Privacy Policy | CannaPath Regulatory Solutions

CannaPath Regulatory Solutions

Effective: August 1,2026
Last updated: August 1, 2026

1. Who we are

CannaPath Regulatory Solutions (“CannaPath,” “we,” “us”) is a cannabis regulatory compliance consultancy operating in Minnesota. This policy explains what personal information we collect through www.cannapath.org, why we collect it, who we give it to, how long we keep it, and what you can make us do about it.

2. The short version

We collect very little. We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not use it to make automated decisions about you.

You can ask us what we hold about you, correct it, delete it, get a copy of it, and get a list of the third parties we have disclosed it to. We honor those requests from any United States resident, whether or not your state's law requires us to.

If we turn a request down, you can appeal. And we will tell you how to complain to your state Attorney General.

3. Who this policy covers, and who it does not

This policy is about you as an individual.

It does not cover information about you in your role as an employee, owner, officer, director, or contractor of a business that engages us. Minnesota law draws that line directly: a “consumer” means a natural person acting in an individual or household context, and does not include a natural person acting in a commercial or employment context. Minn. Stat. § 325M.11(g). Most other state privacy laws draw it the same way.

What that means in practice. If you email us from a licensed cannabis business about an engagement, that correspondence is business information. It is governed by our engagement letter and our confidentiality obligations, not by this policy. Same for the SOPs, inspection findings, seed-to-sale records, personnel files, and license documents we handle during an engagement. Those belong to your business, and the confidentiality terms of the engagement are stricter than anything in this policy.

4. What we collect

Category (statutory term) | What that means here | Where it comes from
Identifiers | Name, email address, phone number, business name, IP address | You give it to us. IP is collected automatically.
Commercial information | The services you asked about, engagement and billing history | You give it to us
Internet or other network activity | Pages viewed, referring page, browser and device type, time on page | Collected automatically
Professional or employment-related information | Job title, license type, facility role | You give it to us
Approximate location | City or region estimated from IP address | Collected automatically
Audio or electronic information | Call or meeting recordings, only where you have agreed to be recorded | You give it to us

We do not intentionally collect sensitive data. Under Minnesota law that means data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, or citizenship or immigration status; biometric or genetic information processed to identify you; the personal data of a known child; and specific geolocation data. Minn. Stat. § 325M.11(v).

Medical cannabis patient status is a health condition. In our line of work people volunteer it in web forms without thinking. Do not put it in a form on this site. If you send us sensitive data anyway, we delete it once we have dealt with your message.

5. Cookies, analytics, and tracking

Strictly necessary cookies. Required to load pages, remember your form entries, and keep the site secure. You cannot switch these off without breaking the site.

Analytics. We use Google, and WIX to count visits and see which pages get read. It is configured to anonymize IP addresses and not to share data with the vendor for its own purposes.

Advertising and cross-site tracking. We do not use them. No advertising pixels, no retargeting tags, no third-party ad networks.

Global Privacy Control. If your browser or extension sends a GPC or other recognized opt-out preference signal, we treat it as a valid opt-out of sale and targeted advertising for that browser. We do neither, so the signal changes nothing about how we handle your data. It is still honored.

Do Not Track. There is still no common standard for how sites should respond to browser DNT headers, so we do not respond to them. We do respond to GPC.

6. Why we use it

- To answer your question and follow up on it
- To provide, schedule, and bill for consulting services
- To send you materials you asked for
- To keep the site working, secure, and free of abuse
- To understand which pages people actually read, so we write better ones
- To keep records we are required by law or professional obligation to keep
- To defend ourselves in a legal claim

We do not use your personal information for anything materially different from these purposes without asking you first.

7. What we do not do

- We do not sell your personal information for money or other valuable consideration.
- We do not share it for cross-context behavioral advertising or targeted advertising.
- We do not profile you to make decisions that produce legal or similarly significant effects.
- We do not offer financial incentives or loyalty programs in exchange for your data.
- We have not done any of these in the preceding twelve months.

If that ever changes, we will update this policy, tell you before the change applies to data we have already collected, and put a clear opt-out link on the site.

8. Who we share it with

We disclose personal information to service providers who need it to do a job for us, under contracts that bar them from using it for their own purposes.

We also disclose personal information when the law requires it: to comply with a subpoena, court order, or lawful government request; to enforce our agreements; to protect the rights, safety, or property of CannaPath or others; and to a buyer or successor in a merger, acquisition, or sale of assets, in which case we will say so here.

We are a compliance consultancy, so this deserves to be said out loud: we do not report your inquiries to the Minnesota Office of Cannabis Management or to any other regulator. Nothing you send us goes to a regulator unless you direct it or a court orders it.

9. How long we keep it

We do not keep personal information that is no longer relevant and reasonably necessary for the purpose we collected it for, unless the law requires us to keep it.

10. How we protect it

We maintain administrative, technical, and physical safeguards appropriate to the volume and sensitivity of what we hold:encrypted transport (TLS) on the site, access limited to staff who need it, multi-factor authentication on business accounts, full-disk encryption on laptops and phones, vendor due diligence before we hand anyone data, and a written inventory of what we hold and where it lives.

No system is perfectly secure and we will not pretend otherwise. If a breach affects your personal information we will notify you as required by Minn. Stat. § 325E.61 and any other applicable state law.

11. Your rights

We extend all of the following to any United States resident, regardless of whether your state has a privacy law.

- Confirm and access. Find out whether we process personal data about you and see the categories we hold.
- Correct. Fix inaccurate personal data about you.
- Delete. Have your personal data deleted.
- Portability. Get a copy of the data you gave us, in a portable and readily usable format, where the processing is automated.
- Opt out. Opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects. We do none of these, so the right is available but there is nothing to opt out of.
- Third-party list. Get a list of the specific third parties we have disclosed your personal data to. If we do not maintain that list per person, we will give you the list of third parties we have disclosed any consumer's data to.
- Question a profiling decision. If a decision with legal or similarly significant effects was made about you by profiling, you can ask why, learn what you might have done differently, review the data used, and have the decision reevaluated on corrected data. We do not profile, so this one will come back “we made no such decision.”
- No retaliation. We will not deny you service, charge you more, or give you worse service because you used a right.

The last three are Minnesota specialties. Minn. Stat. § 325M.14, subd. 1(g) and (h). Most states do not have them. We apply them to everyone anyway, because running two processes is how mistakes happen.

12. If you are a Minnesota resident

The Minnesota Consumer Data Privacy Act, Minn. Stat. §§ 325M.10 to 325M.21, took effect July 31, 2025. It gives you the rights in Section 11 and requires the appeal process in Section 16.

[CONFIRM AND KEEP ONE OF THE TWO PARAGRAPHS BELOW. Delete the other. Which one is true depends on your headcount, revenue, and how many Minnesota residents' data you actually touch. See Part 4 of this document.]

Option A. CannaPath is a small business as defined by the U.S. Small Business Administration, 13 C.F.R. part 121, and does not control or process the personal data of 100,000 or more Minnesota consumers or derive revenue from selling personal data. The MCDPA's general obligations therefore do not apply to us by their terms. Minn. Stat. § 325M.12, subd. 1 and subd. 2(a)(19). We follow them anyway. The one MCDPA duty that binds a small business regardless of size is the ban on selling sensitive data without prior consent, Minn. Stat. § 325M.17, and we sell no data at all.

You can complain to the Minnesota Attorney General's Office at ag.state.mn.us, (651) 296-3353, or (800) 657-3787.

13. If you are a California resident

The California Consumer Privacy Act gives you the right to know, delete, correct, opt out of sale and sharing, limit the use of sensitive personal information, and be free from retaliation.

In the preceding twelve months we collected the categories listed in Section 4, from the sources listed there, for the purposes in Section 6, and disclosed them to the categories of third parties in Section 8. We sold no personal information. We shared none for cross-context behavioral advertising, including none belonging to anyone we know to be under 16. We collect no sensitive personal information for a purpose that would trigger the right to limit.

Because we neither sell nor share, we do not post a “Do Not Sell or Share My Personal Information” link. If that changes, we will post one.

You may use an authorized agent. We will ask for proof of authorization and, unless the agent holds a power of attorney, may ask you to confirm directly.

CannaPath does not currently meet the CCPA definition of a “business” — annual gross revenue over $26,625,000, or buying, selling, or sharing the personal information of 100,000 or more consumers or households a year, or deriving 50 percent or more of revenue from selling or sharing personal information. Cal. Civ. Code § 1798.140(d). We honor CCPA rights voluntarily.

14. If you live in another state with a privacy law

As of this writing, twenty states have comprehensive consumer privacy laws in effect: California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Most of them follow the same template.

We do not run a state-by-state process. Everyone gets the full set of rights in Section 11 and the appeal process in Section 16. If your state gives you something we have missed, tell us and we will honor it.

15. How to make a request, and what happens next

Send it to legal@cannapath.org. Say which right you want to use. You do not need to create an account.

Verification. We will make a commercially reasonable effort to confirm you are who you say you are, usually by replying to the email address we already have on file or asking you to confirm details we already hold. If we cannot verify you, we will say so and tell you what else we need. We do not verify opt-out requests, but we may refuse one if we have a documented, good faith basis to believe it is fraudulent, and we will tell you why.

What we will never send back. Even to a verified requester, we will not disclose a Social Security number, driver's license or other government ID number, financial account number, health insurance or medical identification number, account password or security answers, or biometric data. We will tell you that we hold that type of information and nothing more. Minn. Stat. § 325M.14, subd. 4(i).

Timing. We respond within 45 days. If the request is complex we may take one additional 45 days, and we will tell you inside the first 45 days that we are doing so and why. Opt-out requests are handled as soon as feasibly possible and never later than 45 days.

Cost. Free, up to twice a year. If requests become repetitive to the point of being unfounded or excessive we may charge a reasonable administrative fee or decline, and the burden of showing that is on us.

Someone else's request. A parent or legal guardian may make a request for a child. A guardian or conservator may make one for a person under guardianship or conservatorship. You may designate an authorized agent for opt-out requests, including through a browser setting or extension.

16. Appeals

If we refuse a request you can appeal, either by replying to our refusal or by writing to legal@cannapath.org with “Privacy Appeal” in the subject line. Appealing is as easy as making the original request.

We will tell you the outcome within 45 days, in writing, with reasons. If the appeal is complex we may take up to 60 additional days and will tell you why.

If we deny the appeal we will give you clear instructions for filing a complaint with the Minnesota Attorney General or with your own state's Attorney General.

We keep records of every appeal and our response for at least 24 months and will produce them to the Attorney General on written request.

17. Children

This site is for adults working in or entering a regulated cannabis market. It is not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not process the data of anyone we know to be between 13 and 16 for targeted advertising or sale. If you believe a child has given us information, write to legal@cannapath.org and we will delete it.

18. Links to other sites

We link out to statutes on revisor.mn.gov, guidance on mn.gov/ocm, Metrc documentation, and other outside resources. Those sites have their own privacy policies and we do not control them. Read theirs.

19. Changes to this policy

We update the “Last updated” date at the top whenever we change anything. If we make a material change, we will take reasonable electronic steps to notify affected individuals before it applies to data we have already collected, and give you a reasonable chance to withdraw consent to the new use. Minn. Stat. § 325M.16, subd. 1(e).

20. Contact

CannaPath Regulatory Solutions

legal@cannapath.org

(952)649-2946

We answer privacy email. It is not a black hole.