ObeyMary Privacy Policy

Effective date: October 17, 2026

This Privacy Policy explains what information ObeyMary LLC ("ObeyMary", "we", "us") collects, how we use it, who we share it with, how long we keep it, and the choices you have. It covers our website at obeymary.ai, the ObeyMary app at app.obeymary.ai, our AI assistant Mary, and the emails we send (together, the "Service").

ObeyMary is compliance software for cannabis businesses. Most of the information in the Service belongs to the business that uses it (your "organization"). We handle that information to run the Service for your organization and as described here.

If something in this policy is unclear, write to us at privacy@obeymary.ai or db@obeymary.ai.

1. The short version

• We collect what we need to run the Service: your account details, your organization's compliance information, files you upload, and data from tools you choose to connect, such as Dutchie or an email account.
• We do not sell personal information. We do not use it for advertising.
• We do not use your content to train AI models. We send content to our AI provider only to perform the feature you asked for.
• If you connect a Google account, our use of that data follows the Google API Services User Data Policy, including its Limited Use requirements (see section 7).
• You can delete your account, close your organization, or disconnect an integration at any time. When you do, we delete the related data as described in section 11.

2. Information you give us

Account information. When you sign up we collect your name, email address and a password. We store the password only as a one-way hash (bcrypt), never in readable form. To confirm your email address we send a 6-digit code that expires after 15 minutes. You can also add a job title, phone number, profile photo, badge number and badge photos to your profile.

Sign in with Google. If you choose Sign in with Google, Google tells us your name, email address, whether Google has verified that address, and the web address of your Google profile picture. We use only the basic openid, email and profile permissions for sign-in. Sign-in does not give us access to your Gmail, contacts, files or calendar.

Organization and store information. When you set up a workspace we collect your organization's name and legal name, the primary contact's name and email, business type, license types and numbers, the states you operate in, and facility or store names and addresses. We also record which plan you chose and when you accepted our Terms of Service, along with the IP address you accepted them from.

Team members. Admins can invite colleagues by email address and give them roles. We store the invitation and send the invitee an email. Admins can also invite outside viewers (for example a consultant) to see specific items, and can create share links for some documents, such as standard operating procedures (SOPs).

Content you create or upload. This includes your conversations with Mary, SOPs, audits and audit answers, tasks, reminders, cases, findings, notes, comments, contacts you save (such as names and emails of regulators or vendors), product and packaging records, advertising and marketing materials you submit for review (including images), and documents and other files you upload.

Messages to us. If you use the contact or demo request form on our website, we collect your name, email, company, and the message you write. If you email us or ask for support, we keep that correspondence.

3. Information from tools you connect

You decide whether to connect any of the tools below. Each one can be disconnected.

3.1 Dutchie point of sale

An organization admin can connect a Dutchie store by entering a Dutchie API key, or by sending a setup link to a store contact by email. We encrypt the key before storing it. About once an hour we then copy the following from Dutchie:

• Store identity: location name, state and license number.
• Products and inventory: product names, SKUs, categories, batches, package IDs, quantities, expiration dates, lab test dates and lab test status.
• Sales transactions: the transaction record as Dutchie provides it. That includes the date, the items and amounts, THC amounts, whether the sale was medical or adult-use, void and return flags, and the Dutchie customer ID number. We remove tax and discount details before storing it. We do not ask Dutchie for customers' names, but a transaction record can contain any field Dutchie includes in it.
• Employees (only if the key allows it): employee name, status, and medical marijuana card expiration date. We remove state ID numbers before storing employee records.

We use this data only to run compliance checks for your organization. Examples: possible daily purchase limit breaches, inventory that is expiring or missing lab results, and employee cards that are about to expire. We show the results only to your organization. We do not use Dutchie data for marketing, we do not sell it, and we do not send it to our AI provider. If you disconnect the store, the data we copied from it is deleted.

3.2 Email: forwarding address

Each organization can get a forwarding address (for example alerts+yourcode@obeymary.ai). Mail you forward to it arrives in a mailbox that ObeyMary runs on Google Workspace. We check each message to see whether it is about compliance, for example a notice from a state cannabis regulator.

• Compliance messages: we keep these in your organization's inbox. We also pull out key details such as dates, deadlines and cited rules.
• Everything else: we drop it. For 30 days we keep only a fingerprint (hash) of the message, the sender's domain, and the reason it was dropped, so the same message is not processed twice.

Copies of forwarded messages also remain in our Google Workspace mailbox. We do not currently delete them from that mailbox automatically. You can ask us to delete them at any time (see section 13).

3.3 Email: connected Gmail or Microsoft mailbox

Where this feature is available to your organization, you can connect a Gmail or Google Workspace mailbox, or a Microsoft 365 or Outlook mailbox. This lets Mary find compliance email for you without forwarding.

• What we access: read-only access to your messages (Google permission gmail.readonly; Microsoft permissions Mail.Read, User.Read and offline_access), plus your email address to identify the connection. We do not send, delete, label or change mail in your mailbox.
• What we keep:
  • Compliance messages: kept in your ObeyMary inbox.
  • Messages that might be relevant: only the sender, subject and date, for 14 days, so you can review them. After that they are deleted.
  • All other messages: discarded without storing their content.
• How access is protected: the access tokens Google or Microsoft give us are encrypted at rest (AES-256-GCM).
• Disconnecting: you can disconnect in ObeyMary settings. You can also revoke access in your Google Account (myaccount.google.com/permissions) or Microsoft account. When you disconnect, we stop reading new mail and delete the tokens. If you choose deletion when disconnecting, we also delete the stored mail.

3.4 Partner products

Some partners may offer ObeyMary inside their own software. If you open ObeyMary that way, the partner sends us your name, email address and organization so we can sign you in to the right workspace.

4. Information we collect automatically

Server and security logs. Our hosting provider records technical details of requests to the Service: IP address, browser and device type, the page or address requested, time, and errors. We use these logs to run the Service, fix problems and protect against abuse.

Activity log. Inside a workspace we keep an activity log of important actions, such as who created, changed or exported a record, and when. Some entries include the IP address the action came from. Admins can see this log. It helps organizations show regulators who did what.

Email log. We record each email we send (the type of email, the recipient and the time). We use this to limit how many verification, invitation and notification emails go to one address or organization each day.

Analytics. We use Google Analytics on our website and in the app to understand how people use them. It records:

• the pages you visit, including the full page address
• events such as signup steps
• general details about your browser and device

In the app we also send your plan, your role, the number of states your organization serves, and a coded version of your organization ID. We do not send your name or email address to Google Analytics on purpose. However, a few page addresses can contain an email address or a one-time link token, and Google Analytics may record those as part of the page address. Google Analytics uses cookies (see section 9).

Website chat. If you chat with Mary on our public website, your messages are sent to our AI provider to produce an answer. Your browser stores a small counter of how many free questions you have used that day.

Background music. The app's optional "Compliance Calm" music player streams internet radio directly from SomaFM. When you press play, your browser connects to SomaFM, which can see your IP address.

5. Regulatory information

Mary answers questions using a library of cannabis laws, rules, guidance and regulator notices. We collect this from public sources such as state regulators' websites and published codes, and from regulator newsletters sent to our own mailbox. This material is about rules, not about you. It can include the names of public officials or businesses that appear in public notices. If you subscribe to regulatory alerts, we record which states and topics you follow so we can send you digests and reminders.

6. How we use information

We use the information above to:

• Provide the Service: create and secure your account and run your workspace. That includes answering your questions, producing SOPs and audit materials, running compliance checks, tracking deadlines, and sending reminders and alerts you set up.
• Communicate with you: send verification codes, password reset links, invitations, notifications, regulatory digests, billing notices and replies to your support requests.
• Keep the Service safe: prevent fraud and abuse, enforce rate limits, and investigate security issues.
• Improve the Service: understand which features are used and fix what is broken, mostly through aggregated analytics and error logs.
• Handle billing: manage plans and subscriptions.
• Meet legal obligations: comply with law, respond to lawful requests, and enforce our Terms of Service.

We do not sell personal information. We do not share it with advertisers. We do not use it for targeted advertising, and we do not use it to decide anyone's credit or eligibility for lending.

7. Google user data and Limited Use

This section applies to information we receive through Google APIs:

• Sign in with Google: your name, email address, email verification status and profile picture.
• Gmail API, if you connect a mailbox: your messages, read-only.

How we use it. Only to provide and improve the features you can see and have chosen to use: signing you in, and finding and organizing compliance email in your ObeyMary inbox.

What we do not do.

• We do not use or transfer Google user data for advertising, including retargeting or interest-based ads.
• We do not sell it.
• We do not use it to decide credit-worthiness or for lending.
• We do not use it to develop, improve or train generalized AI or machine learning models.

Who we share it with. We transfer it only:

• as needed to provide or improve those features, for example to our hosting, database and AI processing providers acting on our behalf;
• to comply with applicable law;
• to protect security;
• as part of a merger, acquisition or sale of assets, with notice to you.

Human access. No person at ObeyMary reads Gmail data unless:

• you ask us to, for example for support;
• it is needed for security purposes, such as investigating abuse;
• it is needed to comply with applicable law;
• it has been aggregated and anonymized for internal operations.

When Gmail message content is sent to our AI provider, it is sent only to perform the feature, and we ask the provider not to store the request.

ObeyMary's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Who we share information with

Service providers. We use the following companies to run the Service. They process information on our behalf and only for that purpose.

Payments. When you buy a paid plan, checkout is run by Paddle, which acts as merchant of record and authorized reseller. Paddle collects your payment details directly. We never receive or store your full card number. Paddle tells us your customer and subscription IDs, plan, subscription status, and billing contact details. Paddle uses your information as described in its own privacy policy.

Tools you connect. When you connect Dutchie, Google or Microsoft, information flows between ObeyMary and that service at your direction. Their own privacy policies govern what they do with it.

People in your organization. Information in a workspace is visible to members of your organization according to their roles. It is also visible to outside viewers you invite, and to anyone who has a share link you create. Uploaded files are stored at long, hard-to-guess addresses. Anyone who has a file's address can open it, so share file links with care.

ObeyMary staff. A small number of ObeyMary staff can access accounts and workspaces when needed to provide support, keep the Service running, investigate security issues or comply with law.

Legal reasons. We may disclose information if we believe in good faith that the law requires it, or to respond to valid legal process. We may also disclose it to protect the rights, property or safety of ObeyMary, our users or others.

Business transfers. If ObeyMary is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal. We will tell you before your information becomes subject to a different privacy policy.

Aggregated information. We may share statistics that do not identify any person or organization, such as how many organizations use a feature. These never include data from connected mailboxes.

9. Cookies and similar technologies

In the app:

• access_token cookie: keeps you signed in. It is secure (only sent over HTTPS), cannot be read by page scripts, and lasts up to 30 days.
• Session token in local storage: your browser keeps a copy of the same session token in local storage.
• om_embed cookie: used only when you open ObeyMary inside a partner's product.
• Browser storage: used for preferences, such as a collapsed sidebar, and to remember your plan choices while you finish signing up.

On the website: your browser stores small values in local storage, such as your free chat question count and which version of the home page you saw. A cookie remembers whether the menu is open.

Google Analytics: sets its own cookies (such as _ga) on both the website and the app.

We do not use advertising cookies. You can block or delete cookies in your browser settings. If you block the sign-in cookie, the app will not work. You can stop Google Analytics with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout). We do not currently respond to "Do Not Track" signals.

10. AI processing

Mary and other AI features use OpenAI's API. When you use an AI feature, we send OpenAI your question or instruction, plus the content needed to answer it. Depending on the feature, that can include:

• relevant regulatory text
• details from your workspace
• a document you asked Mary to analyze
• an advertisement image you submitted for review
• an email being checked for compliance content

For email processing and advertisement review, we ask OpenAI not to store the request. Under OpenAI's API terms, OpenAI does not use API data to train its models by default, and it may keep API data for a limited time (up to 30 days) to monitor for abuse.

We do not use your content to train AI models, and we do not let our AI provider train on it. AI answers can be wrong. Always check important answers against the official source.

Our software can also use Anthropic as an alternative AI provider. We do not use it today. If we start using it or another AI provider, we will update the list in section 8.

11. How long we keep information

We keep information for as long as your account or organization is active, unless a shorter period applies below.

Free trials. If a free trial ends without payment, we send reminders. After a grace period we suspend the organization. Suspended workspace data stays until the organization is closed or you ask us to delete it.

Deleting your account. You can delete your own account in settings. This removes your account, your personal uploaded files, and the mailbox connections you made, along with their personal mail. Records and files you created inside an organization stay with that organization, because they belong to it.

Closing an organization. An organization admin can close the organization in settings. This does the following:

• cancels any subscription
• revokes connected mailboxes and deletes stored mail
• deletes the organization's data and uploaded files, including its activity log
• deletes the accounts of people who belonged only to that organization

We keep a short record that the account was deleted or the organization was closed (who did it and when), so we can show the request was carried out.

Data we keep longer. Some information may stay after deletion:

• Backups and snapshots: copies kept by our database and hosting providers until they expire or are removed. We do not use backups for any other purpose.
• Billing and tax records: kept by Paddle and by us as the law requires.
• Email send log: kept for the email limits described in section 4.
• Forwarding mailbox copies: copies of forwarded mail in our Google Workspace mailbox (see section 3.2).
• Legal holds: information we must keep to meet a legal obligation, resolve a dispute or enforce our agreements.

12. How we protect information

We use reasonable safeguards for a business of our size:

• encrypted connections (HTTPS) for the website and app
• one-way hashing for passwords
• AES-256-GCM encryption at rest for mailbox access tokens and point-of-sale API keys
• sign-in cookies that page scripts cannot read
• checks that keep each organization's data separate
• role-based permissions within each organization
• limits on email sending and on public forms
• limited staff access

No method of storage or transmission is completely secure, and we cannot guarantee security. We do not currently hold SOC 2, ISO 27001 or similar certifications. If a security incident affects your personal information, we will notify you as required by law.

13. Your choices and rights

• See and correct: you can view and update your profile and most workspace information in the app.
• Get a copy: ask us, and we will provide a copy of the personal information we hold about you.
• Delete: delete your account or close your organization in settings, or ask us to do it. You can also ask us to delete copies of mail you forwarded.
• Disconnect: disconnect Dutchie, Google or Microsoft at any time in settings. You can also revoke ObeyMary's access in your Google or Microsoft account settings.
• Emails: you can change regulatory alert and notification settings in the app. Account and security emails, such as verification codes, are part of the Service.

Depending on where you live, you may have additional rights under privacy law. These can include the right to know what personal information we hold, to correct or delete it, and to appeal a decision we make about your request.

How to make a request. Write to privacy@obeymary.ai. We will verify your identity before acting on a request, and we will not treat you differently for making one. An authorized agent may make a request for you if we can confirm they have your permission.

Workspace data. If your information is in a workspace run by your employer or another organization, that organization controls the workspace. We may refer your request to them.

14. Where information is stored

ObeyMary is based in the United States. We store information primarily in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

15. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

16. Changes to this policy

We may update this policy as the Service changes. We will post the new version on this page and change the effective date. If a change is significant, we will also tell you by email or in the app before it takes effect.

17. Contact us

ObeyMary LLC Email: privacy@obeymary.ai or db@obeymary.ai