Cannabis Cloud

Privacy Policy

Privacy Policy

Last updated: October 16, 2026

Cannabis Cloud™ (“we”, “us”) provides compliance and point-of-sale software for licensed cannabis businesses, operated and administered by 3KEYMEDIA, LLC, a Nevada limited liability company; since 2024 the Cannabis Cloud™ intellectual property has been held by Eagle 47 Holdings, LLC, a Nevada limited liability company and its holding company. This policy describes how the Cannabis Cloud service — the website, the Salesforce-native application, point of sale, Metrc compliance tooling, and the AI connectors for Claude and ChatGPT — handles information. It implements the data-protection commitments in the Cannabis Cloud License Agreement.

What we collect

  • Account and billing data. Business name, contact details, order and subscription records, and merchant application information. Payments are processed by Stripe; we never store card numbers.
  • Compliance configuration. State license numbers and Metrc API credentials you provide to connect your regulatory account. Credentials are stored in managed secret stores, used only to call the state Metrc API on your behalf, and never shared, sold, logged, or returned in AI responses.
  • Customer Data. Inventory, sales, loyalty, and compliance records entered into or generated by the software by you and your authorized users, which may include consumer information your business collects (such as name, contact details, and driver identification number). You own this data. We process it under license from you, solely to provide the software and related services.
  • Software Performance Data. Availability and performance monitoring — application endpoint URLs, service logs, and IP addresses — captured to validate uptime and detect negative activity. Service logs are minimal and redacted: tool name, timestamp, outcome; no credentials, no consumer identities.

How we use data

  • To provide, support, secure, and bill for the software.
  • De-identified and aggregated data (excluding any customer-branded data) may be used to improve the software, develop products and services, and produce industry reports. We will not share, disclose, sell, or otherwise use Customer Data relating to your branded products and services for any purpose other than providing the software to you.
  • Your data is not accessed by our personnel except as necessary to identify, investigate, or resolve technical problems or to verify compliance with the service terms. Data we access is kept confidential, handled according to applicable law, and never comingled with other customers’ data except in obfuscated, anonymized form.

AI connectors

When you link Cannabis Cloud to an AI assistant (Claude or ChatGPT), the connector exposes read-only regulatory data and explicitly confirmed actions. Metrc keys stay server-side and are never visible to the AI model or the assistant provider. Conversations with the assistant are governed by that provider’s privacy terms. The connectors deny access to consumer personal records and cannot be used to purchase cannabis.

What we never do

  • Sell or rent your data.
  • Use or disclose your customer lists or branded data for any purpose other than providing the service.
  • Process cannabis consumer purchases through AI connectors.
  • Expose credentials, consumer identities, or medical information to AI models.

Legal disclosures

We may disclose Customer Data where necessary to comply with a valid court order or subpoena or with applicable law. We will promptly notify you in writing of such a request (unless prohibited) and will cooperate with you, at your expense, if you choose to contest the disclosure or limit its scope.

Security

We maintain administrative, physical, and technical safeguards appropriate to the data we process, including managed secret stores for API credentials and access controls limited to personnel whose roles require it. Under the service terms, you are responsible for safeguards on your side: access controls for your authorized users, the security of your registers, devices, and network, and the secure transmission of your data to the software.

Your privacy obligations as an operator

If you are a Cannabis Cloud customer, the License Agreement requires you to maintain an easily accessible privacy policy of your own, linked conspicuously from your website and applications, that complies with applicable law for the individuals whose data you collect, and to have obtained all necessary rights, consents, and lawful bases for the data you provide to the service. Consumers whose data is held by a dispensary should direct privacy requests to that dispensary, which controls the data; we process it on the dispensary’s behalf.

Retention and deletion

Subscription and order records are kept for the life of the account plus legal retention requirements. Disconnecting a Metrc integration or cancelling a subscription removes the associated credentials from active systems. On termination of service, your data remains yours; maintaining backups and exports is your responsibility, and post-termination transition assistance is available by mutual agreement. Email privacy@cannabis.cloud for deletion requests.

Contact

3KEYMEDIA, LLC · 701 South Carson Street, Carson City, NV 89703 · privacy@cannabis.cloud