Privacy Policy

We collect the following categories of information:

• Account & business information. Your name, email address, password (stored only in hashed form), business name, city and state, and the number of screens you operate, provided when you sign up or manage your account. We also record when you accepted our Terms of Service and which version you accepted.
• Demo and contact requests. If you ask for a demo or email us, your name, business name, email address, phone number (if you give it), number of screens, and your message.
• Payment information. When you subscribe, our payment processor (Stripe) collects and processes your payment details. We do not store your full card number; we retain limited billing metadata such as subscription status and a customer identifier.
• Menu & content data. Product catalog and inventory data synced from your point-of-sale system, along with images, videos, playlists, and slides you upload or create to display on your screens.
• Integration credentials. API keys or similar credentials you provide to connect a point-of-sale system, stored to operate the integration on your behalf.
• Device & player data. Identifiers and status information from the TV player devices you pair (such as software version, screen resolution, and when it last checked in), and records of what played on each screen and when, used to deliver content, show whether a screen is online, and report on playback.
• Usage & technical data. Log data such as IP address, browser type, pages viewed, and timestamps, collected automatically when you use the Service.

We use the information we collect to:

• provide, operate, and maintain the Service, including syncing and displaying your menus;
• process subscriptions, billing, and payments;
• authenticate users and secure accounts;
• respond to demo requests, support requests, and other messages, and communicate with you about your account and Service updates;
• monitor, troubleshoot, and improve the Service;
• detect, prevent, and address fraud, abuse, or security issues;
• comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described below:

• Service providers. With vendors who help us run the Service, who may process information on our behalf under confidentiality obligations. Our providers currently include Supabase (database, sign-in, and file storage), Vercel (hosting), Stripe (payments), Resend (email delivery), and Upstash (abuse protection, which processes IP addresses).
• Point-of-sale integrations. With the third-party POS systems you choose to connect, such as Dutchie, to the extent needed to retrieve your menu and inventory data using the credentials you provide.
• Legal & safety. When we believe disclosure is required by law, regulation, legal process, or to protect the rights, property, or safety of CanopyOS, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

We use only the cookies and browser storage the Service needs to work: cookies that keep you signed in and protect your session, and your browser’s local storage, which the admin and the TV player use to remember preferences and to keep the last good copy of your menu if the internet drops. We do not use advertising cookies, third-party analytics, or cross-site tracking, which is why the site does not show a cookie banner. If that changes, we will update this policy first. Because we do not sell or share personal information, a browser “Global Privacy Control” or “Do Not Track” signal does not change how we handle your information. You can control cookies through your browser settings, but the Service will not work without the sign-in cookies.

The menu and inventory data displayed through the Service is your business data. Our screens are intended for in-store display of product information and are not designed to collect personal information from the public who view them. If any content you provide includes personal information, you are responsible for having the rights and lawful basis to use it, and you act as the controller of that information while we process it on your behalf. If you need a data processing agreement, contact us.

We keep account information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. We keep demo and contact requests until we no longer need them to follow up, or until you ask us to delete them. We keep billing records for as long as tax and accounting law requires. When information is no longer needed, we take reasonable steps to delete or de-identify it. You may request deletion as described below.

We use administrative, technical, and organizational safeguards designed to protect your information, including access controls, tenant data isolation, encryption in transit, and optional multi-factor authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your information, we will notify you as the law requires. You are responsible for keeping your account credentials confidential.

Depending on where you live (including Oregon, California, Washington, and other states with privacy laws), you may have the right to know what personal information we hold about you, to access and obtain a copy of it, to correct it, to delete it, and to opt out of the sale of personal information, targeted advertising, and certain profiling. We do not sell personal information or use it for targeted advertising or profiling. Oregon residents may also ask for a list of the specific third parties to which we have disclosed personal information.

To make a request, email support@canopydisplay.com from the address on your account. You can also update much of your account information directly in the app. We may need to verify your identity first, and you may use an authorized agent. We will respond within the time your state’s law requires, generally 45 days, which we may extend once where the law allows. If we decline a request, you may appeal by replying to our response, and we will answer your appeal within the time the law requires. We will not discriminate against you for exercising these rights.

The Service is intended for licensed businesses and users who are at least 21 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us so we can remove it.

We operate in the United States, and your information is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be processed here, where data protection laws may differ from those in your jurisdiction.

The Service may link to or interoperate with third-party services, such as your point-of-sale provider and our payment processor. Those services have their own privacy practices, and we encourage you to review their policies. We are not responsible for the privacy practices of third parties.

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice by email or in the app. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Questions or requests about this Privacy Policy? Contact us at support@canopydisplay.com, or by mail to CanopyOS, State of Oregon.