Privacy Policy

Weed POS provides point-of-sale and retail operations software for Oklahoma dispensaries licensed by the Oklahoma Medical Marijuana Authority (OMMA). This policy explains what personal information we handle, why we handle it, who receives it and the choices you have. It applies to weedpos.us, the Weed POS platform, and our sales and support conversations.

Different people meet Weed POS in different ways, so this policy speaks to four groups:

• Dispensary operators. Owners, managers and others who buy, set up or administer Weed POS for a licensed dispensary.
• Dispensary staff. Budtenders and other employees whose logins, shifts and activity are recorded in the platform.
• Patients and caregivers. People who shop at a dispensary that runs on Weed POS.
• Website visitors. Anyone who browses weedpos.us or writes to us through it.

This policy does not cover how a dispensary handles information outside Weed POS, or the practices of other companies whose sites and services we link to or integrate with.

For information about our own relationships, such as operator accounts, billing, support requests, sales conversations and website analytics, Weed POS decides how the information is used and is responsible for it.

For the records a dispensary creates in the platform about its patients, caregivers and staff, the dispensary is in charge. We act as its service provider and process those records on its instructions, under its subscription agreement and our Terms of Service. The dispensary's own privacy notice explains how it uses that information.

If you are a patient or caregiver, your dispensary is the right first contact for questions about your record. If you write to us instead, we will pass your request to the dispensary and help it respond.

What we hold depends on how you interact with us.

We do not collect medical records, physician recommendations or diagnoses. The health-related information in the platform is limited to what a compliant sale requires, such as a patient license number and its expiration date. Because holding a patient license can show that someone uses medical marijuana, we treat every patient record as sensitive.

We use the information described above to:

• Provide, maintain and support the platform, including the integrations a dispensary switches on.
• Report sales and inventory to Metrc and produce the records OMMA requires.
• Create accounts, confirm license details and bill subscriptions.
• Answer demo requests, questions and support tickets.
• Send service notices about downtime, security and changes to our terms or this policy.
• Deliver the receipts, loyalty updates and offers a dispensary chooses to send to patients who have opted in.
• Monitor reliability, fix problems, and detect and prevent fraud or misuse.
• Understand how our marketing website is used so we can improve it.
• Meet legal obligations and enforce our agreements.

We do not sell personal information. We do not share it for cross-context behavioral or targeted advertising. We do not pass patient records to brands, advertisers or data brokers. We do not use dispensary operating data to train third-party AI or machine-learning models without the dispensary's written consent.

We may compile statistics that do not identify any person or dispensary, such as uptime, feature usage and overall transaction volumes, and use them to run and improve the platform.

We share personal information only in these situations:

• With the dispensary. Patient and staff records are available to the dispensary that created them, through the user roles it assigns.
• With regulators and the state tracking system. We send sales, inventory and transfer data to Metrc, and make records available to OMMA, as Oklahoma rules require and as the dispensary directs.
• With integrations a dispensary enables. When a dispensary connects a service such as Leafly, we exchange the data that integration needs. The other service's privacy policy governs what it holds.
• With service providers. Vendors that help us run the platform: cloud hosting (Amazon Web Services), application monitoring, email and text message delivery, and payment processing. Each is contractually bound to use the information only to provide its service to us. A current list of subprocessors is available on request.
• With website tools. Google Analytics measures traffic on weedpos.us, and contact form submissions reach our team through Telegram. These providers handle that information under their own terms and privacy policies.
• For legal reasons. When a law, subpoena, court order or regulator requires it, or when it is needed to protect the rights, safety or property of Weed POS, our customers or the public. We review each request and disclose only what is required. Where the law allows, we tell the affected dispensary first.
• In a business transfer. If Weed POS is involved in a merger, acquisition, financing or sale of assets, information may pass to the successor, which must continue to honor this policy. We will notify active operators if that happens.

weedpos.us uses Google Analytics 4 to understand how the site is used: which pages are viewed, how visitors arrive, what device and browser they use, and their approximate location based on IP address. Google Analytics sets first-party cookies (named _ga, and _ga_ followed by an ID) that last up to two years. The site also loads Google Tag Manager, a tool for managing measurement tags.

We do not run advertising pixels, session recording tools or cross-site fingerprinting on the marketing site.

You can block or delete cookies in your browser settings, and you can install Google's opt-out add-on to stop Google Analytics from measuring your visits on any site. The website works the same either way.

Because we do not sell personal information or share it for targeted advertising, there is nothing for a Global Privacy Control or Do Not Track signal to switch off. The site does not otherwise change its behavior in response to those signals.

The signed-in Weed POS application sets only the cookies needed to keep you logged in.

• How Google uses data from sites that use its services
• Google Analytics opt-out add-on

Dispensaries can use Weed POS to send receipts, loyalty updates and offers by text message or email. The dispensary is the sender and decides what goes out. Promotional messages go only to patients who have opted in.

To stop receiving messages, follow the opt-out instructions in the message or ask the dispensary to remove you. Message and data rates may apply to texts. We do not use patient phone numbers or email addresses for our own marketing.

We keep information only as long as we need it for the purposes in this policy or as the law requires.

Oklahoma rules require dispensaries to keep certain sales records, including the patient license number, whether or not a patient asks for deletion. If you ask us or your dispensary to delete information that is still inside a required retention period, we will tell you what has to stay and delete what does not, such as loyalty contact details and message preferences.

When a subscription ends, the dispensary can export its data before deletion. Deletion windows and procedures are described in the subscription agreement.

We protect information with technical and organizational safeguards, including:

• Encryption in transit with TLS 1.2 or higher and at rest with AES-256, with keys managed and rotated in AWS Key Management Service.
• Hosting in SOC 2 Type II audited data centers in the United States.
• Unique user accounts with role-based permissions for owners, managers and budtenders, granted on a least-privilege basis.
• An audit trail that records every privileged action with the operator, the time and the prior value.
• Encrypted nightly backups with regularly tested restores.
• Regular testing of our security controls.

If a security incident affects personal information, we notify the affected operators promptly and as the law requires, explain what happened and what information was involved, and help them notify patients, staff and regulators where that is needed.

No system can be guaranteed secure. Please use a strong, unique password, never share logins, and report suspected unauthorized access to support@weedpos.us right away.

You can ask to access, correct, export or delete personal information we hold about you, and to stop marketing messages. Depending on the state you live in, privacy law may give you further rights. All requests are subject to the recordkeeping rules that apply to licensed dispensaries.

• Operators and authorized users. Account administrators can view, correct and export most information directly in Weed POS settings. For anything else, email us.
• Dispensary staff. Your employer manages your record in the platform. Ask your manager or the account administrator first, and we will support them in responding.
• Patients and caregivers. Contact the dispensary where you shop. If you email us, we will forward your request to the dispensary and assist with it.
• Website visitors. Email us and we will handle your request directly.

To make a request, email support@weedpos.us with the subject line Privacy request. We may need to confirm your identity before we act. You can use an authorized agent if you give them written permission. We respond within 30 days. If we cannot do what you ask, for example because a record must be kept by law, we will explain why, and you can ask us to review that decision by replying to our response. We will not treat you differently for exercising a privacy right.

• Email a privacy request

weedpos.us and the Weed POS platform are intended for licensed dispensaries and their adult staff. We do not knowingly collect personal information from anyone under 18 through our website. If you believe a child has sent us information, contact us and we will delete it.

Oklahoma issues patient licenses to some minors under the care of a parent or legal guardian. When a dispensary serves such a patient or their caregiver, it records the sale as OMMA requires, and that record is handled as described in this policy.

Platform data is hosted in data centers in the United States and is not replicated outside the country. Some providers that support our website and communications, such as analytics and contact form delivery, may process information in other countries. If you contact us from outside the United States, your information will be transferred to and processed in the United States.

Our website and platform link to or connect with services we do not operate, including Metrc, Leafly, payment processors and the AI assistants linked in our footer. Their own terms and privacy policies apply to what they collect. Please read them before you share information with those services.

We revise this policy when our practices or the law change. The dates at the top of the page show the latest revision and when it takes effect. We email active operators about material changes at least 14 days before they take effect.

Questions about this policy or your information can be sent to support@weedpos.us. Our team is available Monday to Friday, 8am to 6pm Central. Postal mail can be addressed to Weed POS, Privacy Team, Oklahoma City, OK.

• Email support@weedpos.us
• Contact page