Your information should have a defined job.

The public Website can use limited technical and first-touch information needed to operate the site, understand acquisition and preserve a referral into the CannaTally application. The intended acquisition record is deliberately small: a random visitor identifier, first-seen time, landing path, referrer host and campaign parameters when present.

CannaTally.com and CannaTally.me are separate domains. A short-lived opaque handoff reference can connect a Website visit to a later account event without placing an email address, cannabis history, medical information or other sensitive account data in the URL.

When you contact CannaTally, the Website collects the contact and request details you submit so a tracked support case can be created and staff can respond. Do not include passwords, sign-in codes, full payment-card numbers or unnecessary medical information in a support request.

Account details, products, purchases, journal entries, allotment records, scans and settings belong to the signed-in application experience. They are not Website acquisition analytics and should not be copied into public Website telemetry.

Information is used to operate and secure CannaTally, provide requested features and support, connect acquisition steps when appropriate, prevent abuse, troubleshoot problems and meet legal obligations. We do not treat cannabis history as an advertising profile.

CannaTally’s Website acquisition design does not require cannabis usage, inventory, allotment history, product history, medical conditions, precise location, device fingerprinting or session replay. Sensitive information should not be collected merely because it might be useful later.

CannaTally can use infrastructure and communications providers to perform specific services on its behalf. Access should be limited to what the provider needs for that service. Purelymail can provide support-mailbox and email transport functions; the application support case, not an email inbox, is the authoritative support record.

Administrative access does not automatically justify access to sensitive customer information. Technical and organizational controls should limit access according to role and need, while secrets used for Website-to-application integration remain server-side.

Where the applicable product controls are available, customers can review or correct account information and use supported account controls for export or deletion. Privacy or data questions can be submitted through Contact CannaTally.

Information should be retained only for as long as needed for the documented purpose, security, support, legal obligations or legitimate operational requirements, then deleted or de-identified according to the applicable retention process. Different records can require different retention periods.

Cannabis records can be sensitive. CannaTally designs privacy and incident-response controls with that sensitivity in mind. Whether a particular privacy or breach-notification law applies depends on the facts and applicable law; this Policy does not claim that sensitive information falls outside those protections.