Privacy Policy

This policy is issued by BudStack PTY LTD (“BudStack”, “we”, “us”), 57 Camborne Road, New Redruth, Alberton, Gauteng, 1449, South Africa. We build and run software for cannabis retail stores: storefront, point of sale, delivery, loyalty and vendor consignment tracking.

For the personal information where we decide why and how it is used, BudStack is the “responsible party” under POPIA. Our Information Officer can be reached at hello@budstack.co.za.

It matters who you are dealing with, because the answer changes who is responsible for your information.

When you deal with BudStack directly

If you visit this website, request a demo, message our WhatsApp number, email us, or use BudStack as a business client, BudStack is the responsible party. This policy applies to us in full.

When you are a customer of a store that runs on BudStack

Stores use the BudStack platform to run their shop. If you sign up, verify your age, order, collect loyalty points or buy a gift card through a store's own app or website, that store decides what it collects about you and why, so the store is the responsible party. BudStack acts as its operator: we host and process the information on the store's behalf and only on its instructions. Each store runs on its own dedicated database rather than a shared pool, so one store's customers are not mixed with another's.

If you are a store's customer, the quickest way to use your rights is to contact that store. If you contact us instead we will pass your request on to the store and help it respond. The store may also have its own privacy notice, which sits alongside this one.

From this website

• Demo request form: your full name, email, phone number, business or store name, number of stores, your role, monthly budget, store locations, timeline, and anything you write in the notes box.
• Usage data through Google Analytics: pages viewed, device and browser type, approximate location, and how you arrived. This uses cookies (see section 13).
• WhatsApp button: tapping it opens a chat in WhatsApp. We record only that the button was tapped, not who tapped it.

From WhatsApp conversations with us

When you message our WhatsApp Business number, Meta passes the message to us and we store it so our team can reply. That includes your WhatsApp phone number, the profile name you have set on WhatsApp, the content of each message (text, and any image, audio, video, document or location you send), times, and delivery status. Only authorised BudStack staff in sales, support and administration can read the inbox.

From business clients and their staff

• Contact and login details for the people who use our operator portal or a store's back office.
• Billing details, invoices and payment status. We do not store full card numbers.
• Support tickets and the messages exchanged in them.
• Sign-in records: time, email address, whether it succeeded, IP address, country and browser type.
• Activity and audit records showing which user did what in the system.

What a store's platform holds about its customers (we process this as the store's operator)

• Account details: name, email, cellphone number and date of birth.
• ID or passport number, and images of the front and back of an ID document uploaded for age verification.
• Delivery addresses.
• Order history, loyalty points, referral codes and gift-card balances and transactions.
• Prescription records where the store dispenses against a prescription: prescription number, prescribing doctor, allowed and dispensed quantities, dates, and an uploaded prescription document.
• Records that you accepted the privacy policy, with the date and the version you accepted.
• Push-notification subscriptions, if you switch them on.
• Messages and support requests you send through the store's app.

POPIA treats information about a person's health as special personal information, which may only be processed in narrower circumstances, such as with your consent. Prescription records and prescribing details fall into that group, and so does a store's record of what it has dispensed to you against a prescription. Identity numbers and ID document images are not in that group but are among the most sensitive things a store holds, and we treat them accordingly.

• This information is collected by the store, to confirm you are 18 or older and, where relevant, to check dispensing against a valid prescription.
• It is visible only to staff of that store whose role needs it, and to BudStack personnel only where needed to run or support the platform.
• It is never used for marketing and never sold.
• ID and prescription document images are kept in private storage that needs a signed, time-limited link to open. They are not public web addresses.
• If an ID verification is rejected, the uploaded ID images are deleted once the store's retention period has passed (see section 8).

POPIA requires a lawful reason for each use. We rely on the following:

• To provide what you asked for:answering a demo request or WhatsApp message, setting up and running a client's account, sending invoices, providing support.
• To run a store's service (as operator): verifying age, taking and delivering orders, running loyalty and gift cards, and keeping order and tax records.
• Legal obligations: tax and accounting records, and responding to lawful requests from authorities.
• Our legitimate interests: keeping the platform secure, detecting fraud and misuse, and understanding how this website is used so we can improve it.
• Your consent: for example the privacy-policy consent captured at sign-up, and any marketing you opt into. You can withdraw consent at any time; that will not affect what was done before you withdrew.

Marketing. We send marketing messages only where you have asked for them or POPIA otherwise allows it, and you can stop them at any time. Outside the 24 hours after you last messaged us, WhatsApp only lets a business send pre-approved template messages, and we use those only for conversations you have started or agreed to. We do not carry out automated decision-making that has legal or similarly significant effects on you.

We do not sell personal information. We share it only with the following, and only as needed for the purpose described:

• The store you are dealing with, and the delivery driver it assigns, for an order.
• The service providers in the list below, which process information on our instruction.
• Professional advisers, and regulators or authorities where the law requires it or where needed to protect people or defend legal claims.
• A buyer or successor, if BudStack is ever sold or merged, subject to the same protections.

Our main database is hosted in Ireland, and several of the providers above operate in the United States or globally. That means personal information is sent outside South Africa. POPIA allows this where the recipient is bound by law, binding rules or a contract that gives your information protection substantially like POPIA's, where you consent, or where the transfer is necessary to perform a contract with you or on your behalf.

Ireland is part of the European Union, whose data-protection law (the GDPR) offers that kind of protection. For our other providers we rely on their data-processing terms with us. If you would like more detail on how a particular transfer is protected, ask us at hello@budstack.co.za.

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires.

• Demo requests, leads and WhatsApp conversations: for as long as needed to deal with your enquiry and any resulting relationship, and deleted when you ask us to, subject to anything we must keep by law.
• Order, invoice and tax records:kept for the period the law requires. When a customer deletes their account, we strip out what identifies them (name, phone, address, ID number, photo and uploaded documents) and lock the account, but keep the now-anonymous order history so the store's accounting and tax records stay intact.
• Platform clean-up defaults: each store has settings, applied by its administrator, that by default remove dispatched notifications after 90 days, uploaded ID images of rejected verifications after 180 days, and closed support tickets after 365 days. Every clean-up run is logged.

POPIA requires reasonable technical and organisational measures. Ours include:

• Role-based access, so a cashier's login does not see what an owner's does, and one store's staff do not see another store's data.
• Each store on its own dedicated database, with row-level security rules inside it.
• An audit trail of who did what.
• Encrypted connections (HTTPS) between you and our systems, and encrypted storage at our hosting providers.
• Private storage for ID and prescription documents, opened only through short-lived signed links.
• Verification of every incoming WhatsApp webhook by cryptographic signature before we store anything from it.

No system is perfectly secure. If a breach puts your personal information at risk we will notify the Information Regulator and, where we can identify you, tell you, as POPIA section 22 requires. For customers of a store that notice may come from the store, with our help.

Under POPIA you have the right to:

• ask whether we hold personal information about you, and ask for a copy;
• ask us to correct information that is inaccurate, irrelevant, excessive, out of date, incomplete or misleading;
• ask us to delete or destroy information we are no longer entitled to keep;
• object, on reasonable grounds, to our processing of your information, and object at any time to direct marketing;
• withdraw consent you previously gave;
• not be subject to a decision based solely on automated processing, where that decision has legal or similarly significant effects on you; and
• complain to the Information Regulator (see section 16).

To use any of these, email hello@budstack.co.za. We may need to confirm your identity first, so that we do not hand your information to someone pretending to be you. We will respond within a reasonable time. If your information is held by a store as responsible party, we will pass the request to that store.

You can ask us to delete your personal information at any time.

• Anything held by BudStack directly, including WhatsApp conversations, demo requests and lead records: email hello@budstack.co.zawith the subject “Delete my data”, or send the words “delete my data” to our WhatsApp number from the number you want removed. We will confirm what we deleted, and aim to complete deletion within 30 days, except for anything we are legally required to keep.
• A store customer account:in the store's app, open your profile and choose to delete your account. This removes your name, phone, address, ID number, photo and uploaded documents, and permanently locks the account. Anonymised order records are kept for the store's tax and accounting duties. You can also ask the store, or us, to do it for you.

Under POPIA a child is anyone under 18. BudStack's services and the stores on our platform are for adults only: stores verify that a customer is 18 or older before selling to them, and we do not knowingly collect personal information about anyone under 18. If you believe a child's information has reached us, email hello@budstack.co.za and we will delete it.

This website uses Google Analytics 4, which places cookies (for example _ga) in your browser to count visits and see which pages are useful. When a demo request is submitted we send Google only non-identifying details such as the store-count range, role and timeline. We never send your name, email address or phone number to Google Analytics.

You can block or delete cookies in your browser settings, or install Google's opt-out browser add-on. The website works without them. The store apps and operator portal use cookies and similar browser storage to keep you signed in.

BudStack is based in South Africa and serves South African stores. If you visit from the European Economic Area or the United Kingdom, we handle your information under this policy, and you may also have rights under your local law, such as access, correction, deletion and objection. Contact us at hello@budstack.co.za and we will deal with the request.

We will update this page when what we do with personal information changes, and change the “last updated” date at the top. Where a change is significant we will also tell our clients directly.

BudStack PTY LTD
57 Camborne Road, New Redruth, Alberton, Gauteng, 1449
Email: hello@budstack.co.za
WhatsApp: 079 879 9579

If you are not happy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

See also our Security & Trust page for how the platform is built.