Privacy Policy

Effective September 12, 2026 · Last updated September 12, 2026

This Privacy Policy explains what BudFinderKC collects, why, and what we do — and don’t do — with it. It applies to everyone who visits the site, whether or not you create an account.

We built this policy around a simple rule: collect less, so there’s less to worry about. Where you see a specific promise below — “we don’t sell your data,” for example — read it as literal, not as marketing.

If you just browse

We collect the result of the age gate — pass or fail, and when — never your date of birth. We remember a passing result for 30 days in a cookie so you aren’t re-gated on every visit.

We collect standard server logs (IP address, browser, pages requested) for security and to keep the site running. We keep these briefly and don’t use them to build a profile of you.

If you accept analytics cookies in the banner, we may collect anonymous, cookie-light page-view data through Vercel Analytics where it is enabled — the kind of thing that tells us which pages get traffic, not who you are. If you reject the banner, or never respond to it, that script never loads.

If you create an account

We collect your email address, a hashed password (we never see or store your password itself), and anything you add voluntarily — favorites, reviews, and profile details.

Favorites and review history can reveal an interest in cannabis or a specific dispensary. We treat that as sensitive: favorites default to private, and we don’t build advertising segments from them or hand them to anyone outside BudFinderKC.

We never ask for or store a government ID, a medical marijuana card number or image, a qualifying condition, or any other health information — about you or about your visits to a clinic listing.

If you claim a business listing

We collect the DHSS license number you provide to verify the claim, your contact information as the listing’s authorized representative, and whatever content you upload to the listing — photos, menu data, hours, and staff profiles.

If you pay for a Listed, Featured, or Premier tier, billing is handled by our payment processor. We don’t store your card number, and the processor never sees anything beyond what it needs to charge you.

If you’re added as a budtender profile, that requires your employer’s authorization first — we don’t collect or store an agent ID card number or image, only what’s needed to display and disclose the employment link on your staff picks.

If your plan includes analytics or sponsored placement, your dashboard shows aggregate counts — views, direction taps, website clicks, phone taps, and, where you’re in sponsored rotation, impressions and clicks by surface. These are counts, not people: we don’t attach an IP address, browser identifier, cookie, member ID, or session ID to a single one of them, and no cookie of any kind is set to make this counting work. Nothing is recorded at all when a visitor’s browser sends the Global Privacy Control or Do Not Track signal, and a visit from a verified search-engine crawler is never counted as a view. We keep these counts for 400 days, then delete them.

Cannabis-interest and health-adjacent data

No Missouri law clearly requires us to treat cannabis interest as health data, but we do anyway, because the cost of doing so is low and the downside of guessing wrong is not. Favorites, saved searches, and a history of visiting clinic listings can all suggest something about your health or your reasons for using cannabis — so we hold that category of data to a higher bar than the rest of the site.

We don’t run advertising pixels or third-party trackers of any kind on dispensary or clinic pages. We don’t collect precise GPS coordinates — “near me” search uses your coarse, city- or ZIP-level location, never an exact point tied to a specific address. We don’t geofence any dispensary or clinic, for advertising, attribution, or any other purpose. And we don’t assemble a “this person is a medical patient” profile from your browsing, your favorites, or your reviews.

Cookies

BudFinderKC uses a small number of cookies, and you have a real choice about most of them.

Strictly necessary — session, security, and the age-gate cookie (30 days) that remembers you already confirmed you’re 21. These aren’t optional; the site can’t function without them.
Your cookie choice itself — a cookie that remembers whether you accepted or rejected non-essential cookies, so we don’t ask on every page.
Analytics — we may collect page-view data through Vercel Analytics where it is enabled, loaded only if you accept cookies in the banner. We don’t run advertising pixels, and we don’t run any tracking script on dispensary or clinic pages regardless of your cookie choice.

You can change your choice at any time by reopening the cookie banner. We don’t yet automatically detect a browser-level Global Privacy Control or Do Not Track signal — until we do, the cookie banner is how you tell us your preference, and rejecting it has the same effect an opt-out signal would.

How we use what we collect

We use your information to run the directory, and for nothing we haven’t told you about here.

To show you listings, remember your favorites, and let you write and read reviews.
To verify claimed listings and bill for paid tiers.
To moderate submitted content against our published Review Policy, including checking for a material connection between a reviewer and the business being reviewed.
To keep the site secure — detecting abuse, fraud, and attempts to manipulate reviews or ratings.
To send you transactional email you’ve triggered yourself: a verification link, a password reset, or a notice about a claim you submitted.

We don’t use your information to build advertising profiles, and we don’t run cross-site retargeting.

We share data only with the vendors who help us run the site, and only what each one needs to do its job. We don’t work with advertising networks, and we don’t hand your data to a listed business beyond what’s described below.

Hosting and database providers, to run the site and store its data.
Our email provider, to send account and transactional email — verification, password resets, and claim notifications.
OpenStreetMap, for map tiles on the site’s map view — no personal data is sent beyond what’s needed to load a map tile.
A payment processor, once billing is live, to charge and manage subscriptions for claimed listings.
A claimed listing’s owner sees aggregate metrics about their own listing — how many people viewed or favorited it, in bulk — never who any individual visitor is.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising — not for money, and not for free. We disclose information when the law requires it, such as a valid subpoena or court order, and we’ll tell you when we’re legally allowed to.

How long we keep it

We keep what we collect only as long as it’s useful, and no longer.

Age-gate event logs: 90 days, then deleted.
Menu and pricing data: refreshed on a 24-hour cycle, so stale data doesn’t linger.
Account data, favorites, and reviews: kept while your account is active, removed or anonymized within a reasonable period after you delete your account.
Server logs: 30 to 90 days, then purged or anonymized.

Your choices and rights

Wherever you live, you can email privacy@budfinderkc.com to ask us to:

Tell you what personal information we hold about you.
Correct information that’s wrong or out of date.
Delete your account and the personal information tied to it.
Opt out of analytics cookies, at any time, from the cookie banner.

We honor these requests as a matter of policy, not only where a specific state law requires it. A directory this size doesn’t clear the size or revenue thresholds that trigger California’s, Colorado’s, or similar states’ comprehensive privacy laws — and we’ve never sold personal information or shared it for cross-context behavioral advertising, which is the activity most of those laws are built around. We apply the same access, correction, and deletion rights anyway, because it’s the right thing to do and it costs us little to be consistent about it.

Children and under-21s

BudFinderKC is not directed to anyone under 21, and account creation requires confirming you’re 21 or older. We don’t knowingly collect information from anyone under 13, and if we learn we have, we delete it. If you believe a minor has an account or submitted content, tell us at privacy@budfinderkc.com and we’ll investigate and remove it.

Security

We use reasonable technical and organizational measures to protect what we hold — encrypted connections, hashed passwords, and access limits on our own systems. No system is perfectly secure. If a breach compromises personal information, we’ll notify affected Missouri residents without unreasonable delay, consistent with Missouri law.

Third-party sites you visit from here

BudFinderKC links out to listed businesses’ own websites, ordering systems, and social media, and to the Missouri DCR’s licensed-dispensary map. Once you leave BudFinderKC, that site’s own privacy practices apply, not ours — we don’t control what they collect and we’d encourage you to check their policy before you hand over any information there.

International visitors

BudFinderKC is built for the Kansas City metro and hosted in the United States. If you access it from outside the U.S., your information is processed here, under U.S. law.

Changes to this policy

We may update this policy as our practices change. We’ll update the effective date above and post a notice on the site for a material change.

Contact

Questions, requests, or a report of anything that looks like a mismatch between this policy and what the site actually does: privacy@budfinderkc.com.

Questions about this page? Write to hello@wabbit.com or use the contact page.