Privacy Policy

1. Introduction

GrowWise, operated by Monumental Highs LLC (a subsidiary of Black Hills Consortium, headquartered in Custer, South Dakota), is committed to protecting the privacy and security of your information. This Privacy Policy describes how we collect, use, store, share, and protect information obtained through the GrowWise platform, website, APIs, Sage AI assistant, and all related services. Given the highly regulated nature of the cannabis industry, we take additional precautions to safeguard sensitive business and compliance data. By using GrowWise, you consent to the practices described in this Privacy Policy.

2. Information We Collect

We collect several categories of information to provide and improve our services:

• Account Information: Name, email address, phone number, company name, business license numbers, and billing information provided during registration
• Business Data: Point-of-sale transaction records, inventory data, product catalog information, supplier records, and employee data entered into the platform
• Compliance Data: METRC and BioTrack API credentials, seed-to-sale tracking data, regulatory reports, and license information
• Customer Data: Information about your dispensary customers, including purchase history and loyalty program participation, as entered and managed by you through the platform
• AI Interaction Data: Conversations with Sage AI, queries, commands, and feedback provided through the conversational interface
• API Usage Data: API call logs, integration configurations, webhook endpoints, and MCP server connections
• Automatically Collected Data: IP addresses, browser type, device information, access times, pages viewed, and usage patterns collected through cookies and analytics tools

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the GrowWise platform and all associated services
• Process transactions, manage subscriptions, and handle billing
• Power Sage AI features, including personalized recommendations, analytics, and compliance monitoring
• Generate business intelligence reports, sales analytics, and inventory forecasts
• Facilitate METRC and BioTrack compliance reporting and seed-to-sale tracking
• Improve platform performance, develop new features, and fix bugs
• Provide customer support and respond to your inquiries
• Send service notifications, security alerts, and platform updates
• Create anonymized and aggregated industry benchmarks and market intelligence
• Comply with legal obligations, including responding to lawful data requests

4. Cannabis Industry Data Handling

We recognize that cannabis business data is exceptionally sensitive due to the complex regulatory landscape, including the ongoing federal Schedule I classification. GrowWise implements enhanced protections for cannabis-specific data, including seed-to-sale records, purchase limit enforcement data, patient information (where applicable), and compliance documentation. We do not share cannabis business data with federal agencies except as required by law. We encrypt all compliance data at rest and in transit. Access to cannabis-specific data is restricted to authorized personnel with legitimate business needs. We maintain audit logs for all access to compliance-sensitive data. We do not use your identifiable cannabis business data for marketing purposes or share it with competitors.

5. Information Sharing and Disclosure

We may share your information in the following limited circumstances:

• Service Providers: Third-party vendors who assist with hosting, payment processing, analytics, and customer support, bound by confidentiality obligations
• Compliance Systems: State-mandated tracking systems (METRC, BioTrack) as required for your regulatory compliance, initiated only by your configuration
• Black Hills Consortium Affiliates: Limited operational data shared between affiliated entities to improve integrated services, never including your identifiable customer or transaction data
• Legal Requirements: When required by law, subpoena, court order, or governmental regulation, we will comply while making reasonable efforts to notify you in advance where legally permitted
• Aggregated Data: We may share anonymized, aggregated industry data that cannot identify your specific business for benchmarking and research purposes

We do not sell your personal or business information to third parties. We do not provide your data to advertisers or data brokers.

6. Data Security

GrowWise employs industry-standard security measures to protect your data, including AES-256 encryption at rest, TLS 1.3 encryption in transit, multi-factor authentication, role-based access controls, regular security audits, and intrusion detection systems. Our infrastructure is hosted on enterprise-grade cloud platforms with SOC 2 compliance. We conduct regular penetration testing and vulnerability assessments. Despite these measures, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents and notifying affected users in accordance with applicable breach notification laws.

7. CCPA Compliance

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). These rights include:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collecting the information, and the categories of third parties with whom we share the information.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions permitted under the CCPA.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale: We do not sell personal information. However, you have the right to opt out of any future sale of personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your CCPA rights, contact us at legal@blackhillsconsortium.org. We will verify your identity before processing any request and respond within 45 days as required by law.

8. Data Retention for Regulated Industries

Cannabis businesses are subject to record retention requirements that vary by state. GrowWise retains your compliance data, transaction records, and seed-to-sale tracking data for the longer of: (a) the period required by your state's cannabis regulations (typically 3-7 years), (b) the duration of your subscription plus 12 months, or (c) as otherwise required by law. Account and billing information is retained for 7 years for tax and audit purposes. You may request early deletion of non-regulated data at any time. Upon account termination, we retain only the minimum data required by law and our regulatory obligations, and securely delete all other data within 90 days.

9. Cookies and Tracking Technologies

GrowWise uses cookies and similar technologies to maintain session state, remember your preferences, authenticate users, and analyze platform usage. We use essential cookies required for platform functionality, analytics cookies (via Vercel Analytics) to understand usage patterns, and preference cookies to remember your settings. We do not use advertising or targeting cookies. You can control cookie settings through your browser preferences, but disabling essential cookies may impair platform functionality.

10. Your Privacy Rights

Regardless of your location, you have the right to access the personal information we hold about you, request correction of inaccurate data, request deletion of your data (subject to legal retention requirements), object to certain processing activities, request data portability in machine-readable format, and withdraw consent where processing is based on consent. To exercise any of these rights, contact us at the information provided below. We will respond to all legitimate requests within 30 days.

11. Children's Privacy

GrowWise is designed exclusively for use by adults aged 21 and older in connection with licensed cannabis business operations. We do not knowingly collect information from individuals under 21 years of age. If we learn that we have collected personal information from anyone under 21, we will promptly delete that information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting a notice on the platform dashboard, sending an email to your registered address, or both. Your continued use of GrowWise after such notification constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

13. Contact Information

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: