Privacy policy

Connecting a mailbox is optional, and is used for exactly one thing: sending a purchase order that you have assembled and explicitly chosen to send.

StockBud requests one Gmail permission, gmail.send, which permits sending a message on your behalf and nothing else. It also requests openid and email so that we can record and display which mailbox is connected, because the sending permission alone does not tell us the address.

StockBud cannot read, search, download, modify or delete your email. The permissions that would allow any of that are not requested, so no consent you give us grants them.

When you connect a mailbox, we store:

• the email address of the connected account, and a display name used to sign orders;
• an OAuth refresh token, encrypted at rest with AES-256-GCM under a key held outside the database, so that a copy of the database is not on its own enough to send mail as you;
• a short-lived access token, valid for roughly an hour, kept only until it expires and then replaced;
• a record of each order sent: recipient, any CC addresses, the subject, the filenames of attachments, the time, and the identifiers Gmail returns for the message.

We do not store the body of sent messages, and we never store your Google password — authentication happens on Google’s own sign-in screen and we never see it.

StockBud’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it, we do not transfer it except as needed to provide the sending feature you asked for, and we do not use it to train generalized artificial-intelligence or machine-learning models. No human reads your Google data except where you have asked us to help with a problem, where it is necessary for security, or where the law requires it.

You can disconnect the mailbox at any time under Settings → Email, which deletes the stored tokens and stops all sending. You can also revoke access directly from your Google account permissions, which takes effect immediately and independently of us.

Your account. Your name and email address, so we know who you are and which dispensary you belong to.

Your store’s inventory and sales. When a dispensary connects its point-of-sale system, we read product, inventory and sales data in order to calculate days of supply and build reorder plans. This is business data about products, not information about the people who bought them.

Vendor contacts you enter. The names and email addresses you save so orders can be addressed, plus any documents you upload to attach to orders, such as a license or delivery instructions.

We use a small number of providers to run the service, each handling data only to do so: Google (delivering the mail you send), Vercel (application hosting), Supabase (database and file storage), and Clerk (sign-in). We do not sell data to anyone, and we do not share it with advertisers.

Mailbox tokens are deleted as soon as you disconnect. Records of orders you have sent are kept as part of your dispensary’s purchasing history, because a store needs to be able to show what it ordered and when. If your dispensary closes its account, we delete its data on request.

To ask for deletion, or for a copy of what we hold, write to support@stockbud.ai.

Data is encrypted in transit. Mailbox refresh tokens are additionally encrypted at rest, as described above. Access to a dispensary’s data requires membership of that dispensary, and staff access to production systems is limited to the people who operate them.

If we change what we do with data, we will update this page and move the date at the top. If a change materially affects data from your Google mailbox, we will tell you rather than rely on you noticing.

Questions about this policy, or about data we hold: support@stockbud.ai.