Privacy Policy

HarvestRelay ("we", "us") provides an operational recordkeeping and compliance-preparation platform for licensed cultivation businesses, available on the web and through our iOS and iPadOS apps. This policy explains what information we collect, how we use it, and the choices you have. It applies to harvestrelay.com and the HarvestRelay mobile apps.

Account information. When you or your organization creates an account, we collect your name, email address, and password (stored as a secure hash). Your organization administrator may also assign you a role and farm-level permissions.

Operational records. The core of HarvestRelay is data your team enters about your own operation: farms, grow spaces, plants, harvests, inventory, site plans, uploaded documents and photos, and compliance worksheets. This data belongs to your organization.

Audit and usage data. To provide the append-only audit history that compliance requires, we record who performed each action, what changed, and when, along with technical details such as device type and IP address. We also collect basic logs needed to keep the service secure and reliable.

Camera access (mobile apps).The iOS app can use your device camera to scan plant tags and barcode labels. Scanning happens on your device; we do not receive a video feed. Photos you choose to attach are uploaded to your organization's workspace.

We use the information we collect to:

• provide, maintain, and improve the HarvestRelay service;
• enforce role-based access controls and maintain the audit history your organization relies on;
• respond to support requests;
• protect against fraud, abuse, and security incidents; and
• comply with legal obligations.

We do not sell your personal information, and we do not use your operational records for advertising.

Your operational records are visible to other members of your organization according to the roles and permissions your administrators configure. Beyond that, we share information only with:

• service providers that host our infrastructure (such as our database and file-storage providers), bound by confidentiality obligations;
• authorities, when required by law or a valid legal process; and
• a successor entity in the event of a merger or acquisition, under this same policy.

HarvestRelay never connects to Metrc or any government track-and-trace system, never stores Metrc credentials, and never submits data on your behalf.

We retain your organization's records for as long as the account is active. Because cultivation compliance often imposes its own record-retention requirements, deletion of operational records is managed by your organization's administrators. To delete your account or request deletion of your personal information, contact us at the address below; we will respond within 30 days, subject to any retention obligations that apply to your organization.

Data is encrypted in transit, access is restricted through role-based permissions and row-level security, and every change to operational records is captured in an append-only audit log. No system is perfectly secure, but we design ours so that access is limited to what each user is authorized to see.

HarvestRelay is a business tool for licensed operators and is not directed to anyone under 18. We do not knowingly collect information from children.

If we make material changes to this policy, we will post the updated version here and update the date below. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

Questions about this policy or your data? Email support@harvestrelay.com.