1. Introduction

REEUP ("we," "us," or "our") operates a cannabis supply chain management platform at www.reeup.co. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our web application, B2B wholesale marketplace, METRC compliance tools, and AI-powered services.

2. Information We Collect

Account Information

When you register, we collect your name, email address, phone number, and password. For cannabis business verification, we collect your cannabis license information, entity type (retailer, cultivator, processor, distributor, microbusiness), and METRC API credentials.

Business Data

Through platform use, we process inventory data, sales transactions, purchase orders, compliance records, and analytics derived from your cannabis operations. This includes data synchronized from integrated systems such as Dutchie POS, METRC, and OCM.

Technical Data

We automatically collect IP addresses, browser type, device information, and usage patterns through cookies, server logs, and analytics services (Vercel Analytics, OpenTelemetry).

3. How We Use Your Information

Provide and maintain our cannabis supply chain management services
Facilitate METRC compliance reporting and seed-to-sale tracking
Power AI-driven inventory intelligence and demand forecasting
Enable B2B wholesale marketplace transactions
Synchronize data with integrated systems (Dutchie POS, METRC, OCM, Fleetbase)
Process subscription payments through Stripe
Send transactional notifications and platform updates
Improve platform performance and user experience
Comply with cannabis regulatory requirements

4. Data Security

We implement industry-standard security measures to protect your data:

METRC API credentials encrypted with Fernet + PBKDF2 (100,000 iterations)
JWT-based authentication with 24-hour token lifetime
bcrypt password hashing
CSRF protection and rate limiting on all endpoints
Multi-tenant data isolation enforced at the database query level
HTTPS with HSTS, Content Security Policy, and X-Frame-Options headers
Audit logging on all API requests

5. AI and MCP Tool Access

When you connect AI assistants (Claude, ChatGPT, Gemini) to REEUP via the Model Context Protocol (MCP), those AI clients access your data within your authorized entity scope. We do not make outbound AI calls or share your data with AI model providers. AI read operations execute directly; write operations are queued for your review through our confidence scoring system.

6. Third-Party Services

We integrate with the following third-party services that may process your data according to their own privacy policies: METRC (compliance tracking), Dutchie (POS integration), OCM (license verification), Fleetbase (delivery logistics), Stripe (payment processing), Resend (email delivery), Vercel (hosting), Railway (backend infrastructure), and Sentry (error monitoring).

7. Data Retention

We retain your account and business data for as long as your account is active or as needed to provide services. Compliance data (METRC records, audit trails) is retained as required by cannabis regulatory authorities. You may request data deletion by contacting us, subject to regulatory retention requirements.

8. Your Rights

You have the right to access, correct, or delete your personal information. You may also request a copy of your data or object to specific processing activities. To exercise these rights, contact us at privacy@reeup.co.

9. Contact Us

For privacy-related questions or requests, contact us at privacy@reeup.co or visit www.reeup.co.