Privacy Policy

1.Who we are and what this policy covers

Happy Leaf (happyleaf.io) is a point-of-sale and compliance system for licensed cannabis dispensaries, operated by Liberty Marketplaces LLC, an Arizona limited liability company with its principal office at 4539 N 22nd St Ste R, Phoenix, Arizona 85016 (“Liberty,” “we,” “us” or “our”).

This policy applies to the happyleaf.io website, the Happy Leaf register, back office and apps, and the online-ordering, loyalty and reporting features connected with them (together, the “Service”). For information about our own customers, website visitors and contacts, we decide how it is used (in some laws, the “controller”). When a dispensary uses Happy Leaf, we handle its customers' information on the dispensary's behalf as its service provider (in some laws, the “processor”). See Section 3.

This policy does not apply to websites and services operated by others, even if we link to them. Capitalized terms not defined here have the meaning given in our Terms of Service.

2.Information we collect

Information you give us

• Account and store information, such as your name, email address, phone number, store name and address, license details, the staff logins and roles you create, and your products, inventory, prices, sales, cash-drawer records and settings.
• Payment information. If you pay for a plan, our payment processor collects your card details. We receive only limited information, such as the card type, last four digits and expiry date.
• Communications with us, such as support requests and feedback.

Information collected automatically

• Log and device data. When you use the Service, our servers and hosting providers automatically record technical information such as your IP address, browser type and version, operating system, the pages and features you use, referring page, and the date and time. We use it to deliver the Service, keep it secure and fix problems.
• Approximate location. A general location (such as city or region) can be inferred from an IP address. We do not collect precise location.
• Cookies. We use only the cookies the Service needs to work. See Section 6.

Information from other sources

• Dispensary customers, when a store uses Happy Leaf to serve them (see Section 3).
• The state's cannabis tracking system, through the store's own account, when Happy Leaf exchanges sales and inventory information with it for the store.
• Partners a store connects, such as cashless and debit payment providers and online-ordering services, for example when an online order arrives.
• Service providers, such as payment confirmations from our payment processor.

3.Information about dispensary customers

When a dispensary uses Happy Leaf to serve its customers, we process on the store's behalf:

• the customer's name and contact details, such as phone number and email address;
• date of birth and information from an ID, used to confirm the customer is 21 or older as the law requires;
• medical marijuana cardholder status and card expiration date, where the customer is a medical patient, used to apply medical purchase limits, prices and taxes;
• purchase history, purchase limits used, loyalty points and rewards;
• online and phone orders, including pickup time and, for delivery, the delivery address; and
• payment transaction records (never full card or bank account numbers).

Medical cardholder status is sensitive health-related information. It is used only to apply the rules, prices and taxes the law sets for medical patients, and never for marketing or any other purpose.

State reporting. Arizona requires licensed dispensaries to report sales and inventory to the state's tracking system. Happy Leaf sends those reports for the store, using the store's own account.

This information belongs to the dispensary. We process it only to provide Happy Leaf to that store under our Terms with it, and we never sell it or use it to market to the store's customers ourselves. The store is responsible for its own privacy notice and for the reporting and record-keeping rules that apply to it. Questions or requests should go to the store first; if you contact us, we will pass your request to the store and help it respond.

4.How we use information

We use personal information to:

• provide, operate, maintain and support the Service, including the features you choose to use;
• create and secure accounts, verify identity and prevent unauthorized access;
• process payments, send invoices and receipts, and keep financial records;
• communicate with you about the Service, including service messages, security alerts, support responses and changes to our terms or policies;
• run the register, inventory, ID and purchase-limit checks, loyalty, online orders and state reporting for the dispensaries that use Happy Leaf;
• monitor, troubleshoot, measure and improve the Service and develop new features;
• detect, investigate and prevent fraud, abuse, spam, security incidents and violations of our Terms;
• comply with laws, regulations, legal process, and tax and accounting obligations, and establish, exercise or defend legal claims; and
• for any other purpose we describe when we collect the information, or with your consent.

We may create de-identified or aggregated information that can no longer reasonably identify anyone. We use it only for lawful business purposes and will not attempt to re-identify it, except to confirm that our de-identification works.

We do not use automated processing to make decisions about you that produce legal or similarly significant effects.

5.How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We disclose personal information only as follows:

• Service providers that perform services for us, such as website hosting, database and file-storage providers, our payment processor for plan billing, and email-delivery providers. They may use the information only to provide their services to us and are bound by confidentiality and security obligations.
• The dispensary. Customer information is shared with the store that served the customer and the staff it authorizes.
• State regulators. Sales and inventory reports go to the state's cannabis tracking system through the store's own account, and records may be disclosed to regulators when the law requires.
• Partners the store connects, such as payment and online-ordering providers, as needed to complete a transaction.
• Professional advisers, such as accountants, auditors, insurers and banks, under duties of confidentiality.
• Legal and safety: when we believe in good faith that disclosure is necessary to comply with a law, regulation, subpoena, court order or other legal process or valid government request; to enforce our agreements; to protect the rights, property or safety of Liberty, our users or others; or to detect, prevent or address fraud, security or technical issues.
• Business transfers: in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, receivership or sale of all or part of our business or assets. Any recipient must honor this policy for the information it receives.
• With your consent or at your direction, for example when you connect another service to your account.

We may also share de-identified or aggregated information that cannot reasonably identify anyone.

6.Cookies and similar technologies

We use only strictly necessary cookies and similar storage that the Service needs to work, such as a sign-in cookie for the store owner, a cookie that remembers which store you are working in, and security tokens used during sign-in. We do not use advertising cookies, third-party analytics or tracking pixels, and we do not track you across other websites.

Do Not Track and Global Privacy Control. Because we do not track users across websites, we do not respond differently to “Do Not Track” browser signals. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of any sale or sharing of personal information, although we do neither.

7.How long we keep information

We keep personal information only as long as reasonably necessary for the purposes described in this policy, unless the law requires or permits a longer period. As a guide:

• Account and store information: while the store's account is open.
• Sales, inventory, ID-check and customer records: while the store's account is open and for as long as state record-keeping rules require. When a store closes its account, we delete its data, except what the law requires us to keep.
• Billing and transaction records: as long as tax, accounting and legal rules require, generally at least seven years.
• Support correspondence: generally up to three years after it is resolved.
• Log data: for a limited period set by our hosting providers.

We may keep information longer where necessary to resolve disputes, enforce our agreements or comply with a legal hold. When information is no longer needed, we delete or de-identify it; copies held in backups are removed on the backups' normal schedule.

8.How we protect information

We use reasonable administrative, technical and physical safeguards designed to protect personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction. These include encryption in transit (HTTPS) across the Service, encryption at rest provided by our hosting and database providers, access limited to people who need it to do their jobs, individual sign-ins, and periodic review of our security practices. Payment card numbers are handled by our payment processor and never stored on our systems.

You are responsible for keeping your sign-in methods secure and for telling us promptly at hello@happyleaf.io if you believe your account has been compromised. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If we learn of a security breach that affects your personal information, we will notify you, and our business customers where their data is affected, as required by law.

9.Third-party services and links

The Service may link to or work with websites, products and services we do not operate, such as the state's cannabis tracking system, payment providers and online-ordering services. We are not responsible for their content or privacy practices, and this policy does not apply to them. Their own terms and privacy policies govern your use of them.

10.Where we process information

Liberty is based in the United States, and we and our service providers store and process information in the United States. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States, where data-protection laws may differ from those in your country. Where the law requires, we take steps to provide appropriate safeguards for such transfers.

11.Your privacy rights and choices

Your choices

• Account information. You can review and update much of your account information in the Service at any time.
• Marketing emails. You can opt out of marketing emails at any time by using the unsubscribe link or emailing hello@happyleaf.io. We may still send service messages about your account.
• Store data. Store owners can export their products, stock and customers at any time.

Your rights

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you, including the categories, sources, purposes and recipients;
• correct inaccurate personal information;
• delete personal information we hold about you;
• receive a copy of your personal information in a portable format;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do none of these);
• limit the use of sensitive personal information (we use it only for the purposes the law permits);
• withdraw consent where we rely on it; and
• appeal our decision about a request.

We extend these rights to everyone, wherever you live, subject to the exceptions the law allows (for example, information we must keep to comply with the law or to complete a transaction).

How to make a request

Email hello@happyleaf.io with “Privacy request” in the subject line, or write to us at the address in Section 16. To protect your information, we will verify your identity by matching information we already hold, for example by confirming the request from the email address on your account, and we may ask for more information if needed. You may use an authorized agent; we will ask for your signed permission and may ask you to verify your identity directly with us. We will respond within 45 days, and if we need more time (up to another 45 days, where the law allows) we will tell you why. Requests are free unless they are manifestly unfounded or excessive. If we cannot fully meet a request, we will explain why.

If your request is about information a dispensary holds about you as its customer, that store is responsible for it. We will pass your request to the store and help it respond. Some records, such as sales and ID-check records, must be kept by law and cannot be deleted on request.

Appeals

If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line within 60 days. We will respond within the time the law requires. If we deny your appeal, you may contact your state's attorney general.

No discrimination

We will not deny you the Service, charge you a different price or give you a different level of quality because you exercised any of these rights.

12.Children's privacy

Happy Leaf is for licensed dispensaries and their adult customers. We do not knowingly collect personal information from anyone under 21, except as needed to refuse a sale. If you believe someone under 21 has given us personal information, contact us and we will help the store address it.

13.Additional information for U.S. state residents

California

This section supplements this policy for California residents under the California Consumer Privacy Act, as amended (“CCPA”). In the past 12 months we have collected the following categories of personal information, from the sources, for the purposes and disclosed for business purposes to the recipients shown:

• No sale or sharing. We have not sold or shared (for cross-context behavioral advertising) personal information in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.
• Sensitive personal information. We use and disclose it only for purposes the CCPA permits, and never to infer characteristics about you.
• Retention. We keep each category for the periods described in Section 7.
• Shine the Light. We do not disclose personal information to third parties for their own direct-marketing purposes.
• Financial incentives. We do not offer financial incentives in exchange for personal information.
• Your rights. You may exercise the rights described in Section 11, including through an authorized agent.

Other states

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with consumer privacy laws may have the rights described in Section 11, including the right to appeal. We honor them for everyone.

Nevada

We do not sell covered information as defined under Nevada law. You may still submit an opt-out request to hello@happyleaf.io.

14.Visitors from the EEA, UK and Switzerland

If data-protection laws of the European Economic Area, the United Kingdom or Switzerland apply to you, we process your personal information on the following legal bases: to perform our contract with you or take steps at your request before entering into one; for our legitimate interests in providing, securing and improving the Service, communicating with customers and business contacts, and defending legal claims, where those interests are not overridden by your rights; to comply with legal obligations; and, where required, with your consent, which you may withdraw at any time.

You may have the right to access, correct, delete, restrict or object to our processing of your personal information (including objecting at any time to direct marketing), to data portability, and to withdraw consent. To exercise these rights, contact us as described in Section 11. You also have the right to lodge a complaint with your local data-protection supervisory authority.

15.Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date above. If we make material changes, we will give more prominent notice, such as a notice in the Service or an email to account holders, before the changes take effect where the law requires. Earlier versions are available on request.

16.Contact us

If you have questions about this policy or our privacy practices, or want to exercise your rights, contact us:

Please include “Privacy” in the subject line so your message reaches the right person quickly.