01 Information we collect
We collect only what is needed to operate the Service:
- Account information — your name and email address, provided when you create or sign in to an account, used to authenticate you and secure your workspace.
- Account identifiers — an internal user and facility (tenant) identifier used to associate you with your organization's data and your subscription.
- Subscription and purchase data — when you subscribe, Apple processes your payment and our subscription provider (RevenueCat) records your purchase history and subscription status. We do not receive or store your payment card details.
- Operational data you provide — your Metrc facility license, facility and room configuration, and the cultivation records you view or submit (plant movements, tags, harvests, waste, etc.). This data is synced to and from your organization's own state Metrc account at your direction.
We do not collect advertising identifiers, precise location, your contacts, photos, or browsing history, and we do not use third-party analytics or advertising SDKs.
02 How we use information
- To authenticate you and provide the Service's core functionality.
- To sync compliance data between the Service and your licensed Metrc facility.
- To process and manage your subscription (including a free trial, if offered).
- To secure the Service, prevent abuse, and provide support.
03 Tracking & advertising
We do not track you across apps or websites owned by other companies, we do not serve advertising, and we do not sell or rent your personal information. The data we collect is used only to provide the Service.
04 Service providers
We share information only with providers that help us run the Service, under agreements that limit their use of the data:
- Apple — processes in-app subscription payments.
- RevenueCat — manages subscription entitlements (purchase history and your account identifier).
- Cloud infrastructure providers (Amazon Web Services) — host the Service and store data.
- Metrc / state track-and-trace systems — you connect your licensed facility, and we exchange compliance data with Metrc on your behalf.
05 Data security
We use industry-standard safeguards to protect your information in transit and at rest. Sensitive credentials, such as your Metrc API key, are stored encrypted and are used solely to sync your licensed facility's data. See our Security page for detail.
06 Data retention
We retain account and operational data for as long as your account is active or as needed to provide the Service and meet legal and compliance obligations. You can request deletion as described below.
07 Account deletion
You can delete your account and its associated data at any time from within the app (Settings → Delete Account), or by contacting us at hello@carinaos.com. Deleting your account removes your workspace and its records from our systems. Note that compliance records already reported to a state Metrc system are governed by that system and applicable law.
08 Children
The Service is a business tool intended for licensed operators and is not directed to children. It is rated for adults and should not be used by anyone under 17.
09 Your rights
You may request access to, correction of, or deletion of your personal information by contacting us at hello@carinaos.com. Depending on your location, you may have additional rights under applicable privacy laws.
10 Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date above.
11 Contact
Questions about this policy? Contact us at hello@carinaos.com.