This Privacy Policy describes how HempDash Inc. ("HempDash", "we", "us") collects, uses, and shares information when you visit gethempdash.com and its subdomains (the "Site") or interact with our marketing content, or use services that link to this policy.
Information we collect
Information you provide: your email address when you join a waitlist or sign up through the Site, and — on our Charter Vendor application — your name and the tier you select. Any other details you choose to send us when you contact us or book a call.
Usage information: we run our own first-party measurement, and that record — held on our own infrastructure — is the system of record. We also mirror a limited subset of it to Google Analytics from our servers, described under "Analytics" below. Each recorded event contains the name of the event, the time, the page path, the lesson identifier where applicable, the random per-tab session id described in our Cookie Policy, the referring link and any campaign tags from the address you landed on, and a small number of bounded technical values (for example how long a quiz item took, in rough bands, or the length of a library search — never the text you searched for).
This measurement is deliberately narrow. Our servers accept only a fixed list of known event names, cap the length of every value, and discard anything that looks like an email address before an event is stored. We do not collect your precise or city-level location, and no cookies or third-party tracking technologies run in your browser. As with any website, our hosting and content-delivery providers process IP addresses as an inherent part of serving requests to your browser.
How we use information
To respond to your requests (demos, support, questions).
To send product updates you signed up for. Every marketing email includes an unsubscribe link.
To understand how the Site is used and improve it.
To comply with legal obligations.
We do not sell your personal information.
Free COA checker
The Site offers a free certificate-of-analysis (COA) check at /check-coa, available without an account. When you use it:
Your uploaded document is processed in memory and is not stored — it is not written to a database, to file storage, or to temporary files.
Text extracted from the document is sent to our AI providers — OpenRouter (primary) and Anthropic (fallback) — solely to locate the fields the check reads. It is not used for any other purpose.
We do not log the content of your document. The checker's logs carry only technical values such as the size of the request and whether the check succeeded, and its usage metrics are numeric counts.
Service providers
We share information only with service providers who process it on our behalf, and each is bound to use it only to provide their service to us:
Netlify — website hosting and content delivery, and the storage where our first-party usage events are kept.
Sanity — the content management system behind our Academy and article pages. Some lesson media is delivered from Sanity's network directly to your browser.
Railway — the infrastructure provider that hosts our own scheduling system (used when you book a demo) and our internal team messaging system. When you sign up or submit an application on the Site, the details you entered are delivered to our internal team messaging system so we can follow up.
OpenRouter — the primary AI provider for the free COA checker. Text extracted from an uploaded document is sent to OpenRouter solely to locate the fields the check reads.
Anthropic — the fallback AI provider for the free COA checker, used for the same field-location purpose when the primary provider is unavailable.
Google — Google Analytics, which receives a mirror of part of our first-party usage measurement. Our servers send it; your browser never contacts Google. See "Analytics" below.
Analytics
We mirror a limited subset of our first-party usage events to Google Analytics. This is worth stating precisely, because how it is done matters more than the fact that it happens:
Nothing runs in your browser. There is no Google tag, no analytics script, and no request from your device to Google. Our servers send the mirror after the page has already been served to you.
No cookies and no persistent identifier. The mirror is keyed to the same random per-tab session id described in our Cookie Policy, which your browser discards when you close the tab. We never send a user id, and we never invent an identifier that outlives the tab.
A closed list of fields. Only a fixed allow-list of already-sanitized event fields is mirrored. Page paths have any query string stripped first, anything email-shaped has already been discarded, and any event or field not on the list is not sent at all.
The mirror is not the record. Our own first-party store is the system of record. If the mirror fails, nothing about your visit or our record of it changes.
We use no advertising or ad-measurement service on the Site, and we do not use analytics to track you across other websites.
Cookies
The Site sets no cookies. It uses a small amount of browser session storage, which is cleared when you close the tab. See our Cookie Policy for the details.
Data retention
We keep first-party usage events for 12 months, after which they are deleted automatically by a scheduled job that runs every day. Those events contain no name, email address, or location, and the random per-tab session id in them is not linked to you.
Contact details you send us — your email address, and your name on the Charter Vendor application — are kept while we are in touch with you and for as long as needed for the purposes described above, then deleted. You may request deletion sooner at any time (see below).
Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of the personal information we hold about you, and to opt out of marketing at any time. To exercise any of these rights, email us at the address below — we respond to all verified requests.
Age requirement
The Site and our services relate to federally compliant hemp products and are intended for adults 21 and over. We do not knowingly collect personal information from anyone under 21.
Changes to this policy
We may update this policy from time to time. Changes are posted on this page with an updated date above.