01 Who we are
CarinaOS is a cannabis cultivation operating system — a hardware-agnostic intelligence layer that unifies METRC compliance, live sensor data, and crop analytics for licensed operators. The service is provided by CannaVia Holdings LLC ("CarinaOS," "we," "us"), which acts as the data controller for the information described here.
This policy covers our marketing site (carinaos.com) and the application (app.carinaos.com). It does not cover third-party systems you connect — such as METRC or your sensor vendors — which operate under their own privacy terms.
02 What we collect
We collect only what the platform needs to run your operation. That falls into four groups.
Account information
- Your name, email address, and password (stored only as a salted hash — we never see your plaintext password).
- Facility name and your role within the operation.
Compliance & cultivation data
- Your METRC license number and the API credentials you supply to connect it.
- Records you sync through CarinaOS: plant batches, harvests, packages, transfers, waste, and the cultivation logs derived from them.
Sensor & operational data
- Readings pulled from the hardware you connect — climate, substrate, water, and tank metrics from systems such as Growlink, AROYA, and YoLink.
- Room and tank configuration from your sensor manifest.
Billing & usage data
- Subscription and payment details, processed by Stripe. We do not store full card numbers — Stripe handles card data directly.
- Standard log and device data (IP address, browser, pages and features used) to keep the service secure and reliable.
03 How we use it
- To operate the platform — syncing METRC, displaying sensor data, and computing the analytics you rely on.
- To authenticate you and isolate your facility's data from every other tenant.
- To process subscription billing and provide support.
- To monitor for abuse, debug issues, and improve reliability and features.
- To send service-related messages (alerts, billing notices, security notifications).
04 Subprocessors
We rely on a small set of trusted infrastructure providers to deliver the service. Each receives only the data needed for its function.
| Provider | Purpose | Data handled |
|---|---|---|
| Supabase | Authentication & database | Account, facility, and synced records |
| Stripe | Payment processing | Billing details & card data |
| Cloudflare | Edge compute, sync workers & CDN | Credentials in encrypted storage; request data |
| Amazon Web Services | Static hosting (S3 / CloudFront) | Public site assets |
| METRC | State compliance API | Compliance records you sync |
| Calendly | Demo scheduling | Name & email you submit |
Sensor-platform vendors you connect (Growlink, AROYA, YoLink, and others) act as data sources rather than subprocessors; your relationship with them is governed by their own terms.
06 Retention
We keep your data for as long as your account is active. When you cancel, we retain your facility's data for a limited window so you can export or reactivate, then delete or anonymize it on request or at the end of that window — except where we're legally required to keep records longer. You can request export or deletion at any time (see Your rights).
07 Your rights
Depending on where you operate, you may have the right to:
Access
Request a copy of the personal data we hold about you.
Export
Download your facility's data in a portable format.
Correct
Update inaccurate account information.
Delete
Ask us to erase your data, subject to legal limits.
To exercise any of these, email hello@carinaos.com. We'll verify your identity before acting and respond within the timeframe required by applicable law.
09 Security
We encrypt data in transit and at rest, isolate each tenant's data and credentials, and store API keys as encrypted secrets that are never exposed in the interface. For a full account of our controls, see our Security overview. No system is perfectly secure, but protecting your operation's data is core to the product.
10 Age & eligibility
CarinaOS is a business tool for licensed cannabis operators. It is not directed to anyone under 21, and we do not knowingly collect data from minors. You must be of legal age and authorized to act for a licensed facility to use the service.
11 Changes to this policy
We may update this policy as the product and the law evolve. When changes are material, we'll update the date above and notify account holders. Continued use after an update means you accept the revised policy.
12 Contact
Questions about privacy or your data? Reach us at hello@carinaos.com. For security matters, support@carinaos.com.