BridgePoint Cannabis Compliance — Privacy Policy
Last updated: September 28, 2026
1. Who We Are and What This Policy Covers
This Privacy Policy explains how BRIDGEPOINT LLC ("BridgePoint," "we," "us," or "our") collects, uses, shares, and protects information through our public website at bridgepointllc.org (the "Website") and through BridgePoint Cannabis Compliance (the "Service"), the compliance application our customers sign in to.
The Service is built for licensed businesses and the consultants who work with them. Use of the Service is also governed by our Terms of Service. Where this Policy and the Terms of Service address the same subject, the Terms of Service control for customers of the Service.
2. The Short Version
- We do not sell personal information, and we do not share it for advertising.
- The Website uses no advertising trackers and sets no cookies for visitors. We measure traffic ourselves, without cookies and without storing your IP address in our analytics.
- Your audit records belong to you. We do not disclose your audit data to OMMA or any other regulator except as required by law or valid legal process, or at your direction.
- Each customer's audit data is kept separate from every other customer's.
- The Service audits business compliance only. It is not designed to receive patient or caregiver information, and it refuses evidence where it detects such information.
- Evidence you submit is sent to our artificial intelligence provider only to produce your results, and under that provider's commercial terms it is not used to train the provider's models.
3. Information We Collect
3.1 When You Visit the Website
Traffic measurement. When you view the Website, we record which pages you view, which sections of the home page you scroll to, which buttons and links you click, how far you watch the demo video, how long the page is open and in view, the website that referred you (or the campaign name in the link you followed), and your device type (phone, tablet, or computer).
How visitors are counted. To count visitors without tracking them, our server combines your IP address and browser type with the current date and a secret key, and turns them into a one-way code. Your IP address is not stored in our analytics, the code cannot be reversed to reveal it, and the code changes every day, so we cannot follow a visitor from one day to the next.
No cookies for visitors. The Website does not set cookies for visitors. It uses your browser's temporary tab storage to tell page views in the same visit apart; that is erased when you close the tab. If you choose to opt out of traffic measurement (see Section 10), a small note of that choice is saved in your browser. Only BridgePoint staff signing in to the Website's administration area receive a sign-in cookie.
Standard server records. Like any website, the servers that host the Website receive technical information with each request, such as your IP address, browser type, the page requested, and the time. Our hosting provider may keep these records for a limited time for security and operations.
Fonts. The Website loads typefaces from Google Fonts. When it does, your browser connects to Google's servers, which receive your IP address and browser information under Google's own privacy policy.
3.2 When You Request Your State
If you use the "Request my state" form, we collect the state you request, your license type, your email address, your company name if you provide it, the date, and the IP address the request came from (used to prevent automated and abusive submissions).
3.3 When You Contact Us
If you email us, we receive your email address, the contents of your message, and anything you attach.
3.4 When You Use the Service
Account information. Your business name, license number and license type, a contact name, the email addresses of the people on your account, each person's role and permissions, and the date your account accepted the Terms of Service. Passwords are stored only in a one-way scrambled form (a "hash"); we cannot see them.
Billing information. Your subscription plan, price, and payment status. Card details are entered with, and held by, our payment processor. We do not receive or store full card numbers.
Customer Data. The evidence photographs and documents you submit or upload, facility information, audit records, results, notes, corrective action plans, delivery records, the names and addresses of client facilities you save (for consultants), and the questions you ask the AI Assistant along with its answers. As stated in our Terms of Service, you own your Customer Data.
Usage and security records. Which tools and screens are used, what action was taken, how long it took, whether it succeeded, and any error message shown. These records do not include your evidence, photographs, extracted label text, AI Assistant conversations, or anything you type into a form. We also keep a sign-in history: the email address entered, whether the sign-in succeeded and why not, the IP address, and the time. This lets us help when someone cannot sign in and detect misuse.
Browser storage. The Service keeps your sign-in in your browser so you stay signed in between visits.
4. Information We Do Not Want
No check in the Service requires information about an individual patient or caregiver. Please do not submit a patient's or caregiver's name, license or identification number, date of birth, address, or contact information; a medical marijuana recommendation; a receipt or point-of-sale screen identifying a purchaser; a photograph of anyone's identification document; or any individually identifiable health information. The Service screens submitted evidence for this information. When it detects it, the submission is refused, no result is produced, and the evidence is not kept in your audit record. Screening is a safeguard, not a guarantee; see Section 7 of our Terms of Service. If we learn that such information has been stored, we will delete it.
5. How We Use Information
- To provide and operate the Website and the Service, including producing results from the evidence you submit.
- To create and manage accounts, process subscriptions, and provide customer support, including helping people who cannot sign in.
- To keep the Website and the Service secure, prevent fraud and abuse, and enforce our Terms of Service, including monitoring usage patterns as described in Section 5.3 of the Terms.
- To communicate with you: service and account notices, replies to your messages, and, if you requested your state, a message when BridgePoint becomes available there.
- To understand how the Website and the Service are used and to maintain and improve them, using aggregated or de-identified information that does not identify you, your facility, or any individual.
- To comply with law and respond to valid legal process.
We do not use Customer Data for advertising, and we do not sell it.
6. How We Share Information
Service providers. We use a small number of providers to run the Website and the Service: a cloud application and database host, an artificial intelligence provider that performs the evidence analysis and generates AI Assistant answers, a payment processor for subscription billing, an email delivery provider when we send email, and Google Fonts for the Website's typefaces. They receive information only as needed to provide their services to us. A current list of subprocessors is available on request.
Regulators and government. We do not disclose your audit data to OMMA or any other regulator or government agency except as required by law or valid legal process, or at your direction. Where we are legally permitted to, we will try to notify you before disclosing your data in response to a legal demand.
People on your account. Information in your account is visible to the people on your account according to the roles and permissions your account owner sets.
Business transfers. If BridgePoint is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. Any successor will be required to honor this Policy for the information it receives.
With your permission. We share information for any other purpose only with your consent.
We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising.
7. Artificial Intelligence Processing
BridgePoint uses a third-party artificial intelligence provider to perform certain functions within the Service.
When you submit evidence for review, relevant evidence and associated instructions may be sent to our artificial intelligence provider so that the Service can analyze the submitted material and generate information used in your Results. Questions submitted through the AI Assistant may also be sent to that provider together with relevant regulatory content needed to generate a response.
Under our provider’s commercial terms, Customer Data submitted through BridgePoint is not used to train the provider’s general-purpose models unless BridgePoint expressly opts into such use. The provider may temporarily retain or process information for security, abuse prevention, service operation, or other purposes permitted under its applicable commercial terms and data-processing arrangements.
BridgePoint does not authorize its artificial intelligence provider to use Customer Data for advertising.
8. How Long We Keep Information
- Website traffic measurement: about 13 months, then deleted automatically.
- State requests: until you ask us to remove yours, or until we no longer need it to tell you your state is available.
- Customer Data: while your account is active, unless you delete it sooner. We delete Customer Data within thirty (30) days after your written deletion request or after your account is closed, as set out in Section 8.4 of our Terms of Service, except where we must keep it by law.
- Usage and sign-in records: 12 months, then deleted automatically.
- Billing and business records: as long as tax and accounting law requires.
- Email correspondence: as long as needed to respond and keep a record of our dealings with you.
Deleted information may remain in encrypted backups for a limited period until those backups are overwritten. We may keep aggregated or de-identified information that does not identify you, your facility, or any individual.
9. Security
Information is sent over encrypted connections and stored in an encrypted, access-controlled database. Passwords are stored only as one-way hashes. Each customer's audit data is separated from every other customer's. Access to administrative tools is limited and protected, and sign-in attempts are rate-limited. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security incident affects your information, we will notify you without undue delay and as required by law. BridgePoint periodically reviews and updates its administrative, technical, and organizational safeguards as the Service and its risks evolve.
10. Your Choices and Rights
Access, correction, deletion, and a copy. You may ask us to confirm what personal information we hold about you, correct it, delete it, or give you a copy of it. Customers may also delete individual audit records directly in the Service. If you are a member of a customer's team, some requests may need to go through your account owner, since the account belongs to your organization.
How to ask. Email customer-service@bridgepointllc.org. We will verify your request before acting on it and aim to respond within thirty (30) days. If we decline a request, we will explain why, and you may reply to ask us to reconsider. We will not treat you differently for exercising these rights.
State privacy laws. Some states give their residents additional privacy rights. We honor the rights that apply to you under the law of your state.
Website traffic measurement. To stop the Website from counting your visits, open bridgepointllc.org/?notrack=1 once in each browser you use. Open bridgepointllc.org/?notrack=0 to turn counting back on.
Emails. To stop hearing from us about your state request, reply to any of our messages or email us and we will remove you. Service and account notices are part of the Service and continue while your account is active.
Browser signals. Because we do not sell personal information, share it for advertising, or track visitors across other websites, Global Privacy Control and "Do Not Track" signals do not change how the Website works. We treat a Global Privacy Control signal as a request to opt out of any sale or sharing, which we do not do in any case.
11. Children
The Website and the Service are intended for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.
12. Where Information Is Processed
BridgePoint is based in Oklahoma and operates the Website and Service from the United States. Information may be stored or processed by BridgePoint and its service providers in the United States or other locations where those providers maintain operations, subject to applicable contractual and legal safeguards.
13. Changes to This Policy
We may update this Policy from time to time. We will post the updated version here and change the "Last updated" date. If we make a material change, we will notify customers of the Service in advance by email or in the Service.
14. Contact
Questions or requests about this Policy may be directed to BRIDGEPOINT LLC at Customer-service@bridgepointllc.org.