Privacy policy

Connecting a mailbox is optional, and is used for three things only: sending emails to your vendors, such as a purchase order you have assembled and explicitly chosen to send; identifying which of your emails are from your vendors, and their email addresses, so orders can be addressed for you; and finding the vendor invoices for deliveries recorded in Metrc, so each can be opened from the delivery it bills for.

StockBud requests two Gmail permissions. gmail.send permits sending a message on your behalf. gmail.readonly permits reading your mail, and is used only to identify your vendors’ emails and to find their invoices. It also requests openid and userinfo.email so that we can record and display which mailbox is connected.

StockBud cannot modify, delete, label or send anything other than the orders you choose to send. It decides whether a message is from one of your vendors using only the sender, subject and date. It finds invoices by searching your mail for what Metrc records about a delivery — its invoice or manifest number, its vendor, or its amount — and reading the PDFs on the matching messages to confirm which one is the bill. Every other message is skipped and nothing from it is stored.

When you connect a mailbox, we store:

• the email address of the connected account, and a display name used to sign orders;
• an OAuth refresh token, encrypted at rest with AES-256-GCM under a key held outside the database, so that a copy of the database is not on its own enough to send mail as you;
• a short-lived access token, valid for roughly an hour, kept only until it expires and then replaced;
• a record of each order sent: recipient, any CC addresses, the subject, the filenames of attachments, the time, and the identifiers Gmail returns for the message;
• for vendor emails only: the sender, subject, date, the message text (shortened), the links in it, the names of any attachments, and which vendor and brands it concerns. These are visible to the members of your dispensary.
• for vendors set up in StockBud as sending their menu by email only: the menu file attached to their few most recent emails, so it can be opened from StockBud. No other attachment is downloaded for this purpose.
• for deliveries recorded in Metrc only: the invoice files that bill for them, with the sender, subject and date of the email they came on, and the invoice number and totals printed in them, so the bill can be opened and checked against the delivery. Nothing else from that email is stored.

We do not store the body of sent messages, and we never store your Google password — authentication happens on Google’s own sign-in screen and we never see it.

StockBud’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it, we do not transfer it except as needed to provide the sending, vendor-email and invoice features described above, and we do not use it to train generalized artificial-intelligence or machine-learning models. No human reads your Google data except where you have asked us to help with a problem, where it is necessary for security, or where the law requires it.

You can disconnect the mailbox at any time under Settings → Email, which deletes the stored tokens and the vendor emails found in that mailbox, and stops all sending and reading. Invoices already attached to deliveries are kept with your purchasing history; ask us and we will delete them. You can also revoke access directly from your Google account permissions, which takes effect immediately and independently of us.

Your account. Your name and email address, so we know who you are and which dispensary you belong to.

Your store’s inventory and sales. When a dispensary connects its point-of-sale system, we read product, inventory and sales data in order to calculate days of supply and build reorder plans. This is business data about products, not information about the people who bought them.

Vendor contacts you enter. The names and email addresses you save so orders can be addressed, plus any documents you upload to attach to orders, such as a license or delivery instructions.

We use a small number of providers to run the service, each handling data only to do so: Google (delivering the mail you send), Vercel (application hosting), Railway (the background service that syncs your point-of-sale data and looks for vendor emails and invoices), Supabase (database and file storage), and Clerk (sign-in). We do not sell data to anyone, and we do not share it with advertisers.

Mailbox tokens, and the vendor emails found in that mailbox, are deleted as soon as you disconnect. Vendor emails are otherwise deleted 180 days after they arrive. Records of orders you have sent, and vendor invoices attached to deliveries, are kept as part of your dispensary’s purchasing history, because a store needs to be able to show what it ordered and when. If your dispensary closes its account, we delete its data on request.

To ask for deletion, or for a copy of what we hold, write to chris@stockbud.ai.

Data is encrypted in transit. Mailbox refresh tokens are additionally encrypted at rest, as described above. Access to a dispensary’s data requires membership of that dispensary, and staff access to production systems is limited to the people who operate them.

If we change what we do with data, we will update this page and move the date at the top. If a change materially affects data from your Google mailbox, we will tell you rather than rely on you noticing.

Questions about this policy, or about data we hold: chris@stockbud.ai.