This policy explains what information HigroTech LLC (“HigroTech”, “we”, “us”) collects, why we collect it, who we share it with, how long we keep it, and how you can see, fix or delete it.
It covers:
- higrotech.com, our company website, and our intake forms at intake.higrotech.com;
- BOOTH, our platform for our customers and our team, at platform.higrotech.net (also booth.higrotech.net);
- mncannabis.net, the MN Cannabis directory we run;
- the websites, kiosks and in-store menu screens we build and run for stores (“store services”);
- our social media posting service, which publishes a store’s approved posts to its Facebook Page and Instagram account.
The short version
- We don’t sell personal information, and we don’t put advertising trackers on the sites we run.
- Most of what we handle is information about businesses: the stores we work with, their products and their menus.
- When we run a website, kiosk or posting service for a store, we do it on that store’s behalf. That store’s own privacy policy applies too.
- You can ask us what we hold about you, and ask us to correct or delete it, at admin@higrotech.com.
Who we are
HigroTech LLC is a Minnesota company. We design, build and run websites, in-store kiosks, live inventory menus and marketing tools for licensed retailers, many of them state-licensed cannabis retailers.
HigroTech LLC
8565 80th St N
Stillwater, MN 55082
admin@higrotech.com
What we collect and why
On higrotech.com and our intake forms
- Forms you fill out. Our client intake, brand intake and website-transfer forms collect what you type: usually your name, business name, phone number, email address, city, current website, and answers about your brand and your project. We use it to answer you, to quote, and to do the work you ask for.
- Logins for a website move. The website-transfer form asks for logins and account details for your current website, domain or hosting, so we can move your site. We use them only for that move. When the move is done we delete them, or keep them in our encrypted credential store if we’re running the site for you from then on.
- Where the forms are hosted. Our intake forms are at intake.higrotech.com, hosted by WordPress.com, which belongs to Automattic. Its statistics tool records things like the pages you visit, the page that sent you, your browser type and your IP address, and it may set cookies to do so. We see totals, not individual visitors.
- The rest of higrotech.com sets no cookies and runs no statistics tool. Our server logs record your IP address, the time and the page requested, for security and to fix problems.
- Fonts. Pages load fonts from Google Fonts, so your browser contacts Google’s servers, which see your IP address.
On BOOTH
- Your account: your name, email address, your role, and which store or stores your account belongs to. Your password is stored only as a one-way hash, so no one at HigroTech can read it.
- What you put in: support tickets and comments, images you upload, ad bookings, store hours and promotions you edit, and posts you approve.
- Store service credentials: logins and keys a store gives us for its point-of-sale system or other services, so our systems can read its menu. These are stored encrypted and used only to run that store’s service.
- Staying signed in: BOOTH keeps a sign-in token in your browser’s local storage.
- Server logs: your IP address, the time and the page you asked for. We use these for security and to fix problems.
On mncannabis.net
- There are no accounts or sign-up forms.
- Your location, if you share it. If you let your browser share your location, or type a ZIP code, the site uses it to sort stores by distance. It is not saved with your name, because we don’t know your name.
- Questions you ask Gordy, the site’s product-finding assistant. Your question is sent to Amazon Web Services (Amazon Bedrock), which turns it into a list of numbers used for searching, and to Anthropic, the company that makes the Claude AI model, which picks the best match from current store menus. We keep the list of numbers and the answer for up to 24 hours, so a similar question can be answered faster. We don’t keep the words you typed, and we can’t tie a question to a person. Please don’t type personal information into Gordy.
- Display settings, such as light or dark mode, are saved in your browser.
- Server logs: IP address, time and page requested, for security and to fix problems.
On store websites, kiosks and menu screens
We build and run these for the store. Each store website links to the store’s own privacy policy. This section covers our part.
- Age check. A cannabis store’s website asks whether you’re 21 or older. The answer is saved in your browser for that visit. It isn’t sent to us.
- Email or text sign-ups. If a store’s site has a sign-up form, we store the email address (and phone number, if you give one) and the time you signed up, for that store, and give the list to the store. It stays until the store or you ask us to remove it.
- Contact forms. Messages sent through a store site’s contact form are delivered to the store. We keep a copy for 90 days so we can resend one that failed, then it is deleted automatically.
- Pickup orders. If you place an order on a store’s site, we pass your name, phone number, email address, notes and order to the store’s point-of-sale system. We keep a record of the order for 365 days so we and the store can trace an order that went wrong, then it is deleted automatically.
- Kiosks and menu screens show the store’s products. They don’t collect information about the people using them. Some stores use an ID scanner at the door that we install; the scanned details go to the store’s point-of-sale system, not to us.
- Server logs for store sites and menu screens: IP address, time and page requested, for security and to fix problems.
Social media posting (Facebook and Instagram)
What it does. A store, or HigroTech for its own accounts, can connect a Facebook Page and an Instagram professional account. Our posting system, a copy of the open-source tool Postiz that runs on our own servers, then publishes the posts the store has approved in BOOTH, on the schedule it chose.
What we receive from Meta when you connect an account:
- the names, IDs and profile pictures of the Pages and Instagram accounts you choose to connect, and of the business portfolio they belong to;
- the access tokens Meta issues, which let our system post on your behalf;
- after posting: each post’s ID and link, the comments on it, and how it performed (for example reach, likes and comments).
What we use it for. Only to publish the store’s approved posts, confirm they went out, show the store how they did, and let the store reply to comments from BOOTH. We don’t use any data from Meta for advertising. We don’t sell it, we don’t combine it with other data to build profiles of people, and we don’t share it with anyone except as needed to run this service for the store that connected the account.
Where it’s kept. In a database on our servers in Amazon Web Services’ data center in Ohio, in the United States.
How long we keep it. As long as the account stays connected. When the account is disconnected, or when you ask us, we delete its access tokens and the account data we hold within 30 days. Posts that were already published stay on Facebook or Instagram until you delete them there.
Removing our access yourself. You can cut off our access at any time:
- Facebook: Settings and privacy → Settings → Business integrations, then remove HigroTech.
- Instagram: Settings → Website permissions → Apps and websites, then remove HigroTech.
Removing access stops all posting straight away. To have the data we already hold deleted too, follow the steps under How to ask us to delete your data.
Shared product information vs. your own content
Some of what flows through our services is product information: product and strain names, product type, lineage, and whether something is in stock. We use product information from all the stores we work with to keep a shared product library accurate, and parts of it appear on mncannabis.net.
A store’s own content is different: its photos, its written descriptions, its branding and its customers’ details. That stays the store’s. We use it only to run that store’s services, and we don’t give it to other stores.
Who we share information with
We don’t sell or rent personal information. We share it only:
- With the store you’re dealing with, when we run a service for that store.
- With companies that run parts of our services for us, only as much as they need to do that:
- Amazon Web Services: hosting, storage and the search step behind Gordy;
- Anthropic: the AI model behind Gordy and some of our writing tools;
- WordPress.com (Automattic): hosting for our intake forms;
- Google: web fonts;
- Meta: when a store uses our social posting service;
- a store’s point-of-sale provider (for example Dutchie): when we read the store’s menu or send it an order;
- the tools we use to run our business, for team messaging, work tracking, billing, accounting and contracts.
- When the law requires it, or to protect the rights, property or safety of HigroTech, our customers or others.
- If HigroTech is merged or sold, in which case the information moves with the business and stays covered by this policy.
How long we keep information
- Form answers and business records: while we’re working with you, and after that for as long as we need them for accounting, tax and legal reasons.
- BOOTH accounts: until the account is closed.
- Store sign-up lists, contact form copies, order records and social posting data: as described in their sections above.
- Server logs: for a limited time, for security and to fix problems.
- Backups: our database backups are deleted on a fixed schedule, at most 120 days after they’re made, so deleted information can stay in a backup until then.
Your choices and rights
Whatever state you live in, you can ask us to:
- tell you whether we hold personal information about you, and give you a copy;
- correct information that’s wrong;
- delete information about you;
- stop sending you marketing email (every marketing email also has an unsubscribe link).
Email admin@higrotech.com with “Privacy request” in the subject. We’ll answer within 45 days. We may need to confirm who you are before we act. If we hold the information for a store, we’ll pass your request to the store or act on its instructions. We won’t treat you differently for making a request.
How to ask us to delete your data
- Email admin@higrotech.com from the address linked to your account, with “Delete my data” in the subject.
- Tell us which service it’s about: BOOTH, social posting, a store’s sign-up list, an order, or one of our intake forms. For social posting, include the name of the Facebook Page or Instagram account.
- We’ll confirm we’ve received it within 5 business days, finish within 30 days, and email you when it’s done.
For Facebook and Instagram you can also remove our access yourself first, as described under “Removing our access yourself” above.
Children
Our business services are for adults. mncannabis.net and cannabis store websites are for people 21 and older. We don’t knowingly collect personal information from anyone under 21 on those sites, or from anyone under 18 on our other services. If you think we have, email us and we’ll delete it.
Security
All our sites use encrypted connections (HTTPS). Store service credentials are stored encrypted, and only team members who need access have it. No system is perfectly secure. If a security breach affects your information, we’ll tell you as the law requires.
Where information is processed
In the United States.
Changes to this policy
When we change this policy we’ll update the date at the top. If a change matters, we’ll also say so on this page and email BOOTH users.
Contact
HigroTech LLC
8565 80th St N
Stillwater, MN 55082
admin@higrotech.com
