Privacy Policy — The Local Leaf Cannabis

Effective date: July 31, 2026
Last updated: September 29, 2026

1. Who we are

The Local Leaf Cannabis ("Local Leaf", "we", "us", "our") is a cannabis retail service operated by Kansas Enterprises (Franchises) LTD (doing business as The Local Leaf Cannabis), a cannabis retailer licensed by the BC Liquor and Cannabis Regulation Branch (LCRB), operating in British Columbia, Canada.

• Registered business address: 6–2662 Austin Avenue, Coquitlam BC V3K 6C4, Canada

• Privacy contact: support@tllcannabis.com

We hold the following BC cannabis retail licences, one per store:

• Local Leaf Cannabis Terrace — 450250 — 4621 Lakelse Avenue, Terrace BC V8G 1P9

• Local Leaf Cannabis Squamish — 450347 — 11–40437 Tantalus Road, Squamish BC V8B 0N2

• Local Leaf Cannabis Fraser — 450358 — 4317 Fraser Street, Vancouver BC V5V 4G4

• Local Leaf Cannabis Maple Ridge — 450522 — 110–20110 Lougheed Highway, Maple Ridge BC V2X 2P7

• Local Leaf Cannabis Coquitlam — 450527 — 109–2957 Glen Drive, Coquitlam BC V3B 0B5

• Local Leaf Cannabis Victoria — 450581 — 568 Yates Street, Victoria BC V8W 1K8

We are the organization responsible for the personal information handled through the Service.

2. Scope

This policy applies to the Local Leaf mobile app, our back-of-house admin systems, and any Local Leaf websites we operate (together, "the Service"). It does not cover websites or services we merely link to.

3. What we collect

Information you give us when you create an account

Before you can browse the menu or place an order, we require your name, phone number, email and a BC postal code, and you must confirm your age. Marketing consent is optional.

• Email address (required) — to create your account, sign you in, and contact you about your orders. If you sign in with Apple and choose to hide your email, this is a private relay address that Apple creates for Local Leaf and forwards to you; we never see your real address.

• Name (first and last, required) — our staff and drivers use it to identify your order and to match it against your government ID at pickup or delivery, as the LCRB requires.

• Phone number (required) — so the store or driver can reach you about a specific order (for example, if a driver can't locate your unit). We do not use your phone number for marketing.

• Postal code (required) — a BC postal code, which you type in or, if you tap "Use my location", the app fills in from your location (see "Location" below). We use it to confirm you are in British Columbia, where we are licensed to operate. We keep it with your account, and our staff can see it.

• Age confirmation (required) — you confirm you are 19 or older at sign-up. We store only a confirmation timestamp ("age verified on [date]"). We do not store your date of birth.

• Marketing consent (optional) — your explicit yes/no to receiving marketing messages and, if you opt in, the date you did.

• Brands and strains you follow (optional) — if you use "Notify me about new", we store the brands or strains you chose and the store they apply to, so we can send the new-arrival notifications you asked for. We also keep a record of which new products we have already sent, or tried to send, you an alert about, so you don't get the same alert twice; it is kept until you delete your account. Turning these on has its own separate consent step in the app, and you can stop or remove any of them under Profile → Following.

Information Apple or Google sends us if you sign in with them

Signing in with Apple or Google is optional — you can always create an account with an email address and a password instead. If you choose one of them, that provider confirms who you are and sends us:

• Sign in with Apple — a stable Apple user identifier that is unique to Local Leaf; an email address (your real one or, if you choose Hide My Email, a private relay address that forwards to you); and, the first time you sign in only, your name, if you choose to share it. When you sign in, Apple also gives us a security token for your Local Leaf sign-in; we keep it only so that we can ask Apple to remove Local Leaf from your Apple ID when you delete your account, and we delete it with your account, or sooner if Apple sign-in is removed from your account.

• Google — the name on your Google account, your email address, a link (URL) to your Google profile picture, and a stable Google account identifier.

We store these with your account's sign-in record. We use the name to pre-fill the name step of sign-up (you can change it), the email address as your account email, and the identifier to recognise you the next time you sign in. We do not use or display your Google profile picture. We never receive your Apple or Google password, and we get nothing else from your Apple or Google account — no contacts, photos, calendar, or activity. You still give us your phone number and a BC postal code, and confirm your age, exactly as described above.

Information you give us when you order

• Delivery address (delivery orders only) — street address, city, and postal code, plus any delivery instructions you enter. To determine whether your address is inside a store's delivery area, we convert it to map coordinates (see Section 6, "BC Address Geocoder") for that check only; we do not keep the coordinates.

• Order details — the products and quantities you order, whether you chose pickup or delivery, the store, and the totals and taxes calculated for the order.

• Payment information — for delivery orders, which are paid in the app, payment is processed by Moneris on a secure Moneris-hosted checkout page. We never receive or store your full card number. Moneris returns a receipt that we retain for order and refund records. Along with the transaction reference and amount, it repeats the details given at checkout: the name on the card, the card type, the card's expiry date and its first six and last four digits (never the full card number), and the name, email, phone number, billing address and delivery address for the order. If you delete your account, we remove those personal details from the receipt and keep only the transaction record, the card type and the last four digits. For delivery orders, our staff and driver may use the card brand and last four digits to confirm that the person receiving the order is the person who paid for it, alongside the government ID check the LCRB requires. Pickup orders are paid in person at the store counter and are not charged in the app.

Information you give us when you request a product

• Product requests (optional) — if you use "Request a product" to ask one of our stores to carry something, we store the request with your account: the store you chose; the product name and brand you entered; the category and size you chose; anything you write in the optional "Anything else?" note (up to 500 characters); whether "Notify me when it arrives" is on (it is on unless you switch it off); and the request's status (for example, "Under review" or "Now in stock"). You can see your requests and their status in the app.

Your request goes only to the store you chose. That store's staff see it in our admin system, together with your name, so they can look into bringing the product in; our administrators who oversee all stores can also see it. Staff at our other stores cannot. Staff may match your request to a specific product in our catalogue. If "Notify me when it arrives" is on and you allow notifications, we send you one push notification when that product is in stock at that store (or when staff mark your request "Now in stock"), naming the product as you entered it and the store — never more than one per request. To cancel a request, remove its note, or stop its notification, email support@tllcannabis.com and our support team will take care of it. Please don't put personal details in your request — store staff read it. Our in-app usage records (below) note that you sent a request, with the store, the category, and whether "Notify me when it arrives" was on — not the product name or your note.

Information we collect automatically

• Device push token — if you allow notifications, so we can send you order-status updates (for example, "your order is being prepared" or "your driver is on the way") and the alerts you have asked for: new arrivals from brands or strains you follow, and a product you requested being in stock.

• Device and app information — device type, operating system, and app version, used to operate and support the app.

• In-app usage (first-party analytics) — to understand what customers are looking for and to improve the app, we record your activity within the app while you are signed in: when you open the app, screens and product pages you view, tabs you tap, searches you run, filters and sorting you apply, brands or strains you follow or unfollow, changes to your new-arrival notification setting, product requests you send, items you add to or remove from your cart, the checkout steps you reach, whether an order is for pickup or delivery, and order totals. Each record also notes your device platform (for example, iOS) and the app version. This is first-party: it is stored in our own database in Canada and is never shared with any third-party analytics or advertising service. We use it only to operate and improve the Service — not for advertising, and not to build profiles about you for anyone else. These usage records contain product identifiers, the quantities and prices of items you add to your cart, the store, search terms (recorded as you typed them), the names of brands or strains you follow or unfollow, order totals, and the activity events, linked to your account; we do not attach your name, delivery address, or payment card details to them. If you ask us to delete your account, these records are unlinked from it (see Section 9).

• Location — the app may request permission to use your device location to help confirm you are within British Columbia, where we are licensed to operate. If you tap "Use my location" at sign-up, your iPhone asks Apple's location service to turn your location into a postal code (see Section 6); we keep that postal code with your account, not your location. We do not track your location in the background and we do not store your precise device location. Delivery-area checks are performed on the delivery address you enter, not on your live device location.

What we do NOT collect

• We do not use third-party analytics or advertising trackers. Our usage analytics are first-party only (described above), stored in Canada, and are never shared with advertising networks or data brokers. There is no third-party behavioural-tracking or advertising software in the app.

• We do not collect or store an image or scan of your government ID. Age is confirmed by self-attestation at sign-up. Your ID is checked in person by our staff at pickup or by our driver at delivery, as the LCRB requires — they record only that ID was checked. Your ID is never photographed or stored.

• We do not collect your social-media data, your browsing history outside our app, your contacts, or your date of birth. If you sign in with Apple or Google, we receive only the sign-in details listed above — nothing else from that account.

4. How you sign in

You can sign in with Apple, with Google, or with your email address and a password you choose. Apple and Google are optional: the app works the same whichever you use.

• Email and password. We store only a salted hash of your password — never the password itself — so nobody at Local Leaf can see or recover it.

• Apple or Google. Apple or Google checks who you are on your device and tells us (Section 3 lists exactly what they send). We never see or store your Apple or Google password. Because they handle the sign-in, Apple or Google learns that you have a Local Leaf account and when you sign in to it, and handles that information under its own privacy policy. The sign-in itself tells them nothing about what you browse or order. If you would rather neither of them knows you use Local Leaf, sign in with email and password.

We never add Apple or Google sign-in to an existing account — that stops someone getting into your account by signing in with an Apple or Google account that uses your email address. If you try a different sign-in with the same email, the app tells you an account already exists; sign in the way you created it. At a store, staff can set a temporary password for your account (see below) and, if you ask, disconnect Apple or Google sign-in from it.

If you forget your password, bring photo ID to any Local Leaf store and staff can reset it at the counter. Can't come in? Email support@tllcannabis.com from your account email and we will verify it is you before resetting it. We never reset a password on the strength of an email alone, and we never send passwords by email or text.

If you sign in with Apple or Google and lose access to that Apple ID or Google account, bring photo ID to any Local Leaf store. Staff can find your account from your phone number and name — even if its email address is an Apple relay address you don't know — and set a temporary password so you can sign in with your account's email address and that password instead. The same identity checks apply as for a password reset.

5. Why we collect it

We collect and use personal information for these purposes, consistent with BC PIPA:

• To provide the Service — create your account, take and fulfil orders, arrange pickup or delivery, and provide customer support.

• To process payments for delivery orders and handle refunds.

• To comply with cannabis law and our LCRB licence — confirming you are of legal age, enforcing the 30 g public-possession limit, confirming delivery is within a permitted area, and keeping the records regulators require.

• To send you order-status notifications (you can turn off non-essential notifications in your device settings).

• To send you new-arrival notifications for brands or strains you follow — only with your separate, explicit opt-in, at most one bundled notification a day, and you can withdraw at any time under Profile → Following.

• To pass a product request to the store you chose and, unless you switched off "Notify me when it arrives", to send you one notification when that product is in stock there.

• To understand how the app is used and improve it, using the first-party usage analytics described in Section 3.

• To send you marketing messages only if you have opted in, and to stop when you opt out.

• To detect and prevent fraud, abuse, and unauthorized access.

We do not sell your personal information, and we do not use it for advertising or profiling.

6. Who we share it with (service providers)

We share personal information only with service providers who help us run the Service, only as needed, and under agreements requiring them to protect it. We do not sell or rent personal information to anyone.

• Supabase — Hosts our database, account sign-in, and stored files — Canada (Montreal / ca-central-1)

• Moneris — Processes in-app card payments for delivery orders — Canada

• TechPOS — Our stores' point-of-sale system; receives your order so staff can fulfil it — Canada

• Fly.io — Hosts our application servers — Canada (Toronto)

• Expo / Apple / Google push services — Deliver push notifications to your device (order-status updates, new-arrival alerts you opt into, and product-request alerts). Expo also delivers app updates: each time you open the app, it asks Expo for an update, sending a random identifier for this app install, your device platform, the app version and which update it is running (and, if the app crashed while starting, a short technical error report), plus, like any internet request, your IP address — nothing about your account — United States (message transport and app updates only)

• Apple (Sign in with Apple) — Sign-in only — if you choose Sign in with Apple, confirms who you are and sends us the details listed in Section 3; when you delete your account in the app, we ask Apple to revoke Local Leaf's sign-in authorization — United States

• Apple (iPhone location service) — Only if you tap "Use my location" at sign-up: your iPhone sends your location to Apple's location service to find your postal code. We keep only the postal code, never the location — United States

• Google (Google Sign-In) — Sign-in only — if you choose to sign in with Google, confirms who you are and sends us the details listed in Section 3 — United States

• BC Address Geocoder (Province of BC) — Converts a delivery address to map coordinates so we can check it is within a store's delivery area — Canada

Apple and Google are involved in sign-in only if you choose to sign in with them, and Apple's location service only if you tap "Use my location" at sign-up; they handle these under their own privacy policies.

Some of these providers are located in the United States — the push-notification and app-update services, Apple's location service if you use your location at sign-up and, if you choose them for sign-in, Apple and Google — and information handled there may be subject to the laws of that country. We keep what goes to them to the minimum needed for the feature. Push notifications never include your name, contact details, address, or payment details. They carry only:

• Order updates — the order reference, which update it is (for example, "Ready for pickup"), whether it is a pickup or delivery order, the store's name and, for pickup orders, your pickup code.

• New-arrival alerts (only if you opted in) — the names of the new products and the store.

• Product-request alerts — the request reference, the product name you entered and the store's name.

An Apple or Google sign-in involves only the sign-in itself (the details listed in Section 3, and the fact that you use Local Leaf), never your orders, addresses, or payment details. Our core account, order, and payment records are stored in Canada.

We may also disclose personal information where required by law, to comply with a regulator (including the LCRB), or to protect our rights, safety, or property.

7. Where your information is stored

Our database, account, and payment records are hosted in Canada (Montreal and Toronto). As noted above, push notifications and app updates are delivered through providers in the United States, and the optional "Use my location" lookup at sign-up goes to Apple's location service. A push never includes your name, contact details, address, or payment details; it carries only:

• Order updates — the order reference, which update it is (for example, "Ready for pickup"), whether it is a pickup or delivery order, the store's name and, for pickup orders, your pickup code.

• New-arrival alerts (only if you opted in) — the names of the new products and the store.

• Product-request alerts — the request reference, the product name you entered and the store's name.

If you sign in with Apple or Google, the sign-in itself happens with Apple or Google in the United States; the sign-in details they send us (Section 3) are stored with your account in Canada.

8. How long we keep it

• Order records and related audit logs — retained for 6 years, as required by the LCRB and applicable tax law.

• Account information, including any sign-in details Apple or Google sent us — until you ask us to delete it (see Section 9), subject to the record-keeping obligation above.

• In-app usage analytics — retained for 2 years, after which they are automatically deleted. If you delete your account earlier, they are unlinked from it at that point (Section 9).

• Brands and strains you follow — until you remove them or delete your account, whichever comes first. The record of which new products we have already sent, or tried to send, you an alert about is kept until you delete your account.

• Product requests — kept with your account for as long as you have it. If you delete your account, your note and the link to you are removed (Section 9); what remains — the product name, brand, category, size, store, and status — is no longer linked to you and is kept as a record of what customers ask our stores to carry.

• Marketing preferences — until you withdraw consent.

9. Your rights and choices

Under BC PIPA and PIPEDA you can:

• Access the personal information we hold about you, and ask us to correct it if it is wrong.

• Withdraw consent to marketing at any time.

• Ask us to delete your account. When you do, we redact your identifying information (name, email, phone, the postal code on your account, saved addresses), delete the sign-in details Apple or Google sent us, unlink your in-app usage records from your account, delete the brands and strains you follow (and our record of the new-product alerts we sent you), and delete the notes on your product requests and unlink those requests from you (what stays is listed in Section 8; it is no longer linked to you, and no notification is sent for it). Because the LCRB requires us to keep records of cannabis transactions, we retain the underlying order record in a form that no longer identifies you (for a delivery order, the record keeps the delivery city and postal code, but not the street address or delivery instructions). Our record of the deletion keeps a one-way code made from your email address; it does not contain the address, but it lets us confirm the deletion if you ask us about that address later. Purchases are also recorded in the store's point-of-sale system (TechPOS), which keeps its own sales records to meet LCRB and tax requirements. Deleting your app account does not remove those records; they are kept for the period the law requires and then deleted by the store. If your account uses Sign in with Apple and you delete it in the app (Profile → Delete account), we use the token Apple gave us when you signed in to revoke Local Leaf's Sign in with Apple authorization (if we don't have that token, Apple may ask you to confirm once more); if the revoke can't be completed at that moment, your account is still deleted and the app shows you how to remove Local Leaf yourself. If we delete your account for you on request instead, we will tell you how to remove it. You can also remove it at any time in your iPhone's Settings (your name → Sign-In & Security → Sign in with Apple). If you signed in with Google, you can remove Local Leaf's access in your Google Account's security settings, under third-party connections.

• Complain to us, and — if you are not satisfied — to the Office of the Information and Privacy Commissioner for BC (oipc.bc.ca).

To exercise any of these rights, contact us at support@tllcannabis.com. We will respond within the time PIPA allows (generally 30 days).

10. How we protect it

Access to personal information is limited to authorized staff and is restricted by role and by store — a store's staff can see only that store's orders, customers and the product requests sent to that store. The one exception is the in-store sign-in help described in Section 4: with your photo ID, staff at any of our stores can look up your account to reset your sign-in, and each look-up is logged. Card numbers are entered only on Moneris's secure hosted page and never pass through our own systems. We use encryption in transit, access controls and row-level security on our databases, and audit logging of staff actions on customer accounts and orders (such as order status changes, in-store account look-ups, password resets and account deletions).

No system is perfectly secure, but we take steps appropriate to the sensitivity of the information. If we experience a privacy breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner for BC as BC PIPA requires.

11. Age

The Service is for adults 19 and older in British Columbia. It is not directed to anyone under 19, and we do not knowingly collect information from anyone under 19. If we learn we have, we will delete it.

12. Changes to this policy

We may update this policy. When we make a material change, we will update the "Last updated" date and, where appropriate, notify you in the app. Your continued use after an update means you accept the revised policy.

13. Contact us

The Local Leaf Cannabis — operated by Kansas Enterprises (Franchises) LTD
Privacy contact: support@tllcannabis.com
Mailing address: 6–2662 Austin Avenue, Coquitlam BC V3K 6C4, Canada