Privacy Policy

1. Information We Collect

In the course of our business operations, we collect and process the following categories of information:

• Customer and Business Partner Data: Names, business names, billing and shipping addresses, email addresses, phone numbers, invoice records, payment history, and account balances sourced from QuickBooks Online and internal records.
• Employee and Compliance Data: Employee names, job titles, department assignments, agent registration numbers, training records, background check status, compliance certifications, and other information required by the Massachusetts Cannabis Control Commission ("CCC").
• Operational Data: Inventory records, order history, production logs, and seed-to-sale tracking data as required for state compliance.
• Authentication Data: Usernames, hashed passwords, and session tokens for ERP system access.

2. How We Use Information

We use the information we collect solely for internal business operations, including:

• Generating, tracking, and managing invoices and payments through our ERP system and its QuickBooks Online integration.
• Managing customer accounts, order fulfillment, and wholesale operations.
• Maintaining employee compliance records as required by Massachusetts state cannabis regulations.
• Tracking inventory and production data for seed-to-sale compliance reporting.
• Operating internal communication, task management, and document management systems.

We do not use collected information for advertising, marketing to third parties, or any purpose unrelated to Trifecta Farms business operations.

3. Data Storage

All data processed by the Trifecta Farms ERP system is stored locally on company-owned and company-controlled Windows workstations in a SQLite database. Our data is not stored in cloud-hosted databases or third-party data warehouses.

Physical access to data storage devices is restricted to authorized Trifecta Farms personnel. Backup copies of the database are created on a scheduled basis and stored on company-controlled media.

4. QuickBooks Online Integration

Our ERP system integrates with Intuit QuickBooks Online via the QuickBooks API to facilitate invoicing and payment operations. Through this integration, the application may:

• Read and write customer records in the connected QBO company account.
• Create, read, and update invoices and sales receipts.
• Read and record payment transactions.
• Read product and service item catalogs.

The QBO integration operates exclusively within the single Trifecta Farms QuickBooks company account authorized during the OAuth connection process. We do not access, read, or modify data in any other QuickBooks account. OAuth tokens are securely stored using Windows Data Protection API (DPAPI) encryption on the local machine.

5. Data Sharing

Trifecta Farms does not sell, rent, lease, or otherwise share customer, employee, or business data with third parties for any commercial purpose.

Data may be disclosed only in the following limited circumstances:

• Regulatory Compliance: When required by the Massachusetts Cannabis Control Commission, the Massachusetts Department of Revenue, or other governmental authorities with lawful jurisdiction.
• Legal Obligation: In response to a valid subpoena, court order, or other legally binding request.
• QuickBooks Sync: Customer and invoice data transmitted to Intuit QuickBooks Online through the authorized API connection for the sole purpose of financial record-keeping.

6. Data Retention

We retain business, customer, and employee data for as long as necessary to fulfill our operational, legal, and regulatory obligations. Cannabis cultivation licensees in Massachusetts are required to maintain certain records for specified retention periods as mandated by the CCC.

If you wish to request the deletion of your personal data, please contact us using the information provided below. We will honor deletion requests to the extent permitted by applicable law and our regulatory obligations.

7. Security

We implement reasonable administrative, technical, and physical safeguards to protect information within our systems, including:

• Credential Encryption: Sensitive credentials, including API tokens and OAuth secrets, are encrypted at rest using the Windows Data Protection API (DPAPI) with a Fernet fallback mechanism.
• Transport Security: All communication with external APIs, including QuickBooks Online and METRC, is conducted over HTTPS/TLS.
• Access Control: Role-based access control (RBAC) with four permission tiers (viewer, operator, manager, admin) restricts access to sensitive data and functionality.
• Authentication Protection: Login attempts are rate-limited to 10 per minute per IP address, with automatic account lockout after 5 consecutive failed attempts.
• Security Headers: The web application enforces Content Security Policy, X-Content-Type-Options, and X-Frame-Options headers.

8. Massachusetts Cannabis Compliance

Trifecta Farms LLC operates as a licensed cannabis cultivation facility under Massachusetts Cannabis Control Commission License MC283350. Our data collection and retention practices are designed to comply with the regulations set forth by the CCC, including 935 CMR 500.000, and all applicable Massachusetts state laws governing the adult-use cannabis industry.

Certain data, including seed-to-sale tracking information, employee agent registration records, and compliance documentation, is collected and retained as required by state law and may not be subject to individual deletion requests.

9. Contact Information

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

10. Effective Date

This Privacy Policy is effective as of March 31, 2026. We reserve the right to update this policy at any time. Any material changes will be reflected by an updated effective date on this page.