What we collect
Three categories of data:
- Inquiry-form submissions. When you submit the contact form on the homepage, we receive your company name, your name, your email, the volume bracket you indicated, and the free-text message. Cloudflare also adds your country (from IP geolocation, country-level only) and the IP address itself for rate-limiting and spam-defence purposes.
- Anonymised analytics (Google Analytics 4). Page views, referrer, session metadata, country at country-level. We have configured GA4 to anonymise IP addresses, disable Google Signals (no cross-device user tracking), and disable ad personalisation signals.
- Admin authentication data (admin-only). If you sign in to the CMS at
/admin/login, we store your email, the hashed magic-link token (15-minute TTL, single-use), the hashed session ID, your TOTP secret (if enrolled), and an activity log (sign-in events with IP, country, city, region, user-agent).
What we don’t collect
- No third-party advertising cookies, ad-network pixels, or remarketing tags.
- No tracking of individual users across sessions or devices.
- No sale, rental, or sharing of personal data with third parties.
- No collection of children’s data — the site is B2B and not directed at users under 18.
- No payment information is stored on this site (we do not process payments).
Where data goes
Inquiry-form submissions are emailed to export@cannabless.org via Resend (transactional email service, US-hosted, EU/US adequate-protection compliant) and additionally posted to our internal Google Chat space via webhook for real-time team-awareness.
The same submission is also stored in our Cloudflare D1 database (Cloudflare global edge) and processed by an AI lead-triage step. The triage call is routed through OpenRouter (US-hosted API gateway, San Francisco) to Anthropic Claude (currently Haiku 4.5, US-hosted), producing an internal quality score, classification tags, and a drafted reply for the export desk to review and send. Neither OpenRouter nor Anthropic uses customer API content for model training per their published terms; OpenRouter is a passthrough gateway and does not retain content beyond what is needed to serve the request. Triaged data lives in the same retention bucket as the inbox copy: indefinitely until you request deletion.
CannaBless also performs limited B2B outbound contact across its three audiences, always to organisations identifiable from a public source: licensed importers/distributors publicly listed on regulator registries (the TGA in Australia, BfArM in Germany, ANSM in France, SÚKL in the Czech Republic, the MHRA / Home Office in the United Kingdom, and Swissmedic in Switzerland); licensed Thai cultivation farms listed on the public DTAM and MOPH/ONCB licensing registers; and organisations that have themselves publicly announced an interest in entering Thailand’s medical-cannabis market. The legal basis is legitimate interest under GDPR Article 6(1)(f) and equivalent regimes — Thailand PDPA for farm-side outreach — given the narrow, regulated audiences. Every outbound message includes a one-click unsubscribe (reply STOP) and identifies the public source that lists or announced the recipient. We never source contacts from scraped, leaked, aggregator, or non-public databases. This summary is provided for transparency and is not a substitute for our formal data-protection records.
Analytics is sent to Google (GA4 — Mountain View, US) per the privacy posture above. Admin sign-in activity is stored only in our Cloudflare D1 database (Cloudflare global edge).
Server access logs are handled by Cloudflare Workers in line with Cloudflare’s privacy policy.
How long we keep data
- Inquiry submissions: Indefinitely, in the inbox at export@cannabless.org, until you request deletion. Used for ongoing supply discussions.
- Analytics: 14 months, Google Analytics 4 default retention.
- Magic-link tokens: 15 minutes; single-use.
- Admin sessions: 8 hours from sign-in.
- Admin activity log: Indefinitely. Used for security review.
Cookies
We set the following cookies on this site:
cb_admin— HttpOnly, Secure, SameSite=Lax. Only set when a user signs in to/admin. Holds the hashed admin session reference._ga,_ga_*— Google Analytics 4 client ID and session tracking. First-party cookies, anonymised IP, no Google Signals.
Legal basis & applicable law
Our customer base is concentrated in regulated medical-cannabis import markets, so the regimes that drive most of our practical compliance work — and where we hold the highest bar for data-subject rights — are the European Union, the United Kingdom, California, and Australia. Thailand PDPA applies in addition, because CannaBless is a Thailand-based entity.
- EU GDPR & UK GDPR — primary customer-facing regime. Apply when data subjects are physically in the EU/EEA or the UK. We process inquiry data on the legal basis of contract (Article 6(1)(b), responding to your inquiry) or legitimate interest (Article 6(1)(f), rate-limiting, spam-defence, B2B follow-up). No marketing-consent processing.
- California CCPA / CPRA — applies to California residents. We do not sell or share personal information for cross-context behavioural advertising. Deletion requests actioned via the contact below.
- Australia Privacy Act 1988 + Australian Privacy Principles — applies to data subjects in Australia, one of our regulated destination markets, so APP compliance is part of how we handle the channel.
- Thailand PDPA (Personal Data Protection Act B.E. 2562) — corporate primary regime. CannaBless is the data controller; PDPA Section 19 disclosure: data is collected for the purposes stated above and used for no other purpose without further notice. We do not currently collect sensitive personal data of any category.
Cross-border data transfers
Some of the data we process leaves Thailand because the services we use (Resend for email, Google for analytics, Cloudflare for edge routing) are operated outside Thailand:
- Resend (US) — transactional email delivery. Operates under standard contractual clauses for international transfers.
- Google LLC (US) — GA4 analytics. Certified under the EU-US Data Privacy Framework, with standard contractual clauses for additional regimes.
- Cloudflare (global edge) — request routing, DDoS protection, geo-routing. Standard contractual clauses; regional data-localisation suites available where required.
Under Thailand PDPA Sections 28 & 29, cross-border transfer requires equivalent protection or other suitable measures. The standard contractual clauses with each of the processors above satisfy the “suitable measures” threshold.
Your rights
Whichever regime applies to you, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion (“right to be forgotten”)
- Request a copy of your data in portable form
- Object to processing for marketing or analytics
- Withdraw consent at any time (where consent is the basis relied on — withdrawal doesn’t affect processing already carried out lawfully)
- Lodge a complaint with the supervisory authority of your jurisdiction: the Personal Data Protection Committee of Thailand, your national EU/EEA data protection authority, the UK Information Commissioner’s Office, the California Attorney General, or the Office of the Australian Information Commissioner.
To exercise any of these rights, write to contact@cannabless.org. We respond within 30 days (PDPA, GDPR, CCPA all converge on this timeframe). There is no charge for routine requests.
Geographic restrictions
The site is geo-restricted from jurisdictions where regulated medical-cannabis supply isn’t legally established (see /unavailable). The geo-block is implemented at the Cloudflare edge using country-level IP geolocation; your IP itself is not stored beyond the standard Cloudflare access log.
Contact
Privacy questions, deletion requests, or any other data-protection matter: contact@cannabless.org.
Last reviewed . Material changes are reflected here as they happen.