Privacy Policy

Last updated: June 2026

Overview

SeedLink provides live, METRC-synced wholesale menu software to licensed cannabis cultivators. This policy explains what we collect, why, and how we handle it. It covers the SeedLink website and dashboard. It does not change any separate agreement you have with us.

Information we collect

Account information. When a cultivator requests access or signs up, we collect name, email, phone number, password, and the cannabis license you operate under.
Inventory data from METRC. With your connection, we pull your active packages (strains, quantities, lab results, package labels) from the state track-and-trace system to build your menu. METRC API credentials are encrypted at rest.
Menu engagement data. When a buyer opens a menu link you sent, we record the open, products viewed, time spent, and any “interested” or order actions. IP addresses are hashed (one-way) before storage; we do not retain raw IPs.
Buyer contact details. To place an order, a buyer provides a name and email. There is no buyer account — the per-dispensary link is the identity layer.

How we use information

We use this data to operate the product: sync and display your menu, deliver engagement notifications, generate orders and invoices, support your account, and improve the service. We do not sell personal information.

Service providers

We share data only with the vendors that run the product, under their respective terms:

Supabase — database, authentication, and realtime infrastructure.
Vercel — application hosting.
Resend — transactional and notification email.
PostHog — product analytics for the cultivator dashboard (buyer menus are excluded; automatic event capture is disabled to avoid collecting buyer details).
METRC — the state cannabis track-and-trace system we sync inventory from.

Data security

Data is encrypted in transit (HTTPS) and access is governed by row-level security so each cultivator can reach only their own data. METRC credentials are encrypted with AES-256-GCM. No system is perfectly secure, but we work to protect your information.

Data retention

We keep account and engagement data for as long as your account is active or as needed to provide the service and meet legal and regulatory obligations. You can ask us to delete your account data, subject to records we must retain by law.

Your choices

Cultivators can update account details in Settings and disconnect METRC at any time. Notification emails include an unsubscribe option. To request access, correction, or deletion of your data, contact us.

Contact

Questions about this policy? Reach us through the contact page.

Information we collect

Account information. When a cultivator requests access or signs up, we collect name, email, phone number, password, and the cannabis license you operate under.
Inventory data from METRC. With your connection, we pull your active packages (strains, quantities, lab results, package labels) from the state track-and-trace system to build your menu. METRC API credentials are encrypted at rest.
Menu engagement data. When a buyer opens a menu link you sent, we record the open, products viewed, time spent, and any “interested” or order actions. IP addresses are hashed (one-way) before storage; we do not retain raw IPs.
Buyer contact details. To place an order, a buyer provides a name and email. There is no buyer account — the per-dispensary link is the identity layer.

Service providers

We share data only with the vendors that run the product, under their respective terms:

Supabase — database, authentication, and realtime infrastructure.
Vercel — application hosting.
Resend — transactional and notification email.
PostHog — product analytics for the cultivator dashboard (buyer menus are excluded; automatic event capture is disabled to avoid collecting buyer details).
METRC — the state cannabis track-and-trace system we sync inventory from.