Privacy Policy
Effective Date: February 10, 2026 · Last Updated: February 10, 2026
1. Introduction
Cannafront (“Cannafront,” “we,” “our,” or “us”) operates the website cannafront.ai (the “Site”) and provides white-label mobile application services to cannabis dispensaries (the “Services”). This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit our Site, use our mobile applications, or interact with our Services.
This Privacy Policy applies to all visitors to the Site, dispensary merchants who use our platform (“Merchants”), and end-users who interact with Cannafront-powered mobile applications (“App Users”). Please read this policy carefully. By using the Site or Services, you acknowledge that you have read and understood this Privacy Policy.
If you are a California resident, please see Section 10 (“Your California Privacy Rights”) for information about your rights under the California Consumer Privacy Act (“CCPA”).
2. Information We Collect
We collect personal information in the following categories:
2.1 Information You Provide Directly
| Source | Information Collected | Purpose |
|---|---|---|
| Demo Request Form | Full name, work email, dispensary/company name, number of locations, areas of interest | To respond to your demo request and schedule a product demonstration |
| Contact Form | Full name, email address, company/organization (optional), message content | To respond to your inquiry or message |
| Merchant Onboarding | Business name, contact information, dispensary license details, point-of-sale/ecommerce platform credentials, branding assets | To set up and configure your Cannafront-powered mobile application |
2.2 Information Collected Through Mobile Applications
When App Users interact with a Cannafront-powered mobile application, we may collect:
- Device identifiers and push notification tokens
- Product browsing behavior within the dispensary catalog (products viewed, searches performed, categories browsed)
- Saved favorites and re-order selections
- Interactions with AI-generated product recommendations
- App usage data (session duration, screens viewed, feature interactions)
- Device type, operating system, and app version
Important: Cannafront does not process checkout transactions, payment information, or government-issued identification. These remain handled by the dispensary’s existing ecommerce or point-of-sale provider.
2.3 Information Collected Automatically
When you visit the Site or use the Services, we automatically collect:
- IP address and approximate geographic location
- Browser type, operating system, and device information
- Pages visited, referring URL, and navigation patterns
- Date and time of access
- Analytics data collected through third-party analytics tools (see Section 5)
3. How We Use Your Information
We use the personal information we collect for the following purposes:
- Responding to demo requests and contact inquiries
- Providing, operating, and improving the Services
- Powering AI-driven product recommendations and smart notifications within merchant apps
- Sending merchant-approved push notifications to App Users
- Configuring and maintaining white-label mobile applications for Merchants
- Analyzing usage patterns to improve product features and user experience
- Detecting and preventing fraud, abuse, or security incidents
- Complying with legal obligations and responding to lawful requests
We do not sell personal information. We do not use personal information for purposes materially different from those disclosed in this Privacy Policy without providing notice and, where required, obtaining consent.
4. AI-Powered Features
Cannafront uses artificial intelligence to enhance the mobile experience for App Users. Our AI-powered features include:
- Smart Product Discovery: Our AI analyzes browsing behavior within a dispensary’s catalog to surface relevant product recommendations. These recommendations are based on in-app activity and are scoped to each individual dispensary.
- Intelligent Push Notifications: Our AI may generate suggested notification content based on user engagement patterns. All push notifications are reviewed and approved by the dispensary Merchant before delivery.
Important disclosures about our AI features:
- AI recommendations are not medical advice and do not constitute endorsement of any product for any specific purpose.
- Merchants maintain full control over which AI-generated suggestions are approved and delivered to App Users.
- You may opt out of personalized recommendations by contacting us at privacy@cannafront.ai.
5. Third-Party Service Providers
We share personal information with the following categories of third-party service providers who assist us in operating the Services:
| Provider | Category | Data Shared |
|---|---|---|
| Resend | Email delivery | Name, email, company, and message content from form submissions |
| Google Fonts | Web font hosting | Visitor IP addresses (via CDN requests) |
| Analytics Provider | Website/app analytics | Usage data, device info, IP address |
All third-party service providers are contractually obligated to use personal information only for the purposes of providing their services to us and are prohibited from selling or using it for their own purposes.
6. Dispensary Merchant Data Relationships
Cannafront provides Services to dispensary Merchants, who authorize us to power mobile engagement experiences for their customers. In this context:
- For Merchant data: We act as a service provider (as defined under CCPA) processing data on behalf of the Merchant pursuant to a Data Processing Agreement.
- For App User data: The dispensary Merchant and Cannafront may each have independent obligations regarding App User data. The Merchant’s own privacy policy governs how the Merchant uses customer data obtained through their dispensary operations.
- For Site visitor data: Cannafront is the sole controller of personal information collected through the Site (demo requests, contact forms, analytics).
7. Cannabis-Specific Data Handling
We recognize that information related to cannabis product browsing and purchasing behavior is sensitive. We take the following specific measures to protect this data:
- We do not sell, share for cross-context behavioral advertising, or otherwise monetize cannabis-related browsing or purchasing behavior data.
- Cannabis product interaction data is scoped per dispensary and is not aggregated across dispensaries or shared with other Merchants.
- We comply with applicable state cannabis privacy laws, including California Business and Professions Code Section 26162 and related provisions requiring protection of consumer information in the cannabis industry.
- Law enforcement requests: We will not voluntarily disclose cannabis-related consumer data to law enforcement. We will only provide such data in response to a valid, legally binding order (such as a warrant or court order) directed specifically at Cannafront, and we will provide notice to affected individuals to the extent permitted by law.
8. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.
| Data Category | Retention Period |
|---|---|
| Contact/demo request submissions | 24 months from submission |
| Merchant account data | Duration of service agreement + 12 months |
| App User engagement data | 18 months of inactivity |
| Analytics/usage data | 26 months (aggregated thereafter) |
| Push notification tokens | Until opt-out or app uninstall |
When personal information is no longer needed, we securely delete or anonymize it. Aggregated, de-identified data that cannot reasonably be used to identify an individual may be retained indefinitely for analytics purposes.
9. Data Security
We implement commercially reasonable technical and organizational security measures to protect personal information, including:
- Encryption of data in transit (TLS/HTTPS) and at rest
- Access controls limiting data access to authorized personnel on a need-to-know basis
- Regular security reviews of our systems and third-party integrations
- Incident response procedures for potential data breaches
No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security.
10. Your California Privacy Rights (CCPA)
If you are a California resident, the California Consumer Privacy Act (“CCPA”) provides you with the following rights:
- Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.
- Right to Delete: You may request deletion of personal information we have collected, subject to certain legal exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt-Out of Sale/Sharing: We do not sell personal information or share it for cross-context behavioral advertising.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
To exercise your rights, contact us at privacy@cannafront.ai. We will verify your identity before processing your request and respond within 45 days, with a possible 45-day extension if necessary.
Categories of Personal Information Collected
| CCPA Category | Examples | Sold or Shared? |
|---|---|---|
| Identifiers | Name, email, device identifiers | No |
| Commercial information | Product browsing history, favorites | No |
| Internet/electronic network activity | Browsing history, app usage, IP address | No |
| Professional/employment info | Company name, job role (from forms) | No |
| Inferences | Product preferences from AI recommendations | No |
11. Age Restrictions
Cannabis products are restricted to individuals aged 21 and older in the jurisdictions where our Merchant partners operate. Cannafront-powered mobile applications include an age verification gate at first launch. By using any Cannafront-powered application, you represent and warrant that you are at least 21 years of age.
We do not knowingly collect personal information from individuals under the age of 21. If we become aware that we have collected personal information from a person under 21, we will take steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact us at privacy@cannafront.ai.
12. Cookies and Tracking Technologies
Our Site and Services may use the following tracking technologies:
- Essential cookies: Required for the Site to function properly (e.g., session management, security).
- Analytics cookies: Used to understand how visitors interact with the Site. We use analytics tools to collect anonymized usage data.
- Push notification tokens: Device-specific identifiers used to deliver push notifications within mobile applications. You can manage push notification permissions through your device settings.
We do not use advertising or retargeting cookies. We do not engage in cross-site tracking. You can control cookies through your browser settings.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the “Last Updated” date at the top of this policy
- Post the updated policy on the Site
- For material changes affecting App Users, provide notice through the mobile application
- For material changes affecting Merchants, provide direct notice via email
Your continued use of the Site or Services after the updated Privacy Policy is posted constitutes your acceptance of the changes.
14. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us: