WhereLeaf.
BusinessSign in

Privacy policy

Last updated: October 9, 2026

WhereLeaf. (whereleaf.com) is an online directory of licensed cannabis businesses: dispensaries, delivery services and curbside pickup, a strain library, and a directory of suppliers (packaging, labels and wholesale) for those businesses. This policy explains what information we collect, why, who can see it and the choices you have.

In short: You can browse without an account. We don't sell your personal information, we don't use advertising or tracking cookies, and we don't sell or deliver cannabis. Businesses listed on the site sell to you directly.

1. Information we collect

When you browse

  • Page views and clicks on a business's phone, website or directions buttons, so we can show owners how their page performs. To avoid counting the same visit twice we use a scrambled code made from your IP address that cannot be turned back into it and is deleted within an hour. We don't store your IP address with these counts.
  • Standard server logs kept by our web host (IP address, browser, pages requested, time) for security and to fix errors.

When you use "Use my location"

  • Your browser asks your permission first. Your approximate position is used to show nearby businesses and distances, is saved only in your own browser so the next search remembers it, and is included in the search page address. We don't save it to an account or profile. You can instead type a city or ZIP/postal code.

When you write a review

  • Your name, star rating and review are public. Your email address is never shown; we use it to stop duplicate reviews and to contact you about your review.
  • Your IP address and browser, stored with the review to fight spam and fake reviews.

When you contact us or a business

  • What you type in the contact, banner booking, guest article or claim forms (for example name, email, phone, business name and message).
  • Quote requests to a supplier: your name, business, email, phone and message are sent to that supplier so they can reply to you.

When a business or supplier creates an account

  • Account details: name, email address and password (stored only in scrambled, one-way form; we can't read it).
  • Business details you add to your page, which are public: business name, address, phone, website, hours, menu link, description, photos, services and license number.
  • Whether you agreed to receive our tips and offers by email, and when.
  • For paid plans and banners: what you ordered and your contact details. We don't take card payments on this site; we send payment details by email.

2. Cookies and browser storage

We only use what the site needs to work. No advertising cookies, no cross-site tracking and no analytics trackers.

  • Age confirmation: remembers that you confirmed you are of legal age, so we don't ask on every page.
  • Sign-in cookies (business accounts and our team only): keep you signed in.
  • Saved location and search choices: kept in your browser's storage, not sent to an account.
  • Review form: if you tick the box, your browser remembers your name and email for next time.

3. How we use information

  • To run the directory: show businesses, search results, maps, reviews and supplier pages.
  • To check that listed businesses hold a valid license before their page goes live.
  • To manage business accounts and send service emails (welcome, password reset, listing approved, monthly results, replies to requests).
  • To send tips and offers to business owners who agreed to them. Every such email has an unsubscribe link.
  • To keep the site safe: block spam, fake reviews and attempts to break into accounts.

4. Who we share it with

We don't sell or rent personal information, and we don't share it for advertising. We share only what is needed:

  • Businesses and suppliers you contact through the site receive the details you send them.
  • Service providers that run the site for us: our web host, our email delivery service, and (for business owners who agreed to marketing emails) our email newsletter tool. They may only use the data to provide their service.
  • Map images come from OpenStreetMap and fonts from Google Fonts. Your browser loads them directly, so those services see your IP address, as with any website.
  • Authorities, if the law requires it, or to protect people from harm or fraud.

5. How long we keep it

  • Business accounts and pages: while the account is open. When you ask us to delete it, we remove your account and pages within 30 days.
  • Reviews: until you or the business asks us to remove them, or we remove them under our rules.
  • Messages to us: up to 2 years, then deleted.
  • Visit counts: only as totals per business (no personal data).

6. Your choices and rights

  • Business owners can change their name, email, password and email preferences any time under My listings → Account settings, and edit their pages there.
  • Anyone can ask us for a copy of their information, to correct it, or to delete it (for example a review or an account). Contact us and we will reply within 30 days.
  • California residents: you have the right to know, delete and correct personal information, and to not be discriminated against for using these rights. We don't sell or share personal information for cross-context advertising.
  • Canada: we handle personal information under PIPEDA and provincial privacy laws, and send marketing email only with consent (CASL).
  • UK and EU: you also have the right to object, to restrict use and to data portability, and to complain to your data protection authority. We use your information to provide the service you asked for, with your consent (marketing emails, location), or for our legitimate interest in keeping the site safe.

7. Age

This site is only for adults of legal age where they live (21+ in the US; 18 or 19+ in Canada depending on the province). We don't knowingly collect information from anyone under that age. If you believe a minor has given us information, contact us and we will delete it.

8. Security

We protect the site with encrypted connections (https), scrambled passwords, limits on sign-in attempts and spam filters. No website is perfectly secure, so use a password you don't use anywhere else.

9. Changes

If we change this policy we update the date at the top. If a change is important, we will tell business account holders by email.

10. Contact us

Questions or requests about your information? Use our contact form and choose "Something else".