Privacy Policy

1. Information We Collect

When you create an account, we collect your name, email address, and a hashed password. We also collect information you enter into the platform, including inventory data, product details, batch records, and movement logs associated with your dispensary account.

We automatically collect certain usage data when you access TraceRoot, including IP address, browser type, pages visited, and timestamps. This data is used solely to operate and improve the service.

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve TraceRoot. Specifically, we use it to authenticate users, display inventory data scoped to your organization, and maintain audit logs. We do not sell your data to third parties.

3. Data Isolation

TraceRoot is a multi-tenant application. Each dispensary account is logically isolated — your inventory, products, users, and records are only accessible to authenticated users within your organization. We enforce this at the application and database level on every query.

4. Cookies and Sessions

We use session cookies to keep you logged in. Sessions are stored server-side and expire after 30 days of inactivity. We do not use tracking cookies or third-party advertising cookies.

5. Data Retention

We retain your account and inventory data for as long as your account is active. If you close your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law.

6. Security

We take reasonable technical measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and session-based authentication. No system is completely secure — if you believe your account has been compromised, contact us immediately.

7. Third-Party Services

We use a small number of third-party services to operate the platform, including cloud hosting and database infrastructure. These providers are contractually bound to handle your data in accordance with this policy and applicable law.

8. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us at hello@traceroot.io. We will respond within 30 days.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by posting a notice on the platform or emailing the address on file. Continued use of TraceRoot after changes take effect constitutes acceptance of the updated policy.

10. Contact

Questions about this policy can be directed to hello@traceroot.io.