Privacy policy
What this website and the BudAlly service do with personal information, written from what the system actually does.
Who we are
BudAlly, Inc. runs budally.com and the BudAlly service. For anything in this policy, email privacy@budally.com.
What this website collects
Only what you type into a form. There are five: the free audit, the founding-program application, contact, a state request, and the blog subscribe box. Between them they ask for your name, work email, company, phone, state, point-of-sale system, number of stores, and whatever you write in the message field. Only the email address is ever required; the subscribe box asks for nothing else.
Each submission also records which page you sent it from — the path only, never the query string. One hidden field is a spam trap: it is invisible to you, and if anything fills it the submission is silently discarded.
If you arrived from an advertisement or a link someone shared, we also record the campaign tags on that link (the utm_ parameters) and the address of the site that sent you, so we can tell which campaigns are worth continuing. Those are held for the length of your visit in your browser and attached only if you actually submit a form; close the tab without submitting and they are gone. They describe the link, not you, and we do not combine them with anything else to build a profile.
Where it goes
The form posts to budally.com and is passed to our own API on the same server. It is written to a database on a DigitalOcean droplet in San Francisco, United States, and it is emailed to us so somebody reads it. Nothing is sent to an advertising network, a data broker or a CRM, and nothing about you is sold or shared for anyone else's marketing.
Our web server keeps ordinary access logs, which include your IP address, so we can operate the site and limit abuse. Submissions are rate-limited per IP address for the same reason.
Cookies and analytics
This site uses Google Analytics 4 to count visits. It sets Google Analytics cookies (_ga and _ga_<id>) so it can tell a returning visitor from a new one. It records the page, the browser and the site that sent you — for example, whether you came from an AI answer engine. Google receives your IP address to do this. There are no advertising cookies and no cross-site tracking pixels.
The signed-in BudAlly application is different: it sets the cookies a login session needs, which are strictly necessary and are not used for advertising.
Who else processes it
DigitalOcean hosts the server, in the United States. Resend delivers our transactional email — sign-in codes, and the notification that tells us your enquiry arrived. Cloudflare answers DNS for our domains. Google runs the analytics described above.
That is the complete list for this website. The separate list of sub-processors used to deliver the product to a dispensary customer is on the security page, and the terms governing them are in the data processing addendum.
What we process for our customers
When a dispensary uses BudAlly, data about its own customers belongs to the dispensary, not to us — we handle it on their instructions as their service provider, under the data processing addendum. If you are a consumer who shopped at a dispensary and you want your data seen, corrected or deleted, ask the dispensary; we will help them answer you and we will not act on your data without their instruction. If you write to us instead, we will pass your request to the dispensary and tell you we have done so.
How long we keep it
An enquiry is kept for 24 months after our last contact with you, then deleted, unless it has become a customer relationship, in which case the customer terms apply. Web server access logs are kept for 30 days. Backups age out within 28 days.
You can ask us to delete your enquiry at any time and we will, without asking why.
Your rights, and how to use them
Wherever you live, you can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. California residents additionally have the rights to know, delete, correct, and to opt out of sale or sharing under the CCPA as amended by the CPRA — we do not sell or share personal information, so there is nothing to opt out of, and we do not discriminate against anyone who exercises a right.
Email privacy@budally.com. One message is enough; there is no form. We confirm receipt within 10 business days and answer within 45 days. We may ask you to confirm you control the email address the request concerns. Someone acting for you can make the request with your written permission.
Children
BudAlly is for businesses and is not directed at anyone under 21. We do not knowingly collect information from them, and will delete it if we learn we have.
Changes
If this policy changes in a way that affects what we do with information already collected, we will say so on this page, with the date, rather than quietly revising it.
Trademarks
BudAlly and the BudAlly mark are trademarks of BudAlly, Inc. Dutchie, Treez, Flowhub, Cova, BLAZE, Metrc, Headset, QuickBooks, Weedmaps and Leafly are trademarks of their respective owners; BudAlly is an independent product and is not endorsed by or affiliated with them. BudAlly is not affiliated with Ally Financial.