Privacy Policy

Who We Are

Cannalyze is a cannabis intelligence platform built in South Africa. We provide strain reviews, terpene science, community features, and AI-powered recommendations for adults 18 and older.

If you have questions about this policy, contact us at privacy@cannalyze.co.za.

What We Collect

We collect the following information when you use Cannalyze:

• Account information — your email address, chosen username or handle, and avatar preference.
• Content you create — strain reviews, community posts, and any text you submit.
• Usage and telemetry data — pages you visit, features you use, high-level event logs, browser metadata, and hashed network identifiers used for analytics, abuse prevention, and service diagnostics.
• Session data — age verification status, invite validation, and a temporary session identifier stored in your browser's session storage. These values are cleared when the tab session ends unless your browser restores the session.
• Local browser storage — your browser may store authentication session state, runtime configuration values you enter, onboarding progress, invite validation flags, one-time XP state, and a cached copy of public catalogue data for performance.
• Invite and referral data — when you use an invite code, we record the code used, the referring member, and a timestamp. This is used for referral attribution and is visible to admins in the Command Center.
• Subscription information — your membership tier (Free, Pro, or Lifetime) is stored in your profile.
• Support, moderation, and audit data — reports, moderation decisions, transactional email logs, and admin audit records needed to keep the platform safe and accountable.

Why We Collect It

• To provide the service — your account data lets you log in, post reviews, and track your progress.
• To improve Cannalyze — anonymous usage data helps us understand which features matter and where things break.
• To protect the platform — we use moderation records, audit logs, rate limits, and abuse-detection signals to prevent spam, fraud, invite abuse, and misuse of the service.
• To send updates — if you join the waitlist or create an account, we may send relevant product updates. You can unsubscribe at any time.

Legal Basis

We process your personal information under the Protection of Personal Information Act (POPIA), specifically:

• Section 11(1)(a) — Consent — you give consent when you create an account or submit content.
• Section 11(1)(f) — Legitimate interest — we have a legitimate interest in improving our platform and ensuring its security, balanced against your right to privacy.

How Long We Keep It

• Account data — kept for as long as your account exists. Deleted within 30 days of a deletion request.
• Reviews and posts — kept for as long as your account exists. If you delete your account, your content is anonymised or removed.
• Analytics data — retained for a maximum of 2 years, then automatically deleted.
• Waitlist, invite, moderation, and audit records — retained only for as long as reasonably required to operate the service, investigate abuse, comply with legal obligations, and maintain an accurate operational history.

Who We Share It With

We do not sell your data. We share limited information with the following service providers:

• Supabase — our database and authentication provider. Stores your account data and content. Supabase Privacy Policy.
• Anthropic — powers the AI Budtender. Only your chat messages are sent to Anthropic for processing. No personal data (email, username, or account details) is included in AI requests. Anthropic Privacy Policy.
• Plausible Analytics — privacy-friendly analytics. No cookies, no personal data collected, no cross-site tracking. Plausible Privacy Policy.
• Resend — our transactional email provider. Sends account confirmations, password resets, referral notifications, and subscription updates from info@cannalyze.co.za. Your email address is shared with Resend solely for email delivery. Resend Privacy Policy.

Some of these providers may process data outside South Africa. Where that happens, we rely on contractual protections and provider security controls appropriate to the service being used.

Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to update or correct inaccurate information.
• Deletion — request that we delete your personal information.
• Objection — object to us processing your personal information.
• Complaint — lodge a complaint with the Information Regulator if you believe your rights have been violated.

How to Exercise Your Rights

Email privacy@cannalyze.co.za with your request. We will respond within 30 days. We may ask you to verify your identity before processing your request.

Cookies

Cannalyze does not use tracking cookies for advertising or cross-site profiling. We do use browser storage technologies such as localStorage and sessionStorage to support sign-in state, invite gating, onboarding progress, catalogue caching, telemetry session IDs, and runtime configuration values.

Security

We use access controls, row-level security, audit logging, rate limiting, and provider-managed infrastructure protections designed to restrict access to personal information to authorised systems and team members. No internet service can be guaranteed 100% secure, but we work to reduce risk and respond quickly to abuse or vulnerabilities.

Changes to This Policy

If we make significant changes to this privacy policy, we will notify you by email (if you have an account) and update the "Last updated" date at the top of this page.

Information Regulator

If you are not satisfied with how we handle your personal information, you may lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: complaints.IR@justice.gov.za