Privacy Policy

Depending on how you use Evergreen Scan, we may collect:

• account identity, email, authentication state, organization membership, role, plan, and support communications;
• customer-supplied Brand, Product, Batch, COA, laboratory, terpene, media, link, and Portal configuration data;
• Scan time, Scan Token, browser user-agent, inferred browser, and broad device type;
• Portal session and interaction events, including loads, scrolling, module views, video milestones, game activity, COA opens, and destination clicks;
• a randomly generated Portal visitor identifier stored in browser local storage, when storage is available, to measure returning and engaged visits; and
• technical, security, error, billing, and service-administration information supplied by our infrastructure providers.

Evergreen does not currently use Google Analytics, PostHog, advertising cookies, cross-site behavioral advertising, or session-replay recordings in this SaaS application.

• provide authentication, workspaces, public Portals, QR destinations, exports, Signal features, and Growth Analytics;
• measure Portal reliability, engagement, and purchase-intent activity;
• secure accounts, investigate abuse, troubleshoot errors, and support customers;
• administer plans, billing, contracts, and service communications; and
• create aggregated or de-identified operational insights and improve the service.

A business customer controls the content it publishes and determines which Products and supporting documents appear publicly. Evergreen processes dashboard account and customer content to provide the contracted service. Evergreen independently operates first-party Scan and Portal measurement needed to provide and secure the platform.

Customers receive analytics associated with their own Batches. The dashboard is designed to show operational and aggregated results, but authorized customers may also export currently retained raw Scan and Portal events for their own Batches.

Evergreen uses essential authentication cookies to maintain secure dashboard sessions. Public Portals use an in-memory session identifier and may store a random first-party visitor identifier in local storage for anonymous visit and loyalty measurement. Blocking storage may reduce measurement accuracy but does not prevent viewing a public Portal.

We do not currently use advertising cookies. If our tracking practices materially change, we will update this Policy and any consent controls required by applicable law before using the new technology.

Evergreen does not sell personal information or share it for cross-context behavioral advertising. We may share information with hosting, database, authentication, storage, payment, email, security, and professional-service providers that help operate the service; with a customer as needed to administer its workspace; in a business transfer; or when required to comply with law, protect safety, prevent fraud, or enforce our agreements.

Published Product Portals and enabled COA or media sources are intended for public access. Customers should not upload confidential or private material to a public Portal. External Product, laboratory, media, and purchase links are governed by the destination operator's privacy practices, not this Policy.

Evergreen's standard retention period for individual raw Scan and Portal events is 18 calendar months from each event's creation time. Correcting lifecycle dates, completing or reopening a Batch, or changing plans does not restart the period. After 18 months, raw events may be deleted and should not be treated as permanently available.

Automated deletion is not yet active, so some raw events may temporarily remain longer during the implementation transition. That temporary storage does not change the standard retention period. Evergreen will provide at least 30 days' notice before the first automated deletion and a reasonable opportunity for affected customers to export eligible raw history.

Verified daily summaries, compact measurement facts, lifecycle history, finalized Analytics snapshots, published Scan Tokens, and customer configuration may be retained after the related raw events are removed so that long-term Product and Batch history remains available.

Brand and Product deletion may be a soft deletion so historical Batch relationships remain accurate. A Draft Batch may be permanently deleted only through its guarded event-free deletion process. Voided published Batches retain their identity and show a withdrawal notice.

Account cancellation does not currently trigger automatic deletion. Cancellation handling remains separate from the 18-month raw-event period. Any future cancellation schedule will be disclosed before enforcement and will address exports, recovery, holds, and legally required exceptions. Legal, security, incident, contractual, support, and export obligations may require longer retention of affected data.

Evergreen uses reasonable technical and organizational safeguards, including access controls and encrypted transmission. No system is completely secure. Information may be processed where Evergreen and its service providers operate, subject to applicable safeguards.

Depending on your location and applicable law, you may request access, correction, deletion, restriction, portability, or information about how we handle your personal information. We may need to verify your identity and authority before acting. Some Portal activity collected without an account or email may not be reasonably linkable to a particular person.

We may retain information when necessary for security, legal claims, compliance, contractual obligations, or another permitted exception. Exercising a privacy right will not result in unlawful discrimination.

Evergreen's business dashboard is not offered to children. Public Product Portals are informational and are not intended to collect names, emails, or account profiles from children. If you believe a child provided personal information, contact us so we can review and address it.

We may update this Policy when the service or our legal obligations change. We will revise the date above and provide reasonable notice of material changes through the site, dashboard, or registered customer contact.