Privacy Policy
This policy describes the current GreenSource AI demo implementation reviewed on the effective date. Update it before adding advertising trackers, third-party analytics, user accounts, payments, or materially different data practices.
1. Scope
This Privacy Policy explains how GreenSource AI LLC (“GreenSource,” “we,” “us,” or “our”) collects, uses, discloses, and retains information when you use our public demo storefront, recommendation assistant, demo-review form, owner portal, admin tools, and related websites (the “Service”).
The public cannabis-related demo is intended for adults age 21 and older in the United States.
2. Information you provide
Recommendation requests
When you use the assistant, you may provide a free-text shopping request, an optional budget, and follow-up messages. The browser may send up to eight recent conversation turns with each request so the assistant can understand refinements. GreenSource’s application does not write the raw recommendation messages or conversation history to its analytics files.
Your messages are transmitted to OpenAI through its API so the request can be converted into structured preferences. Under OpenAI’s default API data practices, API inputs and outputs are not used to train its models unless the account holder affirmatively opts in. OpenAI may process and retain data as permitted by its applicable terms, settings, and security requirements.
Please do not include medical diagnoses, health-record information, government identifiers, payment-card information, account passwords, or other sensitive personal information in the recommendation box.
Demo reviews
If you submit a demo review, we collect the required star rating and any optional information you choose to provide, which may include written feedback, whether you would recommend the demo, your role, name, company, email address, contact permission, testimonial permission, beta-testing interest, and retailer-introduction interest. The review page also records a simplified browser name and the approximate amount of time the review page was open.
Communications
If you contact us directly, we collect the information contained in your message and any contact information you provide.
3. Information collected automatically
When you connect to the Service, our server and hosting provider necessarily process technical information such as your IP address, request time, requested page, browser or device information, and network details.
Our application uses IP addresses in memory for rate limiting. It also creates a shortened, salted hash of an IP address for security logs and for review-abuse prevention. A hash is a pseudonymous identifier, not a promise of complete anonymity. Our hosting provider may retain raw IP addresses in standard access or security logs under its own settings.
4. First-party cookies and browser storage
As currently configured, the Service does not use third-party advertising cookies or third-party behavioral analytics. It uses limited first-party storage:
- Demo-access cookie: if the demo is password protected, an HTTP-only cookie keeps the demo unlocked for up to approximately 12 hours.
- Age-attestation storage: a short-lived age token is kept in session storage so the age gate does not need to repeat during the session.
- Returning-visitor flag: a small local-storage value remembers that the browser previously received a successful recommendation and changes only introductory wording.
- Admin and retailer-owner portals: access tokens entered by authorized operators are kept in session storage and sent only in authorization headers.
You can clear cookies and site storage through your browser settings. Blocking essential storage may cause the age gate or password gate to reappear or may prevent protected features from working.
5. Voice input
If your browser supports speech recognition and you choose the microphone button, speech-to-text is supplied by your browser or operating-system provider. Audio is not sent to GreenSource’s server, but the browser provider may process audio or transcripts under its own privacy terms. The resulting transcript is placed in the recommendation field and is treated like text you type.
6. Aggregate usage and retailer analytics
We store first-party aggregate counters used to operate the Service and create retailer reports. These counters may include requested experience tags, requested product types, total and count of stated budgets, recommendation outcomes, no-match counts, product names shown, product-link clicks, anonymous thumbs-up or “not quite right” counts, AI token usage, estimated AI cost, and recent event timestamps.
The application is designed not to place raw customer messages, conversation histories, names, emails, or IP addresses in these aggregate retailer analytics. Aggregate monthly analytics are retained for up to 12 months in the current implementation.
7. How we use information
We use information to:
- provide and personalize the recommendation flow;
- interpret requests and rank products from the displayed inventory;
- operate age, access, rate-limit, budget, and security controls;
- measure reliability, demand patterns, product-link activity, and aggregate feedback;
- review software feedback, contact willing testers, and develop the product;
- display testimonials only when permission has been granted;
- detect abuse, investigate errors, enforce our Terms, and comply with law; and
- communicate with you when you request or authorize contact.
8. How we disclose information
We may disclose information to:
- OpenAI: recommendation text and recent conversation context are processed through the OpenAI API for preference extraction;
- hosting and infrastructure providers: technical data is processed to host, secure, log, and deliver the Service;
- retailers: retailer dashboards receive aggregate demand, click, and feedback statistics for their own inventory, not raw recommendation messages;
- professional advisers and transaction parties: when reasonably necessary for legal, accounting, financing, diligence, merger, acquisition, or asset-sale purposes, subject to appropriate confidentiality protections; and
- authorities or others: when required by law or reasonably necessary to protect rights, safety, security, and the integrity of the Service.
When you click a product or menu link, you may leave the Service for a retailer or point-of-sale website. That third party may collect information under its own privacy policy. GreenSource currently records the product name associated with the outbound click as an aggregate count.
9. Sale, targeted advertising, and model training
GreenSource does not sell personal information, does not use personal information for cross-context behavioral advertising, and does not currently operate third-party advertising trackers in the reviewed demo.
GreenSource does not use raw recommendation messages to train a GreenSource foundation model. We may use non-identifying aggregate statistics and feedback to evaluate and improve our software. Public use of a written review requires the separate testimonial-permission selection.
10. Retention
- Raw recommendation messages and browser-held conversation history are not intentionally written to GreenSource analytics storage. They are processed during the request and transmitted to OpenAI.
- Aggregate retailer analytics are retained for up to 12 months in the current code.
- Daily AI usage counters keep the current day’s counts.
- Age and demo-access tokens generally expire after approximately 12 hours.
- Demo reviews are currently retained until manually deleted or until older entries are displaced after the review store reaches 1,000 submissions.
- Security and hosting logs are retained as reasonably necessary under configured provider settings, legal obligations, and security needs.
We may retain information longer when required by law, needed to resolve disputes, prevent abuse, protect the Service, or preserve a record of a deletion request.
11. Security
We use safeguards intended to reduce risk, including HTTPS in production, limited request sizes, rate and spending controls, salted IP hashing in application logs, access tokens, restricted admin interfaces, security headers, and separation of raw messages from aggregate analytics. No system is completely secure, and we cannot guarantee absolute security.
12. Your choices and rights
You may choose not to provide optional review or contact information. You may clear browser storage, stop using voice input, decline testimonial permission, or withdraw future testimonial use by contacting us.
Depending on where you live, you may have rights to request access, correction, deletion, or a copy of personal information, to withdraw consent, or to appeal a privacy decision. We will consider reasonable verified requests even when a particular state law does not require us to do so. Send requests to support@greensourceai.com. We may need information to verify and locate your submission.
13. Children and underage users
The cannabis-related Service is not directed to anyone under 21. We do not knowingly seek personal information from people under 21 through the demo. If you believe an underage person submitted personal information, contact us so we can evaluate and delete it.
14. International users
The Service is operated from the United States. Information may be processed and stored in the United States, where privacy laws may differ from those in your country. The current public demo is not designed as a European Economic Area, United Kingdom, or other international regulated-market deployment.
15. Changes
We may update this policy as the product, vendors, or law changes. We will post the revised policy and update the effective date. Update this policy before adding third-party analytics, advertising, accounts, payments, precise location, identity verification, or persistent conversation storage.
16. Contact
Privacy questions and requests may be sent to support@greensourceai.com.