Who we are
BudMetrics is a retail analytics service for licensed cannabis dispensary operators. It is provided by Green Growth CPAs (“we”, “us”). This policy explains what information we collect when you use BudMetrics and the website at budmetrics.ai, how we use and share it, and the choices you have.
BudMetrics is sold to businesses. Our customers (“stores” or “clients”) decide which of their systems to connect and which of their staff can sign in. For the business data a store connects, we act on that store’s behalf and follow its instructions.
The short version
- We use your data only to provide BudMetrics to your business. We do not sell it and we do not use it for advertising.
- Connecting Gmail is optional. If a store connects it, we read only what we need to find emails from that store’s vendors, and we never store other emails.
- AI suggestions, including purchase-order drafts, are reviewed by a person before anything happens. BudMetrics never places an order on its own.
- We do not use your data, or data from Google, to train generalized AI models, and our AI providers do not train on it either.
- You can ask us to see, correct, export or delete your data at gagan@budmetrics.ai.
Information we collect
Account information
When you sign in we receive your name and email address from the sign-in method you use (Sign in with Microsoft, or an emailed sign-in link). We also keep the stores, applications and role your administrator has given you.
Business data from systems a store connects
When a store connects one of its systems, we import the data needed to run the features it uses:
- Point-of-sale (POS) systems, such as Dutchie and Flowhub: sales transactions, products, inventory, discounts, staff (budtender) activity and store settings.
- Store customer records held in the POS, such as a customer’s name, contact details and purchase history, used for retention reports and for the win-back emails a store chooses to send.
- QuickBooks Online: financial reports and the account and transaction detail behind them.
- LeafLink: wholesale catalogs, prices and orders for the store’s buyer account.
- Gmail, only if a store connects it. See Google user data below.
Credentials for these connections (API keys and access tokens) are stored encrypted or in restricted server-side storage and are never shown back to users.
Public market data
We collect publicly available menu and price information from other dispensaries’ websites and online menus to show a store how its prices compare with nearby shops. We may also use aggregated, third-party foot-traffic statistics about store locations. Neither contains personal information about your customers.
Usage, cost and technical logs
We record how the service is used so we can run, secure and bill for it: sign-ins, pages and features used, the AI requests made and their cost, background job results, errors, IP addresses and browser details. Your browser also stores a sign-in session and small preferences (such as light or dark theme) in local storage. We do not use advertising or cross-site tracking cookies.
Things you send us
If you fill in the demo request form or email us, we keep what you send (for example your name, business, email, phone number and message) so we can reply.
Google user data (Gmail)
The BudMetrics Buy Agent can read a store’s vendor emails to prepare purchase-order drafts. This is optional and off unless a store user with the right permissions connects a Gmail or Google Workspace mailbox and approves Google’s consent screen. This section explains exactly what we do with data we receive through Google APIs.
What we access
- We request one Google permission: read-only access to Gmail (
gmail.readonly). We cannot send, delete, move or change any email, label or setting. - About every 10 minutes we check the connected mailbox for new messages. For each new message we read only its header information: sender, subject, date, labels, Google’s sender authentication result, and the names, types and sizes of any attachments. We use that to decide whether the message comes from one of the store’s vendors.
- We open the attachments (or, if a vendor email has no usable attachment, the message text) only for emails from senders the store has marked as a trusted vendor, and only when Google has verified that the email really comes from that sender. We only open attachments that are price lists or menus in common formats (spreadsheet, CSV, PDF or image), up to 10 attachments of up to 10 MB each per email.
- We skip spam, trash, drafts and mail sent from the connected account itself.
Why we use it
We use vendor emails for one purpose: to read a vendor’s product and price list and turn it into a purchase-order draft that the store’s staff review in BudMetrics. Nothing is ordered and nothing is sent to the vendor automatically; a person decides what, if anything, to buy.
What we store
- Emails from trusted vendors: the sender, subject, date, attachment details, a copy of the price-list attachments, the text we extracted from them and the resulting draft.
- Possible vendor emails from unknown senders: if an email from a sender the store has not yet classified looks like a price list (for example it has a spreadsheet or PDF attachment named like a menu or price sheet), we store only its sender, subject, date and attachment names and sizes, so the store can choose to trust or block that sender. We do not open or store its attachments or text unless the store marks the sender as trusted.
- Every other email is never stored. Its header information is read in memory to make the decision above and then discarded.
- The Google access token is stored encrypted and is never shown to users.
How it is processed and shared
Stored vendor email data is kept in our database and private file storage, visible only to users who have access to that store in BudMetrics. To read a price list, the attachment or its text is sent to our AI provider, Anthropic, which processes it under API terms that do not allow it to train models on that data. We share Google user data with no one else, except as required by law or as part of a merger or acquisition with notice to you.
What we never do with Google user data
- We do not sell it.
- We do not use it, or transfer it, for advertising, including personalized, retargeted or interest-based advertising.
- We do not use it to train, develop or improve generalized or non-personalized AI or machine-learning models.
- We do not use it to determine creditworthiness or for lending purposes.
- No person at Green Growth CPAs reads it, unless you give us your explicit consent for specific messages (for example, to help you with a support request), it is necessary for security purposes such as investigating abuse, or it is required to comply with applicable law.
Retention and deletion
- Disconnecting Gmail in BudMetrics immediately deletes the stored Google access token, so we can no longer read the mailbox. You can also remove BudMetrics’s access at any time in your Google Account at myaccount.google.com/permissions.
- Vendor email data we stored (described above) is kept until the store asks us to delete it or its BudMetrics account ends, so its staff can refer back to past price lists and drafts. To have it deleted, email gagan@budmetrics.ai; we delete it, including stored attachments, within 30 days of a verified request.
Limited Use
BudMetrics' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we use information
We use the information described above to:
- provide BudMetrics’s reports, dashboards, alerts, emails and AI features to the store that owns the data;
- sign users in, apply the access each user has been given and keep one store’s data separate from another’s;
- send the emails and notifications a store sets up (for example end-of-day summaries, reports and win-back emails);
- support you, answer questions and fix problems;
- keep the service secure, prevent abuse and meet legal obligations; and
- understand how the service is used and improve it, using usage logs and aggregated measures rather than a store’s business records.
We do not sell personal information, and we do not use customer data for advertising.
AI processing
Several BudMetrics features use large language models to analyze data and draft text: answering questions about a store’s numbers, reading vendor price lists, suggesting orders and discount changes, and summarizing financial reviews. To do this we send the relevant data to a third-party AI provider through its business API.
- Our AI provider is Anthropic.
- We use these providers under their commercial API terms, which do not permit them to use our API inputs or outputs to train their models.
- We do not use customer data to train generalized AI models of our own.
- AI output can be wrong. It is presented as a suggestion for a person to review; see our Terms of Service.
Security
We protect information with measures appropriate to business financial data, including:
- encryption in transit (HTTPS) and encryption at rest by our hosting and database providers;
- encrypted storage of integration tokens, including the Google access token;
- database access rules that block direct public access, with every request checked on our servers against the user’s store and application access;
- least-privilege access for our staff; and
- read-only connections wherever a feature does not need to write (for example Gmail and POS reporting keys).
No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and the affected store as required by law.
Data retention
We keep a store’s business data for as long as the store has a BudMetrics account, because reports compare against past periods. When an account ends, we delete or de-identify the store’s data within 90 days, unless the store asks for an export first or we must keep something longer to meet a legal, tax or accounting obligation. Account information for a user is deleted when their access is removed and the store no longer needs the related records. Logs are kept for as long as they are needed for security, troubleshooting and billing. Gmail data follows the rules in Google user data.
Your rights and choices
You can ask us to access, correct, export or delete personal information we hold about you, or to stop a particular use of it. Depending on where you live you may have further rights under laws such as the California Consumer Privacy Act; we will honor them as those laws require and will not treat you differently for using them.
Email gagan@budmetrics.ai. We will confirm your request, may need to verify who you are, and respond within 30 days. If your information came to us from a store (for example you are a customer of a dispensary that uses BudMetrics), we will pass your request to that store and help it respond, because the store controls that data.
You can disconnect Gmail, QuickBooks Online, LeafLink or a POS connection at any time, which stops new data from being imported.
Children
BudMetrics is a business tool for licensed cannabis retailers and is not directed to anyone under 21. We do not knowingly collect personal information from children under 13 (or under 16 where local law sets that age). If you believe we have, contact us and we will delete it.
Where data is processed
BudMetrics is operated from the United States. Our subprocessors may process data in the United States and other countries where they operate, under contracts that require them to protect it.
Changes to this policy
We may update this policy as BudMetrics changes. We will post the new version here with a new effective date and, for material changes, tell account administrators by email or in the app before they take effect. We will not use Google user data in a new way without first updating this policy and, where required, asking for your consent.
Contact us
Questions or requests about privacy: gagan@budmetrics.ai.
Green Growth CPAs, operator of BudMetrics.
Mailing address: 200 Spectrum Dr, Irvine, CA 92618