Privacy Policy

Privacy Policy — The Local Leaf Cannabis Mobile

​

Effective date: July 31, 2026 Last updated: August 7, 2026

​

1. Who we are

The Local Leaf Cannabis ("Local Leaf", "we", "us", "our") is a cannabis retail service operated by Kansas Enterprises (Franchises) LTD (doing business as The Local Leaf Cannabis), a cannabis retailer licensed by the BC Liquor and Cannabis Regulation Branch (LCRB), operating in British Columbia, Canada.

• Registered business address: 6–2662 Austin Avenue, Coquitlam BC V3K 6C4, Canada

• Privacy contact: support@tllcannabis.com

We hold the following BC cannabis retail licences, one per store:

• Local Leaf Cannabis Terrace — 450250 — 4621 Lakelse Avenue, Terrace BC V8G 1P9

• Local Leaf Cannabis Squamish — 450347 — 11–40437 Tantalus Road, Squamish BC V8B 0N2

• Local Leaf Cannabis Fraser — 450358 — 4317 Fraser Street, Vancouver BC V5V 4G4

• Local Leaf Cannabis Maple Ridge — 450522 — 110–20110 Lougheed Highway, Maple Ridge BC V2X 2P7

• Local Leaf Cannabis Coquitlam — 450527 — 109–2957 Glen Drive, Coquitlam BC V3B 0B5

• Local Leaf Cannabis Victoria — 450581 — 568 Yates Street, Victoria BC V8W 1K8

We are the organization responsible for the personal information handled through the Service.

2. Scope

This policy applies to the Local Leaf mobile app, our back-of-house admin systems, and any Local Leaf websites we operate (together, "the Service"). It does not cover websites or services we merely link to.

3. What we collect

Information you give us when you create an account

Before you can browse the menu or place an order, we require your name, phone number, and email, and you must confirm your age. Marketing consent is optional.

• Email address (required) — to create your account, sign you in (by one-time code), and contact you about your orders.

• Name (first and last, required) — our staff and drivers use it to identify your order and to match it against your government ID at pickup or delivery, as the LCRB requires.

• Phone number (required) — so the store or driver can reach you about a specific order (for example, if a driver can't locate your unit). We do not use your phone number for marketing.

• Age confirmation (required) — you confirm you are 19 or older at sign-up. We store only a confirmation timestamp ("age verified on [date]"). We do not store your date of birth.

• Marketing consent (optional) — your explicit yes/no to receiving marketing messages, and the date you set it.

• Brands and strains you follow (optional) — if you use "Notify me about new", we store the brands or strains you chose and the store they apply to, so we can send the new-arrival notifications you asked for. Turning these on has its own separate consent step in the app, and you can stop or remove any of them under Profile → Following.

Information you give us when you order

• Delivery address (delivery orders only) — street address, city, and postal code, plus any delivery instructions you enter. To determine whether your address is inside a store's delivery area, we convert it to map coordinates (see Section 6, "BC Address Geocoder") and store those coordinates with the address.

• Order details — the products and quantities you order, whether you chose pickup or delivery, the store, and the totals and taxes calculated for the order.

• Payment information — for delivery orders, which are paid in the app, payment is processed by Moneris on a secure Moneris-hosted checkout page. We never receive or store your full card number. Moneris returns a receipt that we retain for order and refund records; it includes a transaction reference and limited card details (card type and the last four digits of the card). For delivery orders, our staff and driver may use the card brand and last four digits to confirm that the person receiving the order is the person who paid for it, alongside the government ID check the LCRB requires. Pickup orders are paid in person at the store counter and are not charged in the app.
   

Information we collect automatically
 

• Device push token — if you allow notifications, so we can send you order-status updates (for example, "your order is being prepared" or "your driver is on the way").

• Device and app information — device type, operating system, and app version, used to operate and support the app.

• In-app usage (first-party analytics) — to understand what customers are looking for and to improve the app, we record your activity within the app while you are signed in: screens and product pages you view, searches you run, items you add to or remove from your cart, the checkout steps you reach, and order totals. This is first-party: it is stored in our own database in Canada and is never shared with any third-party analytics or advertising service. We use it only to operate and improve the Service — not for advertising, and not to build profiles about you for anyone else. These usage records contain product identifiers, the store, search terms (recorded as you typed them), order totals, and the activity events, linked to your account; we do not attach your name, delivery address, or payment card details to them. If you ask us to delete your account, these records are unlinked from it (see Section 9).

• Location — the app may request permission to use your device location to help confirm you are within British Columbia, where we are licensed to operate. We do not track your location in the background and we do not store your precise device location. Delivery-area checks are performed on the delivery address you enter, not on your live device location.
   

What we do NOT collect
 

• We do not use third-party analytics or advertising trackers. Our usage analytics are first-party only (described above), stored in Canada, and are never shared with advertising networks or data brokers. There is no third-party behavioural-tracking or advertising software in the app.

• We do not collect or store an image or scan of your government ID. Age is confirmed by self-attestation at sign-up. Your ID is checked in person by our staff at pickup or by our driver at delivery, as the LCRB requires — they record only that ID was checked. Your ID is never photographed or stored.

• We do not collect your social-media data, your browsing history outside our app, your contacts, or your date of birth.

4. How you sign in

You sign in with a one-time code sent to your email. There is no password to create or remember, and we do not offer sign-in through Google, Facebook, or any other social account — so no third party is told when or how you use the app.

5. Why we collect it

We collect and use personal information for these purposes, consistent with BC PIPA:

• To provide the Service — create your account, take and fulfil orders, arrange pickup or delivery, and provide customer support.

• To process payments for delivery orders and handle refunds.

• To comply with cannabis law and our LCRB licence — confirming you are of legal age, enforcing the 30 g public-possession limit, confirming delivery is within a permitted area, and keeping the records regulators require.

• To send you order-status notifications (you can turn off non-essential notifications in your device settings).

• To send you new-arrival notifications for brands or strains you follow — only with your separate, explicit opt-in, at most one bundled notification a day, and you can withdraw at any time under Profile → Following.

• To understand how the app is used and improve it, using the first-party usage analytics described in Section 3.

• To send you marketing messages only if you have opted in, and to stop when you opt out.

• To detect and prevent fraud, abuse, and unauthorized access.

We do not sell your personal information, and we do not use it for advertising or profiling.

6. Who we share it with (service providers)

We share personal information only with service providers who help us run the Service, only as needed, and under agreements requiring them to protect it. We do not sell or rent personal information to anyone.

• Supabase — Hosts our database, account sign-in, and stored files — Canada (Montreal / ca-central-1)

• Moneris — Processes in-app card payments for delivery orders — Canada

• TechPOS — Our stores' point-of-sale system; receives your order so staff can fulfil it — Canada

• Fly.io — Hosts our application servers — Canada (Toronto)

• Expo / Apple / Google push services — Deliver order-status push notifications to your device — United States (message transport only)

• BC Address Geocoder (Province of BC) — Converts a delivery address to map coordinates so we can check it is within a store's delivery area — Canada

Some push-notification providers are located in the United States and may be subject to the laws of that country. We keep the information sent to them to the minimum needed for the feature — push notifications carry only the order reference and a message template — or, for new-arrival alerts you have opted into, the product and store names involved — never your other personal information. Our core account, order, and payment records are stored in Canada.

We may also disclose personal information where required by law, to comply with a regulator (including the LCRB), or to protect our rights, safety, or property.

7. Where your information is stored

Our database, account, and payment records are hosted in Canada (Montreal and Toronto). As noted above, push-notification delivery routes through providers in the United States; the information involved is limited to the order reference and a message template (or, for opted-in new-arrival alerts, the product and store names).

8. How long we keep it

• Order records and related audit logs — retained for 6 years, as required by the LCRB and applicable tax law.

• Account information — until you ask us to delete it (see Section 9), subject to the record-keeping obligation above.

• In-app usage analytics — retained for 2 years, after which they are automatically deleted. If you delete your account earlier, they are unlinked from it at that point (Section 9).

• Brands and strains you follow — until you remove them or delete your account, whichever comes first.

• Marketing preferences — until you withdraw consent.

9. Your rights and choices

Under BC PIPA and PIPEDA you can:

• Access the personal information we hold about you, and ask us to correct it if it is wrong.

• Withdraw consent to marketing at any time.

• Ask us to delete your account. When you do, we redact your identifying information (name, email, phone, saved addresses) and unlink your in-app usage records from your account, and delete the brands and strains you follow. Because the LCRB requires us to keep records of cannabis transactions, we retain the underlying order record in a form that no longer identifies you.

• Complain to us, and — if you are not satisfied — to the Office of the Information and Privacy Commissioner for BC (oipc.bc.ca).

To exercise any of these rights, contact us at support@tllcannabis.com. We will respond within the time PIPA allows (generally 30 days).

10. How we protect it

Access to personal information is limited to authorized staff and is restricted by role and by store — a store's staff can see only that store's orders and customers. Payment card data is handled on Moneris's secure hosted page and does not pass through our own systems. We use encryption in transit, access controls and row-level security on our databases, and audit logging of staff access to customer records.

No system is perfectly secure, but we take steps appropriate to the sensitivity of the information. If we experience a privacy breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner for BC as BC PIPA requires.

11. Age

The Service is for adults 19 and older in British Columbia. It is not directed to anyone under 19, and we do not knowingly collect information from anyone under 19. If we learn we have, we will delete it.

12. Changes to this policy

We may update this policy. When we make a material change, we will update the "Last updated" date and, where appropriate, notify you in the app. Your continued use after an update means you accept the revised policy.

13. Contact us

The Local Leaf Cannabis — operated by Kansas Enterprises (Franchises) LTD Privacy contact: support@tllcannabis.com Mailing address: 6–2662 Austin Avenue, Coquitlam BC V3K 6C4, Canada

​

​

​