Privacy
Privacy Policy.
Last updated: August 27, 2026
Hammer Forge Apps LLC DBA CBDPOS ("CBDPOS", "we", "us") builds point of sale and online store software for retail businesses. This policy explains what information we collect through the cbdpos.com website and the CBDPOS service, how we use it, who we share it with, and the choices you have.
This policy covers our relationship with you: the visitor, the person who starts a trial, and the merchant account holder. If you are a customer of a store that runs on CBDPOS, that store has its own privacy policy, and the store, not us, decides how your information is handled. We process that information on the store's behalf as described in section 10.
On this page
- 1. About this policy
- 2. Information we collect
- 3. How we use information
- 4. How we share information
- 5. We do not sell your personal information
- 6. Your choices
- 7. How long we keep information
- 8. How we protect information
- 9. Your privacy rights (United States)
- 10. Your customers' information
- 11. Children
- 12. Email practices
- 13. Changes to this policy
- 14. Contact us
1. About this policy
It applies to the cbdpos.com website and to the CBDPOS service (the point of sale, online store, delivery, and compliance software we provide to merchants).
Questions: [email protected]. We are the entity responsible for the information described here.
2. Information we collect
Account and business information
When you sign up or start a trial, you give us your business's legal name, DBA name, contact email, contact phone, the industry you operate in, your plan choice, and your location count, plus the first name, last name, and email of the administrator account. We also keep a record of your account status and the history of status changes.
Billing information
Subscription payments run through Stripe. When you pay, your card details are entered into Stripe's checkout and go directly to Stripe. We never receive or store your full card number. We store your Stripe customer reference and the status of your subscription so the service knows what you have access to.
Analytics data
We use Google Analytics 4 on cbdpos.com to understand how the site is used: pages viewed, buttons clicked, signup steps reached, and similar events. GA4 sets cookies in your browser for this purpose. Analytics is opt-in: a consent banner loads on your first visit, and nothing analytics-related loads until you accept it. You can change or repeat your choice by clearing site data. We do not use analytics to build advertising profiles about you. You can block or delete these cookies in your browser settings, and Google offers a browser add-on to opt out of GA4 entirely.
The contact and waitlist forms on cbdpos.com fire an analytics event when submitted, but their entries are not currently transmitted to or stored by us.
Email subscriptions
If you sign up for our email newsletter or download a guide, your email address is delivered to Kit (ConvertKit), our email marketing provider, so we can send you the download and future emails. Every marketing email includes an unsubscribe link.
Merchant business data and end-customer data
If you are a merchant, the service processes your business data on your behalf: products, inventory, prices, orders, receipts, and the customer records you create or that shoppers give your store, such as names, email addresses, phone numbers, shipping and delivery addresses, and order history.
To run your store, parts of this data are passed to partners only as needed: customer name, address, phone, and order details to the local delivery dispatch service (Shipday); addresses to shipping rate services (EasyPost); addresses to Google's address lookup service for delivery distance checks; and ZIP codes to a sales tax rate service (Ziptax).
Payment data for your sales
Card payments for a merchant's own sales run through that merchant's own payment processor account (for example, Authorize.net). Card details are turned into a token in the customer's browser and sent straight to the processor. Full card numbers never touch our servers. What we store is the token, the card brand, and the last four digits, so a shopper can use a saved card again.
Usage and delivery logs
We keep technical and audit logs needed to run and secure the service, including records of emails sent to and from the service (provisioning updates, trial reminders, payment notices, receipts you choose to email), sign-in events handled by our sign-in provider, and changes made in the admin.
3. How we use information
- Provide, maintain, and secure the service, including provisioning your store after signup.
- Process your subscription, charges, retries, and cancellations through Stripe.
- Send transactional email about your account: provisioning progress, trial reminders, payment problems, and cancellation confirmations.
- Send marketing email, but only if you opted in, with an unsubscribe link in every message.
- Reply when you contact us for support.
- Detect, prevent, and respond to fraud, abuse, and security issues.
- Meet legal, tax, and record-keeping obligations.
4. How we share information
We share information only with the providers that help us run the service, for the purposes listed, plus the limited cases below. Providers are bound to use the data only to deliver their part of the service.
- Clerk: user accounts and sign-in. Receives names, email addresses, and passwords (which we never see).
- Stripe: subscription billing and payments. Receives your business name, email, and payment details.
- Resend: transactional email delivery. Receives recipient addresses and the email content needed to send it.
- Railway: hosting and databases. Runs the servers and the isolated database that holds each merchant's data.
- Google: site analytics (GA4) on cbdpos.com, and address lookup for delivery distance checks.
- Kit (ConvertKit): marketing email. Receives the email address you gave when opting in, and your business name if you signed up for the service.
- Shipday: local delivery dispatch. Receives customer name, address, phone, and order details for delivery orders.
- EasyPost: shipping rate quotes. Receives origin and destination addresses for packages.
- Ziptax: sales tax rates. Receives ZIP codes.
Your payment processor
Authorize.net (or whichever processor a merchant connects) has a direct relationship with that merchant. Card data goes from the shopper's browser to the processor, never through us, and the processor's own terms and privacy policy govern that relationship.
Legal process and safety
We may disclose information to respond to subpoenas, court orders, or other valid legal process, to enforce our Terms of Service, to protect the rights, property, and safety of our users or others, and to investigate fraud or security issues.
Business transfers
If we are part of a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We would notify account holders by email before the transfer where the law requires it.
5. We do not sell your personal information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. The sharing described above is limited to running the service, and nothing in this policy should be read as a sale of data.
6. Your choices
- Marketing email: use the unsubscribe link at the bottom of any marketing email. Transactional email about your account is not marketing and keeps flowing while you have an account.
- Cookies: block or delete cookies in your browser settings. Analytics will simply record less.
- Account data: you can correct your business details in your admin. To delete your account and its data, see section 7 or write to [email protected].
- We do not currently respond to web browser do-not-track signals.
7. How long we keep information
- Active accounts: we keep your data while your account is active, because the service cannot work without it.
- After cancellation or suspension: we keep merchant store data for 30 days so you can return or export it, then permanently delete it. This matches what our cancellation and payment-failure emails already promise.
- Billing records: invoices and payment records are kept as long as accounting and tax law require.
- Analytics: kept according to the retention settings in our GA4 property.
- Email logs: delivery records are kept for a limited period for troubleshooting and abuse prevention.
8. How we protect information
- Each merchant's data lives in its own isolated database, separate from other merchants.
- Data moves over encrypted connections in transit.
- Full card numbers never reach our systems. Card handling is tokenized at the processor, which keeps our card-handling exposure at the lowest PCI level (SAQ A).
- Access to production systems is limited to staff who need it for their work.
- No method of storage or transmission is perfectly secure. We cannot promise absolute security, but if we learn of a breach affecting your information we will notify affected account holders without undue delay.
9. Your privacy rights (United States)
Depending on your state, including California, Colorado, Connecticut, Virginia, and Minnesota, you may have rights to know what personal information we hold, to access it, to correct it, to delete it, to get a copy of it, and in some cases to opt out of certain processing. These rights generally apply to information about you as our user, not to your business records stored in the service on your own behalf.
To make a request, email [email protected] from the address on your account and tell us what you need. We will respond within 45 days. We may ask for information to verify your identity, and we will never discriminate against you for exercising a right. If we decline a request, you may appeal by replying to our response, and we will tell you how to contact your state attorney general if you are still unsatisfied.
10. Your customers' information
If you are a merchant, you decide how your store's customer information is used, and you are responsible for your store's own privacy practices. We process that information only to provide the service to you, as described in our Data Processing Addendum.
Your storefront must publish its own privacy policy that tells your customers how their information is handled. The admin includes editable policy templates (privacy, terms, refund, shipping) pre-filled for your store, and you can edit them freely. When your customers make requests of you, we will assist you through the tools in the service, such as customer lookup and deletion.
11. Children
The service is for adults and businesses. It is not directed to children, and storefronts on CBDPOS sell products restricted to adults 21 and older. We do not knowingly collect personal information from children. If you believe a child has provided information through the service, contact [email protected] and we will delete it.
12. Email practices
- Transactional email (account setup, trial reminders, payment notices, receipts you send) is sent because you have an account or a customer completed an order.
- Marketing email is sent only to addresses that opted in, includes an unsubscribe link in every message, and honors opt-outs promptly.
13. Changes to this policy
We may update this policy as the service changes. The date at the top always shows the current version. For material changes we will notify account holders by email or in the service before the change takes effect.
14. Contact us
Hammer Forge Apps LLC DBA CBDPOS. For privacy questions or requests: [email protected]. For general support: [email protected].