photograph of where the order was left.
• Its suppliers. The contact people the business records: name, email address, phone number, address, role and notes.

What Cultivar does not collect. Cultivar does not process card payments and has nowhere to store a card number or a bank login. An order records only the method of payment and whether it was paid. Cultivar does not record or follow a driver’s location. When a driver asks for directions, the delivery address is handed to the maps app on the driver’s own phone, which is run by the phone’s maker or by Google under their own terms. Cultivar has nowhere to store a picture of an ID or a date of birth, and does not ask for either. The age screen on a shop’s online store remembers only that you answered.

Free-text boxes and attached pictures hold whatever a person puts in them. We ask businesses not to put ID pictures, card numbers or health information there.

4What we use it for

Information from website visitors is used to reply to you, to decide whether Cultivar fits your business, to set up your account if you go ahead, and to keep the form from being abused.

Information about business users is used to:

• sign you in and show you what your role allows;
• record who did what, so the business has a true history of its stock and orders;
• send you the emails the service needs, such as an invitation, a password setup link or a notice about your account;
• give you help when you ask for it.

The records a business keeps in Cultivar are used to provide the service to that business, on its instructions. That includes showing the records to its team, sending its customers order updates, sending menu emails and phone alerts it chooses to send, and letting its drivers see the orders they have taken. We do not use a business’s customer list to market Cultivar or anything else to those customers, and we do not combine one business’s records with another’s.

For all three groups we also use information to keep the service secure, to find and fix faults, to prevent abuse and fraud, to keep the access log of our own staff, to meet legal duties and to protect our legal rights.

We may produce figures that identify no person and no business, such as how many orders the service handled in a month, and use them to run and improve Cultivar. We do not try to turn such figures back into information about a person.

5Email, and how to stop it

Menu emails from a shop. A shop sends these through Cultivar. The shop is the sender and decides who receives them. Cultivar sends a menu email only to customers the shop’s records mark as having agreed to marketing email and who have not unsubscribed.

Every menu email has an unsubscribe link. The link does not expire. Most inboxes also show their own unsubscribe button, and it works in one click. If you report a menu email as spam, we treat that as an unsubscribe. Unsubscribing stops menu emails from that shop. It is recorded straight away.

Order updates. Emails about an order you placed, such as a confirmation or “on the way”, are not marketing. They carry no unsubscribe link, and unsubscribing from menu emails does not stop them.

Emails from Cultivar itself. We email business users about their account, for example an invitation or a password setup link. If you asked for access, we email you about that request.

Opens and clicks. Emails sent through Cultivar record whether they were delivered and opened and which links were clicked. This works through a small invisible image and through links that pass through our email provider. Shops see the results for their menu emails. Today the same recording is switched on for every email we send, including order updates and account emails. You can stop the open record by turning off automatic loading of images in your email app.

Phone alerts. A shop’s online store and the driver app can send alerts to your phone if you switch them on. You can switch them off in the store’s settings or in your phone’s or browser’s settings.

Text messages. Cultivar does not send marketing by text message.

6Cookies and tracking

This website sets no cookies. It runs no analytics, no advertising and no social media tracking, and it loads its fonts from our own address. The request-access form sends what you typed to Cultivar’s own servers and nowhere else.

The product uses the cookies and browser storage it needs to work: to keep you signed in, and to remember which business and location you are working in. The driver app also keeps recent work on the phone so that it works without a signal.

A shop’s online store uses cookies needed to shop: to keep a customer signed in, to hold the basket and a discount code, to show the order just placed, and to remember that the age screen was answered.

None of these is used to follow you across other websites, and neither the website nor the product contains advertising or other companies’ tracking tools.

Do Not Track and Global Privacy Control. Some browsers can send a signal asking not to be tracked or asking that personal information not be sold or shared. Because the website and the product do not track you across sites, they behave the same way whether or not your browser sends one of these signals.

7Who we share it with

The companies Cultivar runs on. We use other companies to run the service. Each handles personal information in order to provide its service to us, under its own terms and data processing agreement.

• Supabase holds the database, runs sign-in and stores uploaded files such as profile photos and logos. All the records described in this policy are kept there.
• Vercel hosts the website and the product. Every request passes through it, so it receives internet addresses and browser details and may keep them in its logs.
• Resend sends email. It receives each recipient’s email address and the content of the email, and records delivery, opens and clicks.

A phone alert travels through the alert service run by the maker of your browser or phone, such as Apple, Google or Mozilla. That is how every website’s alerts are delivered.

The business you deal with. A business and the team members it has given access see the records of that business, including its customers, drivers and suppliers. A driver sees a customer’s name, phone number and address only after taking that order. One business cannot see another business’s records.

Advisers. We may share information with our lawyers, accountants and insurers where they need it to advise us, under a duty of confidence.

The law and a change of ownership. See When we may have to disclose information.

What we do not do. Cultivar carries no advertising. Nothing in the website or the product sends personal information to an advertising network or a data broker.

8When we may have to disclose information

Legal requests. We may disclose information when we believe in good faith that the law requires it. That includes a court order, a subpoena, a search warrant, or a lawful request from a regulator, a licensing or tax authority, or law enforcement.

Cannabis businesses are licensed and regulated under state law, and cannabis remains unlawful under United States federal law. We cannot promise that information held in Cultivar will be kept from a government body or a court that asks for it lawfully. Where a request concerns a business’s records and the law lets us, we will try to tell that business before we respond, so that it can object.

Protection. We may disclose information where we believe it is needed to protect someone’s safety, to investigate or stop fraud, abuse or a security problem, to enforce our terms, or to establish or defend a legal claim.

A change of ownership. If Cultivar is involved in a merger, a sale of all or part of its business or assets, a financing, a reorganization or a winding up, information we hold may be disclosed to the other party and its advisers and passed to the new owner. The new owner may keep using it as this policy describes.

With your say-so. We may share information in any other case where you ask us to or agree to it.

9Our own staff’s access

People who work at Cultivar have their own kind of account. They are never members of a business’s team. To help a business, a member of our staff opens a timed session into its account and must give a reason. By default the session can only look. A session that can make changes needs a separate permission.

Each session and each action taken in it is written to an access log, with who it was, when, why, and the internet address it came from. That log is kept even if the business’s account is later deleted.

How staff access works

10How long we keep it

We keep personal information for as long as we need it for the purposes in this policy, and then for as long as the law requires or a legal claim could be brought. We do not yet publish fixed periods. What decides how long is below.

• Requests sent through the form are kept while we are in touch with you about Cultivar and for a reasonable period afterwards. You can ask us to delete yours at any time.
• A business user’s account is kept while the account is open. The record of what that person did, such as a stock movement, belongs to the business and stays in its history after the person leaves.
• A business’s records are kept while the business has an account. The business decides how long its customer, driver and order records are kept, and cannabis rules in its state may require it to keep some of them for years. When a business closes its account we delete its records on its request, within a reasonable period, apart from what we must keep by law or to deal with a dispute.
• An unsubscribe is kept with the customer’s record for as long as the shop keeps that record, so that the choice goes on being respected.
• The access log of our own staff is kept after a business’s account is deleted. It records which business was looked at and by whom. It is the proof of how we handled a business’s data, and it would be worth nothing if it vanished with the account.

Deleted information can remain for a limited time in backups and in the logs of the companies we run on, until those are overwritten in the ordinary course.

11Your choices and rights

If you are a website visitor or a business user, you can ask us:

• what personal information we hold about you, and for a copy of it;
• to correct it;
• to delete it;
• to stop emailing you about Cultivar.

To ask, use the Contact page. Business users can change their own name, username and photo in the product at any time. If your account belongs to a business’s team, the owner of that business controls your access, and the history of what you did there stays with the business.

If you are a shop’s customer, driver or supplier, send your request to the shop. The shop decided to collect your information, and only the shop can decide what happens to it. Customers with an account on a shop’s online store can also see and change their own details there. If you send a request to us instead, we will not act on it ourselves. We will tell you to contact the shop and, where we can tell which shop it is, we may pass your request on. We help shops answer these requests.

Checking it is you. Before acting on a request we need to be reasonably sure who is asking. We normally do that by replying to the email address we hold for you. We may ask for more if that is not enough. Someone else can ask on your behalf if they show us your written permission, and we may still check with you directly.

How we answer. We answer within the time the law that applies to you allows. We may refuse a request, or part of one, where the law permits it. Examples are where we cannot confirm who you are, where the information is needed to complete something you asked for, to keep the service secure, to meet a legal duty or to deal with a legal claim, or where it would reveal another person’s information. If we refuse, we will say why. You can ask us to look again by replying to our answer.

No worse treatment. We will not refuse you service, charge you a different price or treat you worse because you made a request under this section.

12California and other state privacy laws

California and a number of other states give their residents rights over personal information held by businesses above a certain size. Whether or not those laws apply to a company of our size, Your choices and rights says what you can ask of us. Depending on your state, the law may give you the right to know what is collected, to get a copy, to correct, to delete, to opt out of the sale of your information or its use for targeted advertising, to limit the use of sensitive information, to appeal a refusal, and not to be treated worse for asking. In California these rights also cover people who deal with us on behalf of a business.

What we collect, in the law’s terms. For website visitors and business users, in the past twelve months we have collected:

• Identifiers and contact details: name, email address, username, a scrambled form of an internet address.
• Professional information: the business you work for and your role in it.
• Internet activity: a description of your browser, what you do in the product, and whether you opened or clicked an email from us.
• Pictures: a profile photo, if you add one.
• Sensitive personal information: the sign-in details for your account. We use them only to sign you in and keep the account secure.

It comes from you, from the business that invited you, and from your use of the website and product. We collect it for the purposes in What we use it for, and disclose it to the companies in Who we share it with so that they can provide their services to us. We keep it as How long we keep it describes. We do not use it to make decisions about you by automated means that have legal or similarly significant effects.

Sale and sharing. Nothing in the website or the product passes personal information to an advertising network or a data broker.

Shops’ records. For the records a business keeps in Cultivar, we are that business’s service provider or processor. We handle that information only to provide the service to the business and for the limited purposes the law lets a service provider keep for itself, such as security and fixing faults. We do not use it for our own marketing. Rights requests about it go to the business, and we help the business answer them. Some of that information is sensitive under state law, such as a driver’s licence number. It is used only to provide the service.

13Security

We take reasonable steps to protect the information we hold. Each business’s records are kept apart from every other’s. What a person can see and do is set by their role. Our own staff reach a business’s account only through logged, timed sessions. The Security page describes these measures, and what we have not built yet.

No system is completely secure, and we cannot guarantee that information will never be reached by someone who should not have it. Keep your password to yourself, and tell us straight away if you think your account has been used by someone else.

If we learn that personal information has been exposed in a way the law requires us to report, we will tell the people affected, or the business whose records they are, and any authority we must tell, as the law requires.

Read the Security page

14Where information is kept

Cultivar is run from the United States and is offered only to businesses in the United States. It is not offered to people or businesses in other countries. The companies we run on may process information in the United States and in other countries where they operate.

If you use the website from outside the United States, your information will be handled in the United States, where privacy law may differ from the law where you live.

15Children

Cultivar is software for licensed businesses and the adults who work for them. The website and the product are not directed at anyone under 21, and we do not knowingly collect personal information from anyone under 21. A shop’s online store is for adults of legal age to buy cannabis in the shop’s state, and the shop is responsible for checking that.

If you believe a child or anyone under 21 has given us personal information, use the Contact page and we will delete it.

16Changes to this policy

We will change this policy as Cultivar changes. The current version is always on this page, and the date at the top shows when it was last changed. If a change significantly affects how we handle personal information we already hold, we will take reasonable steps to tell business users, for example by email or in the product.

The new version applies from the day it is posted. If you keep using the website or the product after that day, the new version applies to you.

17Contact

For a question about this policy, or to make a request about your own information, use the Contact page.

If you ordered from or drive for a shop that runs on Cultivar, contact the shop first. Its contact details are on its own site.