Privacy policy

This notice describes how Canopy (the operator of canopy-os.com) and the associations (“clubs”) that use Canopy process personal data. It is written for people in the European Economic Area, with Spain (GDPR and LOPDGDD; supervisory authority: Agencia Española de Protección de Datos, AEPD) as the primary reference.

Who is responsible

• Your club (the association / tenant) is the controller of membership records created at that shop: identity details, medical notes, ID images stored for that enrollment, check-ins, dispensing limits, and sales attached to you at that location.
• Canopy is the processor of that club data: we host and operate the software on the club’s instructions (Art. 28 GDPR). A data processing agreement (DPA) between Canopy and the club will set those instructions.
• Canopy is a joint controller of the global member account (email, password, platform profile) that can connect to more than one club. That account exists so you can sign in once across participating shops.

Until counsel confirms the legal entity name, DPO (if appointed), and registered address, treat the operator as “Canopy, canopy-os.com”. Contact: privacy@canopy-os.com.

Categories of data

Depending on how you use Canopy, we (or the club, through Canopy) may process:

• Identity and contact: name, date of birth, nationality, gender, email, phone, address, membership card number
• Government ID number and a scan or photo of your ID / passport (stored privately)
• Optional health-related notes (for example prescriptions or conditions the club records)
• Signature captured for the membership contract
• Visit and purchase data: check-ins, dispenses, store credit, membership periods
• Staff accounts: username, optional email, encrypted name/phone, login IP, IP allowlists, time-clock records
• Security logs: audit actions, IP address, timestamps
• Billing identifiers for the club (for example Stripe customer IDs), not member card payments at the till unless a payment provider is used

Names and phone digits are also stored in a search index so staff can find members at the counter. Encrypted copies of identity fields are stored separately.

Purposes and legal bases (outline)

Clubs typically process member data to run the association (membership contract, Art. 6(1)(b)), to keep legally required records, and — for health notes and identity documents — under a suitable Art. 9 GDPR condition (often explicit consent, which later product phases will capture). Canopy processes club data as a processor and the global account as a joint controller for authentication, support, and platform security (Art. 6(1)(b) and (f)).

This draft does not replace the club’s own membership privacy information. Ask your club as well as Canopy.

Where data is stored

• Application and database: Railway, EU West (EEA)
• Media (avatars, ID documents, receipts): Amazon S3 in eu-south-2 (Spain), delivered via CloudFront
• Email: Postmark (United States)
• DNS for canopy-os.com: Amazon Route 53
• Error monitoring: Sentry in the EU (Frankfurt)
• Optional ID-document prefill: Scaleway Generative APIs in Paris (EEA). The photo is sent for a one-shot read and is not stored by Canopy for that step. Keeping a copy of the ID is a separate consent. Staff see a notice before scanning and must tell you first; your acknowledgement is recorded with your enrollment.
• In-app assistant (Canopy AI): Scaleway Generative APIs in Paris (EEA). Staff questions and the query results used to answer them are processed in the EEA. Results may include membership card numbers and aggregated visit or purchase facts. Encrypted member PII, ID photos, and signatures are not sent.
• Product suggestions: Scaleway Generative APIs in Paris (EEA). Staff type a product description and the model returns suggested catalog fields. Photos are not sent.

International transfers

Sentry (Functional Software, Inc., United States) processes stack traces, request paths, and anonymous staff/member IDs for reliability. Event storage is configured in the EU (Frankfurt). Transfers rely on Sentry’s DPA and Standard Contractual Clauses (or equivalent). Names, emails, and request bodies are stripped before events are sent.

Postmark (ActiveCampaign, LLC, United States) sends transactional email, including the recipient address and message content. Those transfers rely on Postmark’s data processing terms and Standard Contractual Clauses (or equivalent).

AWS and Railway process the other services listed above in the EEA; they are US-headquartered vendors. Canopy will document SCCs / Data Privacy Framework coverage in the signed DPA.

Retention

Clubs decide how long membership and accounting records are kept, subject to law. Global accounts remain until you delete them in the member portal or a club asks us to erase what we hold as processor. Database backups (including point-in-time recovery) can retain a copy for a limited window after erasure. ID images and audit IPs should not be kept longer than needed; specific periods will be set with counsel.

Your rights

You may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent where processing is based on consent, without affecting prior lawful processing. You may complain to the AEPD (https://www.aepd.es) or your local EEA supervisory authority.

The member portal can delete the global account and anonymize enrollments (sales stay in the shop’s books without your name). A structured download of your data will follow in a later product phase; until then, email privacy@canopy-os.com or ask the club.

Cookies

See the Cookie policy. We currently use only what we consider strictly necessary for login, language, and display preferences. There is no advertising tracker.

Changes

We will update this page and the version stamp when the text changes. Material changes after this draft is approved may require a new acknowledgement.