Privacy Policy

We collect the information needed to run a cannabis operations platform: account details for operator employees, transaction data for orders, and customer profiles (including IDs and medical recommendations where applicable) for the operators we serve. We don't sell personal information. We don't share it outside of what's required to deliver the service or comply with regulators. We let you export and delete your data on request.

• Operator account data — name, email, phone, role for employees of operators using Kushify.
• Customer data on behalf of operators — name, email, phone, date of birth, ID photos, medical recommendation documents, order history. We are the data processor; the operator is the data controller.
• Transaction data — order details, line items, prices, taxes, payment status. We do not store full payment card numbers; those are handled by your payment processor.
• Operational logs — every status transition, override, refund, and verification decision is logged for audit purposes.
• Technical data — IP addresses, browser type, device identifiers, and basic analytics for the operation of the service.

• To operate the platform and deliver the features customers have subscribed to.
• To meet cannabis compliance reporting obligations on behalf of operators (Metrc, BioTrack, Leaf Data, state regulators).
• To respond to support requests and improve the service.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with our legal obligations.

• Sub-processors — cloud hosting (AWS), database (Postgres on managed infrastructure), email (SES/Mailjet/Brevo), SMS (Twilio/Plivo), and a small number of operational tools. A full list is available on request.
• Operators — customer data is provided to the operator that owns the storefront where the customer made a purchase. Operators are responsible for how they use that data.
• Regulators — when required by state cannabis traceability systems or by lawful request.
• Never sold. We do not sell personal information to anyone for any purpose.

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal information. To exercise these rights, email [email protected]. If you are a customer of an operator using Kushify, you should typically request these rights through the operator directly; we will support them in fulfilling your request.

We retain transaction and audit data for the period required by state cannabis regulators (typically 3-7 years). Account data is retained while the operator account is active and for 90 days after cancellation. Customer profile data is retained according to the operator's retention policy. ID and medical recommendation photos are retained for the period required by the operator's state.

See our security page for specifics. Short version: TLS 1.3 in transit, AES-256 at rest, row-level scoping at the database, audit logging on every sensitive operation, annual third-party pentests.

Kushify is not directed at anyone under 21. Cannabis storefronts running on Kushify enforce age gates and ID verification. If you believe a minor has provided us with personal information, contact us and we will delete it.

We will update this policy from time to time. Material changes will be communicated to operator account owners via email. The "Last updated" date at the top of this page always reflects the current version.

Privacy questions: [email protected]
Mail: Kushify · Los Angeles, CA
Phone: (888) 836-6322