Cannafront Privacy Policy

Effective Date: January 1, 2026
Last Updated: January 1, 2026

1. Introduction

Cannafront ("Cannafront," "we," "our," or "us") operates the website cannafront.ai (the "Site") and provides white-label mobile application services to cannabis dispensaries (the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our Site, use Cannafront-powered mobile applications, or otherwise interact with our Services.

This Privacy Policy applies to:

Site Visitors who visit or interact with the Site;
Merchants (dispensary businesses) that use our platform; and
App Users who use mobile applications powered by Cannafront on behalf of a Merchant.

By using the Site or Services, you acknowledge that you have read and understood this Privacy Policy.

If you are a California resident, see Section 10 (Your California Privacy Rights).

2. Information We Collect

We collect personal information in the following categories:

2.1 Information You Provide Directly

Demo Request Form

Information: full name, work email address, dispensary/company name, number of locations, areas of interest, page URL
Purpose: respond to your request and schedule a product demonstration

Contact Form

Information: full name, email address, company/organization (optional), message content, page URL
Purpose: respond to your inquiry or message

Merchant Onboarding

Information: business name, business contact information, dispensary license details, point-of-sale/ecommerce platform credentials, branding assets
Purpose: set up and configure your Cannafront-powered mobile application

2.2 Information Collected Through Mobile Applications

When App Users interact with a Cannafront-powered mobile application, we may collect:

Device identifiers and push notification tokens
Product browsing behavior within the dispensary catalog (e.g., products viewed, searches performed, categories browsed)
Saved favorites and re-order selections
Interactions with AI-generated product recommendations
App usage data (e.g., session duration, screens viewed, feature interactions)
Device type, operating system, and app version

Important: Cannafront does not process checkout transactions, payment information, or government-issued identification. Those functions remain handled by the Merchant and/or the Merchant's ecommerce or point-of-sale provider(s).

2.3 Information Collected Automatically

When you visit the Site or use the Services, we automatically collect:

IP address and approximate geographic location
Browser type, operating system, and device information
Pages visited, referring URL, and navigation patterns
Date and time of access
Analytics data collected through third-party analytics tools (see Section 5)

3. How We Use Your Information

We use personal information for the following purposes:

Responding to demo requests and contact inquiries
Providing, operating, maintaining, and improving the Services
Powering AI-driven product recommendations and smart notifications within Cannafront-powered apps
Sending Merchant-approved push notifications to App Users
Configuring and maintaining white-label mobile applications for Merchants
Analyzing usage patterns to improve features and user experience
Detecting and preventing fraud, abuse, or security incidents
Complying with legal obligations and responding to lawful requests

We do not sell personal information. We do not use personal information for purposes materially different from those disclosed in this Privacy Policy without providing notice and, where required, obtaining consent.

4. AI-Powered Features

Cannafront uses artificial intelligence to enhance the mobile experience for App Users. AI-powered features may include:

Smart Product Discovery: analyzing in-app browsing behavior within a Merchant's catalog to generate product recommendations. Recommendations are based on in-app activity and are scoped to the applicable Merchant.
Intelligent Push Notifications: generating suggested notification content based on engagement patterns. All push notifications are reviewed and approved by the Merchant before delivery.

Important disclosures:

AI recommendations are not medical advice and do not constitute endorsement of any product for any specific purpose.
Merchants control whether any AI-generated suggestions are approved and delivered.
You may opt out of personalized recommendations by contacting us at privacy@cannafront.ai.

5. Third-Party Service Providers

We may share personal information with third-party service providers that help us operate the Site and Services. Categories may include:

Email delivery and communications providers (e.g., to deliver form submission notifications)
Infrastructure and cloud hosting providers (e.g., to host the Site and Services)
Analytics providers (e.g., to understand how visitors and users interact with the Site and Services)
Font/content delivery providers (e.g., when loading web fonts via a CDN)

These providers are permitted to use personal information only to perform services for us and are contractually restricted from selling or using it for their own independent purposes.

6. Dispensary Merchant Data Relationships

Cannafront provides Services to Merchants that authorize us to power mobile engagement experiences for their customers. In this context:

Merchant Data: We generally act as a service provider/processor processing data on behalf of the Merchant under applicable agreements.
App User Data: The Merchant's own privacy policy governs how the Merchant uses customer data obtained through the Merchant's dispensary operations and systems. Cannafront and the Merchant may have independent obligations depending on the context and applicable law.
Site Visitor Data: Cannafront is the controller of personal information collected through the Site (e.g., demo requests, contact forms, and Site analytics).

7. Cannabis-Specific Data Handling

We recognize that cannabis-related browsing and purchasing behavior can be sensitive. Accordingly:

We do not sell, share for cross-context behavioral advertising, or otherwise monetize cannabis-related browsing or purchasing behavior data.
Cannabis product interaction data is scoped per dispensary and is not shared with other Merchants.
We seek to comply with applicable cannabis privacy requirements, including California Business and Professions Code Section 26162 and related provisions requiring protection of consumer information in the cannabis industry.
Law enforcement requests: We do not voluntarily disclose cannabis-related consumer data to law enforcement. We disclose only in response to a valid legally binding order (such as a warrant or court order) directed specifically to Cannafront, and we will provide notice to affected individuals when permitted by law.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Typical retention periods include:

Contact/demo request submissions: up to 24 months from submission
Merchant account/onboarding data: duration of the service agreement + up to 12 months for wind-down and operational needs
App User engagement data: up to 18 months of inactivity (or earlier upon request, where applicable)
Analytics/usage data: up to 26 months (aggregated or de-identified thereafter)
Push notification tokens: until opt-out or app uninstall (or loss/rotation of token)

When personal information is no longer needed, we securely delete or anonymize it. Aggregated or de-identified data that cannot reasonably be used to identify an individual may be retained for analytics and product improvement purposes.

9. Data Security

We implement commercially reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, including:

Encryption in transit (TLS/HTTPS) and at rest (where applicable)
Access controls limiting access to authorized personnel on a need-to-know basis
Security reviews of systems and third-party integrations
Incident response procedures for potential data breaches

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect personal information, we cannot guarantee absolute security.

10. Your California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act ("CCPA") provides certain rights regarding your personal information, subject to exceptions:

Right to Know: request disclosure of the categories and specific pieces of personal information collected, categories of sources, purposes for collection, and categories of third parties with whom we share personal information.
Right to Delete: request deletion of personal information collected from you, subject to legal exceptions.
Right to Correct: request correction of inaccurate personal information we maintain about you.
Right to Opt-Out of Sale/Sharing: we do not sell personal information or share it for cross-context behavioral advertising. If we ever change this, we will provide a "Do Not Sell or Share My Personal Information" link on the Site.
Right to Non-Discrimination: we will not discriminate for exercising your CCPA rights.

How to exercise your rights: Contact us at privacy@cannafront.ai. We will take reasonable steps to verify your identity before processing requests. We aim to respond within 45 days, and may extend by an additional 45 days when permitted (with notice).

Categories of personal information collected (prior 12 months):

Identifiers: name, email address, device identifiers (Not sold/shared)
Commercial information: product browsing history, favorites, dispensary affiliation (Not sold/shared)
Internet/electronic network activity: Site browsing and app usage data, IP address (Not sold/shared)
Professional/employment information: company name, job role (from contact forms) (Not sold/shared)
Inferences: product preferences derived from browsing behavior (e.g., for recommendations) (Not sold/shared)

11. Age Restrictions

Cannabis products are restricted to individuals aged 21 and older in jurisdictions where our Merchant partners operate. Cannafront-powered applications may include an age gate at first launch.

We do not knowingly collect personal information from individuals under 21. If we learn we collected personal information from a person under 21, we will take steps to delete it. If you believe a minor provided us personal information, contact privacy@cannafront.ai.

12. Cookies and Tracking Technologies

The Site and Services may use:

Essential cookies required for the Site to function (e.g., security, session management)
Analytics technologies to understand how visitors interact with the Site and Services (e.g., usage events, device info, IP address)
Push notification tokens used to deliver push notifications within mobile applications (you can manage permissions via device settings)

We do not use third-party advertising cookies for behavioral advertising, and we do not engage in cross-site retargeting.

You can control cookies through your browser settings. Disabling cookies may affect certain Site functionality but will not prevent access to core content.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last Updated" date above
Post the updated policy on the Site
For material changes affecting App Users, provide notice in-app or via push notification (if opted in)
For material changes affecting Merchants, provide notice via email

Your continued use of the Site or Services after updates are posted constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise privacy rights, contact us:

Cannafront
Email: privacy@cannafront.ai
General Inquiries: hello@cannafront.ai
Website: cannafront.ai