Privacy Policy
1. Who we are and what this policy covers
PURP Technologies Inc. (“PURP”, “we”, “us”) is based in Edmonton, Alberta, Canada. PURP makes business-to-business retail software for licensed cannabis retailers.
This policy explains how we handle personal information on the purpco.com website, including its buying guides, the contact form and the live demos of PURP (point of sale, Admin, Delivery Dispatch, the Driver app and the wallet pass and gift card designers). The website sells nothing, takes no payments and does not sell or deliver cannabis.
This policy does not cover:
- The PURP apps. The PURP POS app and the PURP Driver app have their own privacy policies: the PURP POS privacy policy and the PURP Driver privacy policy.
- Information we process for retailers. When a retailer uses the PURP platform, PURP processes that retailer’s records, including information about its customers and staff, on the retailer’s behalf under the retailer’s agreement with PURP. The retailer decides how that information is used and is responsible for its own privacy notices. If you are a customer of a store that uses PURP, please contact that store first.
2. Information we collect and why
When you contact us
The “Talk to PURP” form on our homepage and contact page asks for your name, email address, phone number (optional) and your message. We use this information to reply to you and to follow up about PURP. Submitting the form does not subscribe you to marketing email.
To stop duplicate sends and spam, our server keeps a short-lived receipt of each submission. The receipt holds a fingerprint (a one-way hash) and its delivery status, not your message. Our spam limits count submissions per hashed email address over ten minutes and across the whole site each hour. We do not use your IP address for these limits.
When you try a demo
Starting a demo gives your browser its own fictional “practice business” with sample products, fictional customers and fictional sales, orders and deliveries. We do not ask for your name or email address to start a demo.
If you choose, you can type a store name, pick colours and upload a logo (PNG, JPEG or WebP, up to 500 KB) to see your branding on the pass, gift card and email previews. We store these for the length of your visit so the previews can show them. Anything else you type into the demo apps, such as a sample customer or a note, is saved in your practice business and deleted with it when the visit ends. While your visit lasts, anyone who has the exact web address of an uploaded logo image can open it, but uploaded logos cannot be listed or searched.
Please do not enter real customer information or other real personal information into the demo. The demo is for trying PURP with fictional data. Payments in the demo are simulated, no email is sent to anyone and no Apple or Google wallet pass is issued.
The demo includes Ask P, an AI assistant. If you type a question into it, the question and the practice business information needed to answer it are sent to our AI provider to produce the answer (see section 5).
Technical information
Like most websites, our hosting and servers record technical details of each request, such as your IP address, browser and device type (user agent), the page or address requested and the time. We use this information to keep the site secure, to prevent abuse and to diagnose problems.
4. How we use information and your consent
We use personal information only for the purposes described in this policy:
- to answer your enquiry and continue a business conversation you started;
- to provide your demo visit and show your chosen branding;
- to keep the website and demos secure, prevent spam and abuse, and fix problems; and
- to meet our legal obligations.
We handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA). We rely on your consent. When you send the contact form, you consent to our use of the details you provide to reply and follow up. When you choose to start a demo or upload branding, you consent to our use of that information to run your visit. We rely on implied consent for the technical processing that any website needs to operate securely. You may withdraw consent at any time, subject to legal or contractual limits, by contacting us as set out in section 9; if you do, we may not be able to answer your enquiry or provide a demo.
We send commercial email in line with Canada’s anti-spam law (CASL). Any commercial message we send will identify us and include a way to unsubscribe.
We do not sell personal information, and we do not share it with anyone for their own marketing.
Analytics consent is separate from sending an enquiry or starting a demo. Withdraw it through “Analytics settings”; you can continue using those features after declining analytics.
5. Service providers and processing outside Canada
We use the following service providers to run the website. They process information to provide their services to us, under their contracts with us:
- Google Cloud and Firebase (Google LLC) for website hosting, servers, databases, file storage, sign-in for demo visits and server logs. Demo data is held in the United States.
- Amazon Web Services (Amazon Simple Email Service) to deliver contact-form messages to our inbox. This processing takes place in the United States.
- Microsoft (Microsoft 365) hosts our email inbox, where contact-form messages and our replies are kept.
- OpenAI (United States) answers questions you type into the demo’s AI assistant, Ask P. Your question and the practice business information needed to answer it are sent to OpenAI. Please do not type personal information into Ask P.
- Mapbox (United States) to show maps on some pages, such as Deliver the Day, and in the demo. When a map loads, your browser downloads Mapbox's map software and map tiles directly from Mapbox. Mapbox receives your IP address and browser details and records the map load under its own terms and privacy policy.
Some sample product images in the demo may load directly from the image services that host them, such as brand or supplier image hosts. Those services receive your IP address and browser details when an image loads.
Your information will be processed and stored outside Canada, mainly in the United States. You can ask our Privacy Officer (section 12) for written information about our policies and practices for service providers outside Canada, and our Privacy Officer can answer your questions about how those providers collect, use, disclose and store personal information. While it is there, it is subject to the laws of the United States, and courts, law enforcement and national security authorities there may be able to access it. We rely on these providers’ contractual commitments to protect the information and to use it only to provide their services to us.
6. Other disclosures
We may disclose personal information:
- where required or permitted by law, such as in response to a valid court order, warrant or other legal process;
- to protect the security of our website, systems and users, or to investigate fraud or misuse; and
- to a party to a proposed or completed sale, merger, financing or other business transaction involving PURP, where that party agrees to protect the information and use it only for the purposes of the transaction or as described in this policy.
7. How long we keep information
- Contact-form receipts (a one-way hash fingerprint of the message and its delivery status, never the message itself) are kept so the same message is not sent twice, and are deleted automatically about seven days after the message is sent.
- Contact-form messages stay in our email inbox for as long as we need them to handle your enquiry and any business relationship that follows, and are then deleted.
- Demo visits end when you leave (about 45 seconds after your last demo page closes), after ten minutes without activity, when you choose to start again, or at most eight hours after the visit began. When a visit ends, we delete its practice business, its demo sign-ins, your uploaded logo and your branding.
- Server and hosting logs are kept for a limited period. Google Cloud’s default retention for these logs is 30 days.
- Previously collected Google Analytics data remains subject to the existing two-month user and event retention setting. Aggregated reports can remain available longer. New optional website analytics collection is disabled.
- Spam-limit counters hold a hashed email address, a count and a reset time. They are used only for the spam limits described in section 2, contain no message text, and are deleted automatically within about an hour after their limit period ends.
We may keep information longer where the law requires it or where it is needed to resolve a dispute or security incident.
8. How we protect information
We use safeguards appropriate to the sensitivity of the information, including:
- encryption of all connections to the website (HTTPS);
- access to our systems and inbox limited to people who need it for their work;
- demos use practice data in an environment isolated from real retailer data; and
- one-way hashing, instead of stored email addresses, for spam and duplicate checks.
No method of transmission or storage is completely secure. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the appropriate regulators as the law requires.
9. Your rights and how to use them
Subject to legal exceptions, you have the right to:
- ask whether we hold personal information about you and get access to it;
- ask us to correct information that is inaccurate or incomplete;
- withdraw your consent, as described in section 4; and
- ask how your information has been used and to whom it has been disclosed.
To make a request, email hi@purpco.com with “Privacy request” in the subject line. We may need to confirm your identity before we act. We will respond within 30 days, or tell you within that time if we need an extension and why. Please do not send passwords or identity documents in your first message.
Quebec residents also have rights under Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), including the right to ask us to stop disseminating or to delete your information in certain circumstances and the right to receive computerized personal information you provided to us in a structured, commonly used technological format. As explained in section 5, your information may be communicated outside Quebec. Contact us at the same address to exercise these rights.
If you live outside Canada, you may have additional rights under your local law. Contact us and we will respond in line with the law that applies.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, to Alberta’s Office of the Information and Privacy Commissioner, or, in Quebec, to the Commission d’accès à l’information. We would appreciate the chance to address your concern first.
10. Children
purpco.com is intended for business users who are adults and, where the law requires it for the cannabis industry, of legal age in their jurisdiction. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.
11. Changes to this policy
We may update this policy as the website and the law change. We will post the updated policy on this page and change the “Last updated” date. If we make a significant change to how we use personal information, we will make it clear on the website before the change takes effect.
12. Contact us
Questions, requests and complaints about privacy can be sent to our Privacy Officer:
Attention: Privacy Officer
PURP Technologies Inc.
Edmonton, Alberta, Canada
hi@purpco.com
See also our Terms of Use.