YOUR INFORMATION
Privacy Policy
How LocalLeaf Canada collects, uses, discloses, retains, and protects information across its customer directory and restricted partner workspaces.
Effective and last updated: July 28, 2026
1. Scope and accountability
This policy applies to the LocalLeaf Canada mobile apps, public web experience, merchant workspaces, administrator tools, and related LocalLeaf services. It does not govern an independent store, identity provider, device dialler, SMS or email app, or external website that you choose to use.
LocalLeaf is responsible for the information under its control. Questions, access requests, corrections, consent withdrawals, and deletion requests can be sent to the privacy contact at the end of this policy.
2. Information we collect
Customer choices stored on the device
We store the date of your 19+ confirmation and the city you select. The age confirmation expires after 30 days. The selected city is sent with directory requests so LocalLeaf can return city-relevant content. LocalLeaf does not request GPS or precise device location. If you type an address or postal-code reference into the optional delivery-fee estimator, that text remains on the current screen and is not saved or sent to LocalLeaf.
Pseudonymous app analytics
The app creates a random installation identifier and sends it with the platform type and launch event. The server hashes the identifier before storing first-seen, last-seen, and aggregate launch information. LocalLeaf does not use an advertising ID or join this analytics record to customer, subscriber, contact, partner, or purchase records.
Optional store updates
If you ask for updates from one store, we collect your name, email address, consent choice, consent version and source, timestamps, subscription status, and a secure management token. The information is isolated to that selected store.
Delivery notices
An authorized store team may enter a customer mobile number, an optional private reference, and a record that the customer consented to one transactional delivery notice. LocalLeaf records that the native SMS composer opened; the store performs the final send, and LocalLeaf does not receive the resulting message or delivery status.
Partner accounts and authentication
When an approved applicant, merchant, reviewer, or administrator signs in, LocalLeaf may receive and store an identity-provider user ID, name, email address, login method, role, organization membership, and last-sign-in time. A successful partner sign-in creates or updates a LocalLeaf user record and session.
Merchant applications and public listings
Applicants may provide legal and public business names, contact information, premises address, authorization identifiers and dates, issuer information, reviewer correspondence, and PDF or image evidence. Approved merchants may publish store contact details, hours, service areas, menus, prices, promotions, product photographs, and delivery information.
Private merchant operations
Opted-in merchants may store catalogue, inventory, cost, completed-sale, refund, tax, payment-method category, movement, note, and weekly-report records. These private bookkeeping records may identify the authorized partner user who performed an action, but they are not designed to store customer names, customer addresses, payment-card numbers, or customer payment credentials.
Security and audit data
LocalLeaf may record timestamps, request IP address, authenticated user and organization identifiers, action metadata, and before-and-after values to enforce permissions, investigate problems, maintain authorization provenance, and protect the service.
3. How we use information
- Provide the directory, selected-city results, partner workspaces, store-update controls, and delivery-notice tools.
- Authenticate users, enforce store and administrator permissions, and secure sessions.
- Review merchant identity and authorization evidence and maintain a traceable decision history.
- Operate private merchant inventory, sales, refund, and weekly-report features when a store enables them.
- Measure aggregate installs and launches, troubleshoot errors, prevent abuse, and improve reliability.
- Respond to support, privacy, access, correction, consent-withdrawal, and deletion requests.
- Meet legal, regulatory, security, fraud-prevention, and dispute-resolution obligations.
4. When information is disclosed
LocalLeaf does not sell personal information and does not disclose it for cross-context behavioural advertising. We disclose information only in the circumstances described here.
The store you selected
A store-update subscription is available only to that store’s authorized team. Delivery-notice information is available only to the authorized team of the store that entered it. LocalLeaf does not combine or share subscriber lists across stores.
Service providers acting for LocalLeaf
Managed identity, hosting, API, database, object-storage, email or notification, and security services may process information to operate LocalLeaf. They are expected to handle it only for the services they provide and under applicable safeguards.
Public information chosen by merchants
Approved store-profile, menu, promotion, contact, authorization-summary, and delivery information is intentionally made public in the directory.
Legal and safety reasons
Information may be disclosed when reasonably necessary to comply with law or lawful process, protect users or the public, investigate fraud or security incidents, enforce rights, or complete a business reorganization subject to appropriate protections.
External apps and websites
Call, text, email, and website actions open an independent app or service. LocalLeaf does not receive the resulting communication or external browsing activity. Those providers and stores apply their own privacy practices.
5. Retention
Age confirmation and city
These choices remain on the device until they expire, are changed, are revoked, or the app’s local data is cleared. The age confirmation is valid for 30 days.
Store updates
Subscription information remains available to the selected store until it is permanently deleted. Unsubscribing stops the active subscription; the in-app delete control permanently removes the subscription record.
Delivery notices
Stores default to deletion after 30 days. A store may instead choose a 30-day metadata-only archive that removes the phone number and private reference, or a manual-cleanup mode. The selected mode is shown to the store team.
Weekly reports
A merchant may configure weekly report snapshots for 13 to 520 weeks; the default is 104 weeks.
Other business and security records
Partner accounts, applications, evidence, audit records, analytics, and underlying merchant ledgers are retained only as long as reasonably necessary for the purposes described in this policy, including authorization, security, fraud prevention, disputes, and legal or regulatory recordkeeping. Some of these records do not currently have an automatic deletion schedule. A verified request may result in deletion, de-identification, restriction, or continued limited retention where required or permitted.
6. Security
LocalLeaf uses safeguards appropriate to the nature of the information, including encrypted network transport, authenticated sessions, role and organization access checks, store isolation, private object storage, time-limited signed file access, and audit records. No system can guarantee absolute security, and users should protect their devices, sign-in methods, and subscription-management links.
7. Your choices and privacy rights
- Change the selected city or show the age confirmation again from the Information screen.
- Use the store-update controls to unsubscribe or permanently delete that subscription.
- Sign out of a partner session from the restricted workspace.
- Ask LocalLeaf to explain, provide access to, or correct personal information under its control.
- Withdraw consent where processing relies on consent, subject to legal or contractual limits.
- Request deletion or account closure using the contact method below.
We may need to verify identity, authority, store relationship, or the installation or subscription concerned before acting. We will respond according to applicable law and explain any lawful reason that prevents full access or deletion.
8. Partner account deletion
Customers do not need a LocalLeaf account. A partner user who wants to close a LocalLeaf account may email the privacy contact with the subject “LocalLeaf account deletion” and include the email used to sign in and, if applicable, the store or organization name. Do not send passwords, identity documents, or authorization evidence by ordinary email unless LocalLeaf specifically requests a secure method.
After verification, LocalLeaf will delete or de-identify the account and associated personal information that is no longer required. Limited information may remain where reasonably necessary for legal obligations, security, fraud prevention, authorization history, accounting records, disputes, or the rights of other users and stores.
9. Adults only
LocalLeaf’s cannabis-store information is intended only for adults who meet the applicable legal age. In Ontario, users must confirm they are at least 19. LocalLeaf does not knowingly provide regulated menu or promotional content to minors. If you believe a minor’s personal information has been submitted, contact us so it can be assessed and removed where appropriate.
10. Processing location
LocalLeaf and its service providers may process information in Canada, the United States, or other jurisdictions where their infrastructure or personnel operate. Information may therefore be subject to the laws and lawful access processes of those jurisdictions. LocalLeaf uses contractual, technical, and organizational safeguards appropriate to the service and information involved.
11. Changes to this policy
We may update this policy when the service, providers, laws, or data practices change. The updated version will show a new last-updated date. If a change materially affects how information is handled, LocalLeaf will provide an appropriate in-app or other notice before the change takes effect where required.
12. Contact LocalLeaf privacy
Email bjarvie67@gmail.com for privacy questions, access or correction requests, consent withdrawal, subscription deletion, or partner account closure. Please describe the feature, store, subscription, or account involved without including passwords or unnecessary sensitive documents.
Email privacy contact