Privacy Policy

This policy explains what Hemp Connect collects, why, who we share it with, and the choices you have. It covers hempconnect.net and its marketplace, auctions and related features (“Hemp Connect,” “we,” “us”). Hemp Connect is run by Joseph Rudys (Hemp Connect), 1044 Don Felipe Rd, Belen, NM 87002, USA. Questions: joseph@hempconnect.net.

The short version

• We collect what you give us to run your account and to verify that sellers and buyers are who they say they are.
• We never take your card or bank details for purchases. You pay the seller or dispensary directly, at their own checkout.
• We don’t sell your personal information, share it for targeted advertising, or run ad trackers.
• ID photos are deleted as soon as we finish reviewing them.
• You can edit your profile, turn off optional emails, and close your account from your dashboard.

1. Who this applies to

Adults and businesses in the United States who buy or sell legal hemp and, where state law allows, licensed cannabis products. You must be 21 or older to create an account (section 10).

2. What we collect

a) Account and sign-in

Your email address and, if you set one, a password. Sign-in is handled by our database provider, Supabase; we never see your password in readable form. You can also sign in with a one-time email link.

b) Profile and business information

• Your role (grower, buyer, or another business such as a dispensary, brand or extractor) and, for buyers, whether you buy for yourself or a business.
• Your name, company, state and city; business type, acreage, annual volume and crop focus.
• A bio, profile and banner images, and showcase photos.
• Optional public contact details (email, phone, website) — shown publicly only if you turn that on.
• For dispensaries: shop name, license state and number, branding, pickup or delivery information and your checkout link.

c) License and identity verification

• License details: your state license number and type. We run an automatic format check and an admin reviews them by hand.
• ID photos: to verify your identity you may upload a photo of your government ID (and optionally a selfie). An admin reviews it by hand, and we delete the photos as soon as the review is finished, approved or denied. We keep only the result: verified or not, the date, your name as verified, whether you’re 21+, and your state.

d) Age and state confirmation

To use the auctions you confirm you meet the minimum age for your state and tell us your state. We record what you confirmed, which state, and when.

e) Listings, auctions and deals

Listings, photos, videos, prices and quantities; lab reports (Certificates of Analysis, “COAs”) and inventory files you upload; bids, Buy It Now purchases, wins and pickup status; inquiries and agreed deal terms; reviews and ratings; saved listings, saved searches and shops you follow.

f) Messages and payment instructions

Messages you exchange about a deal, and payment instructions a seller saves, are encrypted in our database. This isn’t end-to-end encryption: we hold the key, so authorized admins can read them to resolve disputes, investigate reports or meet legal requirements. Payment instructions are shown only to the buyer on a deal the seller accepted.

g) Waitlist, alerts and feedback

If you sign up for alerts: your email, an optional phone number, your role, language and country. If you send feedback: your message and email. We don’t send text messages today; we’ll ask for your consent before we ever do.

h) Visits and devices

• Page analytics: Vercel Web Analytics, which counts page views without cookies.
• Visit log: which part of the site was visited, approximate location (city, region, country, worked out from your IP address by our host), device type and browser, the referring site, any campaign tag, and roughly how long you stayed. We don’t store your IP address in this log or link it to your account.
• Sign-in location: when you sign in we note the approximate city and region.
• Server logs: our host keeps standard logs, which include IP addresses, to run and secure the service.

i) Emails we send

Emails go through our email provider, Brevo, which records whether an email was delivered and may record opens and clicks.

3. How we use it

• To run the service: your account, listings and auctions, bids, connecting buyers and sellers, and the notices you need (outbid, won, purchase about to expire, new inquiry, replies).
• For compliance and trust: reviewing licenses and identity, enforcing age and state rules, checking THC levels and lab reports, awarding Verified badges, and blocking deals that break the rules we enforce.
• To read your uploads: we send lab-report PDFs and inventory files to an AI service (Anthropic) to pull out test results and product details, which fill in your listing and are cross-checked against what you entered. Under Anthropic’s commercial terms, these files aren’t used to train its models.
• To bill shops: referral fees owed on completed auction and Buy It Now sales.
• To keep things safe: preventing fraud and abuse, investigating reports, enforcing our Terms.
• To run the business: the owner gets real-time alerts about signups, sign-ins, new listings, inquiries and visits, plus a daily summary.
• To contact you with service emails, announcements you signed up for, and replies.
• To meet legal obligations.

We do not use your information for targeted advertising, and we don’t sell it.

4. Who we share it with

Other users, as part of a listing or deal

• Your public listings, shop, ratings and reviews are visible to others. Your bio, photos and contact details are public only if you turn them on.
• When a seller accepts an inquiry, the buyer and seller can see each other’s names and companies, their messages and the deal terms; the buyer also sees the seller’s payment instructions.
• When you buy at auction or with Buy It Now, the dispensary sees your purchase and pickup details and, if you’re ID-verified, your verified name and that you’re 21+, so it can hand over the order lawfully.

Service providers who work for us

If we add a payment processor, a point-of-sale integration or an outside ID-verification company, we’ll update this list first.

Authorities and legal requirements

We may share information when we believe in good faith the law requires it (for example a subpoena, court order or a request from a state cannabis regulator), or to protect people’s safety, prevent fraud or illegal activity, or defend our legal rights. Where the law allows, we’ll try to tell you first.

If the business changes hands

In a merger, sale or similar deal, your information may pass to the new owner and stays covered by this policy unless you’re told otherwise.

5. Payments

We never collect or store your card number or bank login for purchases. Auction and Buy It Now purchases are paid at the dispensary’s own checkout; marketplace deals are paid directly between buyer and seller. We keep a record of what sold and for how much, to bill the shop’s referral fee and for records and disputes. Fees shops owe us are invoiced separately.

6. How long we keep it

We may keep something longer if the law requires it or it’s needed for a legal claim.

7. How we protect it

• Encrypted connections (HTTPS) everywhere.
• Database rules so each user can only see and change their own private data.
• Extra encryption for message text and saved payment instructions.
• A private, admin-only storage area for ID photos, which are deleted after review.
• Admin tools limited to a short list of approved accounts.

No system is perfectly secure. If a breach affects your personal information, we’ll notify you and the authorities as the law requires.

8. Your choices

• Edit your information at Dashboard → Profile.
• Public visibility: your public profile page and public contact details are off unless you turn them on.
• Email settings at Dashboard → Profile → Email notifications: turn off outbid alerts, auction-won emails, new-inquiry emails and “going live” alerts. Emails needed to complete a deal (purchase confirmations, expiring claims, inquiry replies) still send.
• Close your account at Dashboard → Profile → Delete account. Your name, company, location, business details, bio, photos, contact details, license and identity records, saved items, notifications, payment instructions, showcase files and any ID photos are removed; your listings close and your shop goes offline; your login is locked and your email released so you can sign up again later. Some records stay without your name attached — completed sales, bids, messages with the other party, and reviews — because other users and our legal records depend on them. To have waitlist signups or past owner alerts deleted, email joseph@hempconnect.net.

9. Cookies and browser storage

We don’t use advertising or cross-site tracking cookies. We use:

• Sign-in cookies (Supabase) to keep you signed in. Required.
• Visit cookies holding only a random ID: one stops us counting the same visit twice (24 hours), one records how long a visit lasted (6 hours).
• Local storage on your device that never leaves it: that you passed the auction age check, the role you picked before signing up, and which messages you’ve already dismissed.

Vercel Web Analytics doesn’t use cookies. If you block cookies you can’t stay signed in. We don’t sell or share personal information for advertising, and we treat a Global Privacy Control signal as an opt-out request.

10. Age requirement

Hemp Connect is only for adults. You must be 21 or older to create an account, and some states set a higher minimum for auctions. We don’t knowingly collect information from anyone under 21. If we learn we have, we’ll close the account and delete the information — tell us at joseph@hempconnect.net.

11. Your state privacy rights

Depending on where you live, US state privacy laws may give you the right to:

• know and access the personal information we hold about you, and get a copy;
• correct inaccurate information;
• delete your information (some records may stay, as in section 8);
• opt out of the sale of personal information, sharing for targeted advertising, or profiling — we don’t do any of these;
• not be treated differently for using your rights.

You can use these rights wherever you live. Email joseph@hempconnect.net with “Privacy request” in the subject. We’ll confirm your identity (usually by checking the email on your account) and respond within 45 days, or tell you if we need more time. An authorized agent can ask for you with your written permission. If we deny your request you can appeal by replying to our answer; we respond to appeals within 45 days, and if you still disagree you can contact your state attorney general.

California residents: in the past 12 months we collected identifiers (name, email, phone), commercial information (listings, bids, purchases), professional information (company, licenses), internet activity (visit log, analytics), approximate location, audio/visual information (photos, ID images) and sensitive personal information (government ID images during review only, and message contents). We collect these from you and your use of the site, for the purposes in section 3, and disclose them only to the recipients in section 4. We use sensitive personal information only to verify identity and provide the service. We have not sold or shared personal information, including that of anyone under 16, and we don’t share it with third parties for their own direct marketing.

Outside the US: Hemp Connect is run from the United States and stores data there. The German waitlist page has its own notice at /de/datenschutz.

12. Changes

If we change this policy we’ll update the date at the top; for a significant change we’ll tell you by email or on the site before it takes effect.

13. Contact

Joseph Rudys (Hemp Connect), 1044 Don Felipe Rd, Belen, NM 87002, USA · joseph@hempconnect.net