Privacy Policy

Last updated: October 2026

Overview

SeedLink provides live, METRC-synced wholesale menu software to licensed cannabis cultivators. This policy explains what we collect, why, and how we handle it. It covers the SeedLink website and dashboard. It does not change any separate agreement you have with us.

Information we collect

Account information. When a cultivator requests access or signs up, we collect name, email, phone number, password, and the cannabis license you operate under.
Inventory data from METRC. With your connection, we pull your active packages (strains, quantities, lab results, package labels) from the state track-and-trace system to build your menu. METRC API credentials are encrypted at rest.
Menu engagement data. When a buyer opens a menu link you sent, we record the visit: the open, products viewed, time spent, what goes into the cart and in what quantities, and any “interested” or order actions, along with errors the page hit. Visits are also recorded as session replays of the page as the buyer used it: what a buyer types is masked in those recordings except quantities and product search, and names, email addresses, phone numbers and notes are blocked. Visits by signed-in cultivators and SeedLink staff are not recorded. IP addresses are hashed (one-way) before storage; we do not retain raw IPs.
Marketplace activity. When a buyer signed in to the SeedLink market opens a product’s details or adds it to their basket, we record which product and, for a basket add, how many, and share it with the cultivator who sells that product, including the buyer’s name and store. Activity by SeedLink staff is not recorded. We also record in our own database how a signed-in buyer uses the market (pages opened and for how long, searches and filters, basket and checkout steps, and errors), and we record those sessions as replays with what is typed and the text on screen masked. Neither of these is shared with cultivators.
Dashboard use. When a cultivator uses the SeedLink dashboard, we record in our own database which pages are opened and how long each is on screen, every click and every change to a control, each described by the label of what was clicked or changed, and errors the page hit, with the account and brand, and, when the dashboard was opened from one of our emails, which email it was. What you type into a text field is never recorded: we keep its label and how many characters were entered, not what they were. A choice you make, such as a search term, a number, a date or an option from a list, is recorded as chosen. Dashboard sessions are also recorded as replays, with what is typed and the text on screen masked. We use this to understand how SeedLink is used and to decide what it sends and where. A short summary of each session is written by Anthropic’s Claude for SeedLink’s own review, as described under session summaries below; it is not shown to cultivators or buyers. Use by SeedLink staff is recorded and labelled as staff.
Public pages and sign-in. Our public pages (including the guides) and the sign-in, signup and request-access pages record in our own database each page opened, how long it is on screen, clicks (each described by the label of what was clicked, where a link goes, without anything in it that works as a password, and the part of the page it sat in), and errors. Each record carries a random visitor identifier that your browser keeps in its local storage for this site (each SeedLink web address keeps its own) and a session identifier kept for the browser tab. The first record of each visit also carries the name of the site that sent you (only its host name, never the full address of the page), the campaign tags in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content and utm_term, and whether a Google Ads click id was present, not the id), and your device type, browser window size and browser language. Sign-in and signup pages also record each step: that a form was started, which fields were completed, and whether it was submitted and succeeded or failed, but never what you typed. No third-party analytics or advertising trackers run on these pages, and there is no analytics cookie. To limit abuse of the endpoint that receives these records, a keyed one-way hash of your network address is kept only to count requests against a ten-minute limit; once that window has passed it is deleted the next time the endpoint clears expired counts, which it does while it is in use (no more often than once a minute). The address itself is never stored. If you are signed in, your account is recorded with the visit, and the visitor identifier in your browser is linked to your account; these pages are part of the session summaries described below.
Session summaries and profiles. A short summary of a session is written by Anthropic’s Claude for SeedLink’s own review: dashboard sessions; signed-in marketplace sessions; visits to a buyer menu link, which are described by the store the link was made for, never by a buyer’s name; visits to our public, sign-in, signup and request-access pages by an approved account, or by any other visitor whose visit opens more than one page, reaches the sign-in, signup or request-access pages, or arrives from a search engine or AI assistant; and sessions of signed-in accounts in WeedShelf Intelligence, which are linked to a SeedLink account only through our one-login bridge. Claude also keeps a short profile of each account, menu link or returning visitor, updated from those summaries. Summaries and profiles are never shown to cultivators or buyers, and sessions of SeedLink staff accounts are never summarized.
Links in our emails. The one-tap pages our emails link to (confirming an order, approving a menu, recording a shipment, a store brief, a model decision) record that the page was opened and what was done on it, never the link itself. If you are signed in to SeedLink on that device, your account is recorded with it; otherwise who opened it is not known.
Buyer contact details. To place an order, a buyer provides a name and email. Buyers may optionally create a marketplace account (name, work email, phone, store); without one, the per-dispensary link is the identity layer.

How we use information

We use this data to operate the product: sync and display your menu, deliver engagement notifications, generate orders and invoices, support your account, and improve the service. We do not sell personal information.

Service providers

We share data only with the vendors that run the product, under their respective terms:

Supabase — database, authentication, and realtime infrastructure.
Vercel — application hosting.
Resend — transactional and notification email.
PostHog — session recordings in the signed-in cultivator dashboard, the signed-in marketplace and buyer menu links, so we can see how the product is used. In the dashboard and marketplace, what is typed and the text on screen are masked; on a buyer menu, what is typed is masked except quantities and product search, and names, email addresses, phone numbers and notes are blocked. Request and response bodies are not recorded, and the menu link is removed from every address. PostHog receives the recording and a coded identifier for the account or menu link, never your network address (our servers pass recordings on without it) and never a person’s name or email address. It receives no page views, clicks or events of ours. Our own analytics are kept in our own database.
Anthropic — the AI model behind the SeedLink assistant, the buying assistant for marketplace accounts, the features that propose menu plans and turn a pasted order or menu into a draft, and the internal summaries of sessions and the profiles built from them. It receives what is typed or pasted into those features and the records each request needs: catalog, order, menu engagement and METRC records, which can include buyer names and contact details, and, for a session summary, that session’s recorded page views, clicks, changes and cart activity, and, for a profile, that person’s earlier summaries.
METRC — the state cannabis track-and-trace system we sync inventory from, and where we create packages and transfer manifests when you ask us to.

Data security

Data is encrypted in transit (HTTPS) and access is governed by row-level security so each cultivator can reach only their own data. METRC credentials are encrypted with AES-256-GCM. No system is perfectly secure, but we work to protect your information.

Data retention

We keep account and engagement data for as long as your account is active or as needed to provide the service and meet legal and regulatory obligations. You can ask us to delete your account data, subject to records we must retain by law.

Your choices

Cultivators can update account details in Settings and disconnect METRC at any time. Notification emails include an unsubscribe option. To request access, correction, or deletion of your data, contact us.

Contact

Questions about this policy? Reach us through the contact page.

Information we collect

Account information. When a cultivator requests access or signs up, we collect name, email, phone number, password, and the cannabis license you operate under.
Inventory data from METRC. With your connection, we pull your active packages (strains, quantities, lab results, package labels) from the state track-and-trace system to build your menu. METRC API credentials are encrypted at rest.
Menu engagement data. When a buyer opens a menu link you sent, we record the visit: the open, products viewed, time spent, what goes into the cart and in what quantities, and any “interested” or order actions, along with errors the page hit. Visits are also recorded as session replays of the page as the buyer used it: what a buyer types is masked in those recordings except quantities and product search, and names, email addresses, phone numbers and notes are blocked. Visits by signed-in cultivators and SeedLink staff are not recorded. IP addresses are hashed (one-way) before storage; we do not retain raw IPs.
Marketplace activity. When a buyer signed in to the SeedLink market opens a product’s details or adds it to their basket, we record which product and, for a basket add, how many, and share it with the cultivator who sells that product, including the buyer’s name and store. Activity by SeedLink staff is not recorded. We also record in our own database how a signed-in buyer uses the market (pages opened and for how long, searches and filters, basket and checkout steps, and errors), and we record those sessions as replays with what is typed and the text on screen masked. Neither of these is shared with cultivators.
Dashboard use. When a cultivator uses the SeedLink dashboard, we record in our own database which pages are opened and how long each is on screen, every click and every change to a control, each described by the label of what was clicked or changed, and errors the page hit, with the account and brand, and, when the dashboard was opened from one of our emails, which email it was. What you type into a text field is never recorded: we keep its label and how many characters were entered, not what they were. A choice you make, such as a search term, a number, a date or an option from a list, is recorded as chosen. Dashboard sessions are also recorded as replays, with what is typed and the text on screen masked. We use this to understand how SeedLink is used and to decide what it sends and where. A short summary of each session is written by Anthropic’s Claude for SeedLink’s own review, as described under session summaries below; it is not shown to cultivators or buyers. Use by SeedLink staff is recorded and labelled as staff.
Public pages and sign-in. Our public pages (including the guides) and the sign-in, signup and request-access pages record in our own database each page opened, how long it is on screen, clicks (each described by the label of what was clicked, where a link goes, without anything in it that works as a password, and the part of the page it sat in), and errors. Each record carries a random visitor identifier that your browser keeps in its local storage for this site (each SeedLink web address keeps its own) and a session identifier kept for the browser tab. The first record of each visit also carries the name of the site that sent you (only its host name, never the full address of the page), the campaign tags in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content and utm_term, and whether a Google Ads click id was present, not the id), and your device type, browser window size and browser language. Sign-in and signup pages also record each step: that a form was started, which fields were completed, and whether it was submitted and succeeded or failed, but never what you typed. No third-party analytics or advertising trackers run on these pages, and there is no analytics cookie. To limit abuse of the endpoint that receives these records, a keyed one-way hash of your network address is kept only to count requests against a ten-minute limit; once that window has passed it is deleted the next time the endpoint clears expired counts, which it does while it is in use (no more often than once a minute). The address itself is never stored. If you are signed in, your account is recorded with the visit, and the visitor identifier in your browser is linked to your account; these pages are part of the session summaries described below.
Session summaries and profiles. A short summary of a session is written by Anthropic’s Claude for SeedLink’s own review: dashboard sessions; signed-in marketplace sessions; visits to a buyer menu link, which are described by the store the link was made for, never by a buyer’s name; visits to our public, sign-in, signup and request-access pages by an approved account, or by any other visitor whose visit opens more than one page, reaches the sign-in, signup or request-access pages, or arrives from a search engine or AI assistant; and sessions of signed-in accounts in WeedShelf Intelligence, which are linked to a SeedLink account only through our one-login bridge. Claude also keeps a short profile of each account, menu link or returning visitor, updated from those summaries. Summaries and profiles are never shown to cultivators or buyers, and sessions of SeedLink staff accounts are never summarized.
Links in our emails. The one-tap pages our emails link to (confirming an order, approving a menu, recording a shipment, a store brief, a model decision) record that the page was opened and what was done on it, never the link itself. If you are signed in to SeedLink on that device, your account is recorded with it; otherwise who opened it is not known.
Buyer contact details. To place an order, a buyer provides a name and email. Buyers may optionally create a marketplace account (name, work email, phone, store); without one, the per-dispensary link is the identity layer.

Service providers

We share data only with the vendors that run the product, under their respective terms:

Supabase — database, authentication, and realtime infrastructure.
Vercel — application hosting.
Resend — transactional and notification email.
PostHog — session recordings in the signed-in cultivator dashboard, the signed-in marketplace and buyer menu links, so we can see how the product is used. In the dashboard and marketplace, what is typed and the text on screen are masked; on a buyer menu, what is typed is masked except quantities and product search, and names, email addresses, phone numbers and notes are blocked. Request and response bodies are not recorded, and the menu link is removed from every address. PostHog receives the recording and a coded identifier for the account or menu link, never your network address (our servers pass recordings on without it) and never a person’s name or email address. It receives no page views, clicks or events of ours. Our own analytics are kept in our own database.
Anthropic — the AI model behind the SeedLink assistant, the buying assistant for marketplace accounts, the features that propose menu plans and turn a pasted order or menu into a draft, and the internal summaries of sessions and the profiles built from them. It receives what is typed or pasted into those features and the records each request needs: catalog, order, menu engagement and METRC records, which can include buyer names and contact details, and, for a session summary, that session’s recorded page views, clicks, changes and cart activity, and, for a profile, that person’s earlier summaries.
METRC — the state cannabis track-and-trace system we sync inventory from, and where we create packages and transfer manifests when you ask us to.