Privacy Policy

This Privacy Policy describes how Kamui Digital LLC ("Kamui", "we", "us", or "our") collects, uses, and shares information when you visit this website, request information about the Kamui platform, or sign up for an operator account. The Kamui platform is business software for retail shops, including licensed cannabis dispensaries; this site and the platform are intended for business operators. Where an operator's own customers' information (for example, order and delivery details) is processed in the platform, we process it on the operator's behalf, as the operator's service provider and under the operator's instructions.

01Information we collect

Information you provide

When you contact us or begin signing up for the platform, we collect the information you submit, which may include your business name, your name, email address, phone number, the workspace identifier ("slug") you request, and the plan tier you are interested in.

Information collected automatically

When you use this site or the platform, we and our service providers collect certain information automatically, including:

• Usage metrics — pages viewed, features used, actions taken in the platform, timestamps, and referring pages, used to understand how the service is used and to improve it.
• Device and browser data — IP address, browser type and version, operating system, screen size, language, and similar technical identifiers.
• Cookies and similar technologies — small files or local-storage entries used to keep you signed in to the platform and remember preferences (such as your theme choice). This marketing site does not currently set advertising or third-party analytics cookies. You can control cookies through your browser settings; disabling them may limit some functionality.
• Aggregated product analytics — statistics derived from platform usage (for example, feature adoption or error rates) that do not identify an individual.

As the platform evolves, we may expand the product telemetry we collect (for example, performance and reliability metrics). Any such telemetry is used for the purposes described in this policy, and we will update this policy if our practices materially change.

02How we use information

We use the information we collect to:

• operate, maintain, and provide the site and the platform;
• improve the service, including diagnosing problems, analyzing usage, and developing new features;
• secure the service, including detecting, preventing, and investigating fraud, abuse, and unauthorized access;
• communicate with you — responding to inquiries, onboarding, service announcements, and (with your consent where required) product updates; and
• comply with legal obligations.

03How we share information

We do not sell your personal information. We share information only with service providers (processors) who help us run the service, under contracts that restrict their use of it:

• hosting and infrastructure providers;
• payment processors (subscription billing is handled by Stripe; Kamui does not store full payment-card numbers);
• SMS and telephony providers used to deliver messages;
• analytics vendors that help us measure product usage (none are currently used on this marketing site).

Our current subprocessors are: Railway (cloud hosting and databases), Stripe (subscription billing), Resend (transactional email), SalesMessage (SMS delivery, where SMS features are enabled), Anthropic and OpenAI (language-model processing behind the AI assistant features), and Sentry (error monitoring and diagnostics). We will update this policy as the list changes. A data-processing agreement (DPA) is available to operators on request at legal@kamui.digital.

We may also disclose information if required by law, to protect the rights and safety of Kamui, our customers, or others, or in connection with a merger, acquisition, or sale of assets (in which case this policy will continue to apply to previously collected information).

Marketplace and point-of-sale integrations

Where such integrations are available, operators may connect Kamui to third-party marketplaces and point-of-sale services (for example, Weedmaps) to keep their menu, inventory, and orders in sync. When an operator enables such an integration, Kamui exchanges the data needed to provide it — such as product and pricing information and order details — with that service, acting as the operator's point-of-sale and integration provider on the operator's behalf and under the operator's authorization.

Order details received from a connected marketplace may include the order recipient's personal information — such as their name, contact details, delivery address, and, where applicable, medical-authorization information. We process that information solely as the operator's service provider to fulfill and record the order, under the operator's instructions. We do not use it for marketing, do not combine it with data from other sources or other operators, and do not use it for any purpose of our own.

Personal information exchanged with Weedmaps — whether provided to or received from Weedmaps — is handled in accordance with the Weedmaps Privacy Policy, which is incorporated here by reference for that data. We use marketplace data solely to provide the integration to the operator; we do not sell it, use it for our own commercial purposes, or use it to train machine-learning models, algorithms, or datasets. When an integration is disconnected or an account is terminated, we delete the associated marketplace data except where retention is required by law.

04Data retention

We retain personal information for as long as needed to provide the service and for legitimate business purposes such as accounting, dispute resolution, and legal compliance. Lead and contact information that does not result in an account is retained for a reasonable period and then deleted or anonymized. Aggregated or de-identified data may be retained indefinitely.

05Security

We maintain an information-security program with administrative, technical, and physical safeguards appropriate to the risk. These include encryption of data in transit, encryption of storage at rest by our hosting infrastructure with additional application-layer encryption for sensitive credentials and integration secrets, database-level tenant isolation so each operator's data is segregated from every other tenant's, access controls, and monitoring. If we become aware of a data breach affecting personal information, we will notify affected parties and any integration partners as required by law and by our agreements. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

06Your rights and choices

Depending on where you live, you may have rights regarding your personal information, including the right to request access to, correction of, or deletion of personal information we hold about you, the right to object to or restrict certain processing, and the right to data portability.

California residents (CCPA/CPRA)

The California Consumer Privacy Act gives you the right to know what personal information we collect, to request deletion or correction, and to not be discriminated against for exercising those rights. In the preceding 12 months we have collected the following categories of personal information, for the purposes described in section 02, sharing them only with the service providers described in section 03:

• Identifiers — name, email address, phone number, IP address;
• Commercial information — plan interest, subscription and billing records;
• Internet or network activity — usage metrics and device and browser data as described in section 01;
• Professional information — business name and your role at the business.

We do not sellor "share" (for cross-context behavioral advertising) personal information, and have not done so in the preceding 12 months. Beyond account log-in credentials (used solely to authenticate you), the only sensitive personal information we process arises where an operator enables ID verification — government-ID data handled solely as that operator's service provider, under its instructions. We do not use sensitive personal information to infer characteristics about anyone.

EEA/UK residents

Where the GDPR or UK GDPR applies, our processing rests on legal bases such as performing a contract, legitimate interests, consent, and legal obligations, and you may lodge a complaint with your supervisory authority.

To exercise any of these rights, email legal@kamui.digital(as an online-only business, we accept privacy requests by email). You may designate an authorized agent to submit a request on your behalf; we will verify the agent's authority and your identity. We will verify your request and respond within the time required by applicable law.

Do Not Track:some browsers send "Do Not Track" signals. There is no common standard for interpreting them, and this site does not currently respond to DNT signals.

07Children and age requirements

Kamui is business software for retail operators; this site and the platform are not directed to minors, and we do not knowingly collect personal information from anyone under 13. Where the platform is used by cannabis (or other age-restricted) retailers, the products those businesses sell are restricted to adults aged 21 and over, and those operators are responsible for their own age-verification obligations. If you believe a minor has provided us personal information, contact us and we will delete it.

08Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version here and update the "Last updated" date above. Material changes will be communicated to account holders by email or an in-product notice.

09Contact

Questions about this policy or our data practices: legal@kamui.digital.