What the platform collects, why it is used, and who controls it.

1. Who controls company data

Each subscribing company controls the customer, sales, manifest, compliance, accounting, product, and team data entered into its private workspace. Authorized company administrators decide who can access that workspace and which state markets and territories are assigned.

2. Data the service handles

• Account and team data, including names, work email addresses, roles, territories, session records, and notification settings.
• Company and regulatory profile data, including business contact information, state license identifiers, and controlled-substance registration identifiers.
• Employee and payroll data entered at the company's direction, including contact and home-address information, date of birth, Social Security number, emergency contact, employment and payment information, withholding elections, electronic attestations, pay records, and uploaded W-4, OK-W-4, I-9, or payment-authorization documents.
• CRM and operations data, including public-license records, customer contacts, call notes, follow-ups, opportunities, orders, pricing, invoices, and payments recorded by the company.
• Uploaded or imported business documents, including manifests, certificates of analysis, forms, labels, and accounting support files.
• Integration and billing data needed to operate read-only Metrc Connect, email, web-push, and Stripe billing. Payment-card data is handled by Stripe rather than stored in the TAGE workspace.
• Technical records used to secure and operate the service, such as request, delivery, sync, document-access, audit, and error logs.

3. How data is used

Data is used to authenticate users, isolate company workspaces, operate requested CRM and accounting workflows, import authorized records, generate company documents and reports, deliver requested communications, process subscriptions, secure the service, and diagnose failures. TAGE Grower Desk is not an advertising network and is not designed to sell personal information or use company records for cross-context behavioral advertising.

4. When data is shared

Data may be sent to service providers only as needed to operate requested features, such as Stripe for billing, Resend for transactional email, web-push providers for device notifications, and Metrc for an authorized read-only integration. Data may also be disclosed when required by law, to protect the service or its users, or during a business transaction subject to appropriate safeguards. A company may independently send information to its own customers, accountants, investors, regulators, or other recipients.

5. Security and tenant separation

The service uses company-scoped records, role checks, secure session cookies, expiring and revocable employee links, protected server configuration, encryption for supported stored credentials and sensitive tax and HR fields, private document storage, and audit-oriented import, delivery, and HR-access records. Employee links must not be forwarded. Administrators must restrict, review, download, print, and disclose employee records only for authorized employment, payroll, tax, benefits, compliance, or legal purposes. No system can guarantee absolute security. Users must protect access codes, email accounts, devices, API credentials, and downloaded files, and should report suspected unauthorized access promptly.

6. Retention and deletion

Business and employment records are retained while a company account is active and as reasonably needed for service operation, payroll and tax administration, security, backup, dispute resolution, and legal obligations. Employers and regulated businesses may have independent retention duties, including separate rules for payroll, employment-tax, and Form I-9 records. An authorized company administrator may request account export or deletion, subject to required retention and the practical limits of backups and immutable audit evidence.

7. Choices and requests

Users can update many company and profile fields in the service, unsubscribe from eligible marketing notices, revoke browser notifications, and ask their company administrator to correct or remove workspace access. Privacy, access, correction, export, or deletion requests may be sent to jcalvin@2cproduction.com. The requester may need to verify identity and authority over the company workspace.

8. Age and regulated-business use

The service is intended for authorized adults working with licensed businesses. It is not directed to children or consumers purchasing cannabis. Public-license information is provided for business research and must be verified with the responsible regulator before a regulated decision.

9. Changes

This notice may be updated as the service, state coverage, or legal requirements change. Material changes should be communicated through the service or the company contact on file before they take effect when reasonably possible.