Privacy Policy

Last Updated: April 23rd, 2026
‍
This Privacy Policy explains how Distru Corp. (“Distru,” “we,” “us,” or “our”) collects, uses, shares, stores and protects personal information about you when you visit www.distru.com (the “Site”), signup for, access or use our products and services, including our platform and any mobile applications (together with the Site, the “Services”), and in other settings where we reference this Privacy Policy. It also describes your choices and your privacy rights under applicable law.For purposes of this Privacy Policy, “personal information” means information that identifies, relates to, describes, or could reasonably be linked to you.This Privacy Policy applies to visitors to the Site, prospective business customers who engage with our sales and marketing, users of the Distru software services platform and related applications (“B2B Accounts”). In the event of any conflict between this Privacy Policy and a data processing addendum governing use of the B2B Account, the data processing addendum shall prevail.  Please read this policy carefully. By using our Services, you acknowledge that you have read and understood this Privacy Policy. We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and, where appropriate, notify you by email or through the Services. We encourage you to review this policy periodically. Your continued use of our Services after changes are posted constitutes acknowledgment of the updated policy. For questions or privacy requests, contact us at hello@distru.com.  

‍1. Personal Information We Collect and SourcesA. Information You Provide Directly

‍We collect personal information you give us when you (or your business) create an account, contact customer service, or otherwise interact with us. This includes

:Business or Commercial Data: data about your company (if applicable), including phone number, web site, transaction information, payment information, product information, financial account data, delivery instructions, and licensing information.

‍Identifiers: name, email address, date of birth, address, phone number, company name and title, security information for authentication and access (including login information for customer integrations (such as cannabis track-and-trace systems (e.g., Metrc) (“Customer Integrations”)), government issued identifications for compliance and verification and other unique identifiers. 

‍Communications: messages you send us by email, phone, chat, or publicly post on discussion rooms, message boards or other online forums  or through our customer support platform and sign up information relating to our newsletters, promotional campaigns or to receive other marketing or informational materials via email, text message, push notifications or other media. Where consistent with applicable law we record and store telephone calls and chat transcripts for a period of time when you interact with our customer or technical support personnel, or if you provide us feedback about our Services.

Sensitive personal information: we may collect information from you that is deemed “sensitive” information under applicable law. We treat this information with heightened care. See Section 5 for more details.

‍Marketing preferences: email and SMS opt-in status and communication preferences.

‍Careers: If you decide that you wish to apply for a job with us, you may submit your contact information and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience.

‍B. Information Collected Automatically or Inferred When you visit our Services, we and our service providers collect information about or derive information from your activity on the Services, such as:

‍Device and browser data: IP address (used to approximate general location), device type, operating system, browser type and version

‍Usage data: time spent on the Services, login timestamps, search queries, actions taken, errors

‍Geolocation data: we may collect the physical location of your device and use your device’s physical location to provide you with location-based services. In some instances, you may be permitted to limit or deny such collection and/or uses, and if you do, it may limit your access to personalized services and content.

‍Inferences: we and our service providers may derive inferences about your preferences from your browsing behavior or other engagement with the Services. 

‍Cookie and tracking data: cookies and data collected through the advertising and analytics technologies described in Sections 4 and 6

‍C. Information Collected from Third Parties In addition to collecting as described above we may obtain personal information from the following sources:From our service providers From advertising and analytics partners From referrals partners From public sourcesCustomer Integrations (e.g., Metrc). We may combine information received from third parties with personal information we have about you. In addition, some personal information processed through our Services is submitted by or collected on behalf of our business customers pursuant to their instructions and applicable services agreements. For such data, we act as a data processor and our customers are the responsible data controllers. Our data processing addendum governs the processing of that data and controls in the event of any conflict with this Privacy Policy. This includes data processed on behalf of customers where applicable law or regulatory requirements may govern retention, access, and deletion of certain records.

‍2. How We Use Your Personal Information We use the personal information we collect for the following business purposes:Provide and operate the ServicesMaintain and improve the ServicesProvide customer support and respond to your inquiries and otherwise communicate with you regarding the ServicesConduct sales, marketing, and product testing and researchDe-identify and aggregate information collected through the Services and use it for any lawful purposeComply with legal obligations, prevent fraud, maintain the safety and security of our ServicesFulfill any other purpose for which you provide your personal information or as explained to you at the point of information collectionEnforce our agreements, resolve disputes and protect our legal rights, property, privacy, legitimate interests and the interests of others

‍Use of AI Tools. We may use automated tools, including artificial intelligence and machine learning technologies, to help us provide, maintain, and improve our products and services. These tools may be used for purposes such as customer support, fraud prevention, analytics, and improving our Services.When we use third-party service providers to process personal information through artificial intelligence technologies, we require those providers to process personal information on our behalf in accordance with applicable law and our contractual obligations.We do not use automated processing in a manner that produces legal or similarly significant effects about you without appropriate safeguards where required by law.We do not use sensitive personal information for purposes such as targeted advertising or profiling through automated tools, except as permitted by applicable law and as described in this Privacy Policy.

‍3. How We Share Your Personal InformationWe share your personal information only in the following circumstances:

‍Affiliates: We may share personal information with our current and future parent and subsidiary companies and other affiliated companies under common control and ownership for any of the purposes described in this Privacy Policy.

‍Service Providers: We share your personal information with companies that help us operate our business (such as cloud hosting and email communication vendors). When you make a purchase through the Services, a third party payment provider may receive your payment card or banking information. Service providers may share Personal Information with sub-processors.

‍Analytics and Advertising Partners: We may share certain data with advertising and measurement partners. The information shared with these partners may include identifiers and commercial information. These partners may use this information to provide advertising and analytics services, including by matching it with information they already have and this processing may constitute “sharing” personal information for cross-context behavioral advertising or a “sale” or processing for “targeted advertising” under applicable law. See Section 4 for more details. 

‍Legal and Safety Disclosures: We may disclose your personal information if required by law, subpoena, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights or the safety of others.

‍Business Transfers: We may disclose and transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our business or assets.

‍With Your Consent: We may share your personal information for other purposes with your explicit consent. 

‍User Submissions: The Services may allow you to publish or display certain information on public areas of the Services (for example on message boards, discussion rooms, online forums). Information you post on such areas of the Services will automatically be available to other users. By choosing to use these areas, you understand and agree that anyone can access, use, and disclose any information that you post to those areas.We do not sell your personal information for monetary consideration. 

‍4. Advertising Technologies and Third-Party Tracking We work with third-party partners that collect or process information about your interactions with our Services through technologies such as cookies, pixels, and server-side integrations. See Section 6 for more information on the tracking technologies used on the Services. Where consistent with applicable law our partners may also collect information about your use of other websites, apps, and online resources.  The information collected includes device identifiers, commercial information (such as purchase activity), IP addresses, browsing behavior, inferences, and other data described in Section 1. Information collected is used to provide advertising or analytics services. For example, we use Google Analytics to collect and process certain analytics data. Disclosure to third party partners in these cases may be considered “sharing” of personal information for cross-context behavioral advertising or “targeted advertising” under applicable law. Ads are displayed on the platforms that we own or operate but we also use third-party ad partners to display ads for Distru on third party websites and apps (sometimes referred to as “retargeting”). The categories of third parties we work with may change over time. By using our Services, you acknowledge and consent to the collection, monitoring, recording, and sharing of your interactions with our Services as described in this Section.Generally, you can control the interest-based ads you see as a result of retargeting by changing the privacy settings of the device itself or changing the privacy settings of your browser. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work. You can opt out of targeted advertising by visiting the Digital Advertising Alliance’s opt-out portal at: http://optout.aboutads.info/. You can learn about Google’s practices by going to https://www.google.com/policies/privacy/partners/, and opt-out of them by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout. 

‍5. Sensitive Personal Information We may collect certain categories of personal information that are considered “sensitive” under applicable law. This information is primarily used to verify eligibility for or secure the Services or for compliance purposes or in connection with a Customer Integratoin. We collect and use sensitive personal information only where necessary for the purposes described in this Privacy Policy, where reasonably necessary and proportionate to provide and/or operate our products and services, and, where required by law, with your consent. We do not use sensitive personal information for targeted advertising or profiling, and we do not sell such information. We limit access to sensitive personal information to authorized personnel and apply additional safeguards appropriate to its nature.Where applicable, you may have the right to request access to or deletion of your sensitive personal information, to limit certain uses, or to withdraw your consent. 

‍6. Cookies and Tracking Technologies We and our third party partners use cookies, pixels, web beacons, session replay and similar tracking technologies on our Services. We may use both first-party tracking technologies, which are set by us, and third-party tracking technologies, which are set by our partners. Tracking technologies monitor, record and/or analyze how users interact with our Services (including in real time), such as information about pages visited, navigation paths, scrolling, and general interaction patterns.. We may allow our analytics, advertising, and service providers to collect information directly from your browser or device on our behalf, or to receive information from our systems (including through server-side integrations), including as you interact with our Services. Some of the tracking technologies we use may last solely for your browsing session and are deleted when you close your browser, while others are persistent and stored after you close your browser. By using the Services you consent to the use of such technologies, including cookies, geolocation, screen capture technology and pixel tags, to collect information about you.

‍The cookies we use typically fall into one of the following categories:Strictly necessary cookies: Required for core Services functionality (e.g., maintaining session state or security). These cannot be disabled without affecting your ability to use the Services.

‍Analytics cookies: Help us understand how visitors use our Services. If you do not allow these cookies we will not know when you have visited our Services, and will not be able to monitor its performance.

‍Performance cookies: These cookies enable the Services to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

‍Marketing and advertising cookies/pixels: Used to measure advertising performance and, where applicable, to reach relevant audiences. If you do not allow these cookies, you will experience less targeted advertising.

‍Types of Data. Categories of information we may collect through tracking technologies include IP Address, location, operating system, device data, browser type, browser history, pages viewed and other data about your interaction with the Services. Data collected through tracking technologies may be collected by or disclosed to Distru’s analytics providers, security providers, and other technology and business partners. 

Use of Data. We use cookies for a number of reasons, including to operate, maintain, improve, and secure our Services and for communication, marketing and analytics purposes. 

‍Managing your cookie choices. You have options to control or limit how we and our partners use cookies and other tracking technologies. Although most browsers and devices accept cookies by default, their settings usually allow you to clear or decline cookies. Disabling certain cookies may affect Services functionality. In some cases law requires us to obtain your consent before using non-essential tracking technologies.You can learn more about targeted advertising and opt out of interest-based advertising from participating companies through:The Network Advertising Initiative (NAI): https://optout.networkadvertising.orgThe Digital Advertising Alliance (DAA): https://optout.aboutads.info

‍Global Privacy Control (GPC). We honor the Global Privacy Control signal. If your browser or device sends a GPC signal when visiting our Services, we will treat it as a valid opt-out of the sale and sharing of your personal information for targeted advertising, consistent with applicable state privacy laws that recognize universal opt-out mechanisms.

‍Do Not Track. We do not currently respond to browser-level “Do Not Track” signals, as there is no uniform technical standard for interpreting them. We do honor GPC signals as described above.

‍7. Data Retention We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy and to satisfy legal, accounting, or reporting obligations, resolve disputes, enforce our agreements, prevent fraud, and maintain security. This may include retaining information for a reasonable period after you stop using our Services to the extent permitted or required in accordance with applicable law. For example, to the extent required by California law, we retain certain records processed through our Services in connection with cannabis regulatory compliance for a period of seven (7) years. What this means in practice will vary between different types of information, and when we consider our approach, we take into account ongoing business or legal needs for the information. When personal information is no longer needed, we delete or anonymize it consistent with our internal data management practices. 

‍8. Your Privacy Rights Depending on where you live, you may have rights regarding your personal information. To exercise any of these rights, email hello@distru.com with your name, email address, and the right you wish to exercise or otherwise contact us as set forth the “Contact Us” Section of this Policy. We will not discriminate against you for exercising your privacy rights.

‍Response to Requests and Identity Verification. Requests to exercise data protection rights will be assessed on a case-by-case basis. There may be situations where we are not legally required to comply with the request because of exemptions provided for in data protection legislation. To protect your privacy and maintain security and comply with law, we take steps to verify your identity before responding to your request or granting you access to your personal information. If we cannot verify your identity or your authority to make the request, we may be unable to fulfill it. We will respond to your request within the timeframes required by applicable law (generally within 45 days, with an extension where permitted).

‍Authorized Agents. You may designate an authorized agent to submit a privacy rights request on your behalf. To do so, please provide written authorization signed by you, or a valid power of attorney. We may verify the identity of both you and your authorized agent before processing the request. We may deny a request from an agent who cannot provide sufficient proof of authorization.

‍Rights Available to All UsersConfirm: Request confirmation of whether we are processing your personal information

‍Access: Request a copy of the personal information we hold about you

‍Correction: Request correction of inaccurate information

‍Deletion: Request that we delete your personal information

‍Opt out of marketing: Click “Unsubscribe” in any email, or reply STOP to any SMS

‍California Residents As a California resident, you have the following rights:

‍Right to know: Request disclosure of the categories and specific pieces of personal information we have collected, including the categories of personal information, sources of collection, purposes of use, and categories of third parties with whom it is shared

‍Right to delete: Request deletion of your personal information (subject to certain legal exceptions)

‍Right to correct: Request correction of inaccurate personal information

‍Right to opt out of sale/sharing: Opt out of the sale of your personal information and the sharing of your personal information for cross-context behavioral advertising 

‍Right to limit use of sensitive personal information: Request that we limit use of sensitive personal information to what is necessary to provide the services you requested

‍Right to data portability: Receive your personal information in a portable, machine-readable format

‍Right to non-discrimination: We will not deny you goods or services or charge you different prices because you exercised your privacy rightsThe disclosures in this Privacy Policy describe our practices with respect to the categories of personal information we collect and the categories of sources we collect from (Section 1), the categories of third parties to which we disclose personal information (Section 3), and the business purposes of our processing (Section 2). The categories of personal information we collect may include: Identifiers (such as device identifiers, contact information), Additional Data Subject to Cal. Civ. Code § 1798.80, Protected Classifications, Commercial Information, Geolocation data Employment Information, Sensitive Information, Online Activity, and  Inferences.During the prior 12-month period, we have collected the following categories of personal information, and for some of these categories, we may disclose such information or “sell” or “share” (as such terms are defined in California law) for marketing and advertising purposes to third-party advertising networks and social media platforms:

‍Category of Personal InformationDiscloseSell or ShareCategory of Third Party Sold To/Shared With

‍Identifiers (such as device identifiers, contact information)YesYesAdvertising networks, data analytics providersAdditional Data Subject to Cal. Civ. Code § 1798.80YesNoN.A.Protected ClassificationsYesNoN.A.Commercial InformationYesYesAdvertising networks, data analytics providersAudio, electronic, visual or similar informationYesNoN.A.Geolocation dataNoNoN.A.Employment InformationYesNoN.A.Online ActivityYesYesAdvertising networks, data analytics providersInferencesYesNo N.A.Additionally, we may disclose personal information to third parties as necessary to comply with law, respond to legal claims, enforce our contracts, or protect the rights, property, or personal safety of Distru, our employees, customers or users, or the public. Distru does not use or disclose sensitive personal information or sensitive data, as defined in applicable laws, for any purposes other than those permitted by applicable law.You have the right to opt out of any disclosure of your information which may be considered a “sale” or “sharing” under California law. If you would like to opt out of the sale or sharing of your personal information, email us at hello@distru.com or contact us as set forth in Section 16 below. We do not sell your personal information in exchange for monetary consideration without your consent.

‍California Shine the Light (Civil Code § 1798.83): If you are a California resident with an established business relationship with us, you may request information once per calendar year about whether we have disclosed personal information to any third parties for their direct marketing purposes during the immediately preceding calendar year and identity of those third parties . To make such a request, email hello@distru.com with “Shine the Light Request” in the subject line.

‍Residents of States with Comprehensive Privacy Laws In addition to California, a growing number of U.S. states have enacted comprehensive consumer privacy laws, including but not limited to Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. If you reside in a state with an applicable consumer privacy law, you generally have the right to:Access the personal information we hold about youCorrect inaccurate personal informationDelete personal informationOpt out of targeted advertising, profiling, and the sale of personal information (where applicable)Receive a portable copy of your personal informationAppeal a denial of your privacy rights request — respond to our denial notice or email hello@distru.com with “Privacy Rights Appeal” in the subject line.The specific rights available to you, and any exceptions, depend on the laws of your state of residence. To submit a request, contact us as set forth in Section 16 with your state of residence noted.

‍Oregon residents Under the Oregon Consumer Privacy Act, Oregon residents have the right to request a list of the specific third parties to whom we have disclosed your personal information. To make this request, email hello@distru.com with “Oregon Third-Party List Request” in the subject line.

‍Nevada Residents We do not sell covered personal information as defined under Nevada Revised Statutes Chapter 603A. For questions, email hello@distru.com with “Nevada Privacy Request” in the subject line.

‍Washington Residents Washington residents have specific rights under the My Health My Data Act (“MHMD”), including the right to confirm whether we hold your consumer health data, to access it, and to request deletion. Under MHMD, you have the right to confirm whether we are collecting, sharing, or selling your consumer health data, access your consumer health data, request deletion of your consumer health data, and withdraw consent. You may exercise these rights using the contact methods described in this Policy. We obtain your consent before collecting or sharing consumer health data where required by law.

‍Excessive or Manifestly Unfounded Requests If a privacy rights request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee to cover administrative costs, or we may decline to act on the request, as permitted by applicable law. We will notify you of our reasons in either case. 

‍9. Notice of Financial Incentives We may offer incentives — such as discounts, credits, or other rewards — to business customers or their representatives in connection with referral programs, beta participation, or similar programs that involve the collection or use of personal information. You may opt out of any such program at any time by contacting us at hello@distru.com without affecting your access to our Services.We estimate the value of personal information collected through these programs based on the return on investment or incremental margin generated by us from administering financial incentives and from the processing of your personal information. You may contact us to request our current estimate.

‍10. Data Security We use administrative, technical, and physical security measures to protect your personal information, including encryption of data in transit and at rest, and access controls limiting who can access your data within our organization. No method of internet transmission or electronic storage is completely secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law. 

‍11. SMS and Text Message Marketing If you provide your mobile phone number and consent to receive SMS marketing from Distru, you agree to receive recurring promotional text messages. Message frequency varies. Message and data rates may apply.

‍To opt out: Reply STOP to any message

‍For help: Reply HELP or email hello@distru.comWe use service providers to send text messages on our behalf. Your phone number and messaging interaction data (such as delivery status) may be processed by these providers solely to provide messaging services to us. We do not sell or share your mobile phone number with third parties for their own marketing purposes. You agree to notify us of any changes to your mobile number and update your account to reflect this change.

‍12. Social Media We maintain a presence on various social media platforms. When you interact with our social media accounts — for example, by commenting on a post, sending us a direct message, or tagging us — the social media platform may provide us with certain information about you, such as your name, username, and the content of your interaction. Any information you post or share on a social media platform is governed by that platform’s privacy policy. Personal information we receive through our social media accounts will be processed in accordance with this Privacy Policy.

‍13. External Links Our Services may contain links to third-party websites that are not controlled by us. We are not responsible for the privacy practices of those websites. We encourage you to review the privacy policies of any third-party site you visit. 

‍14. Children’s Privacy Our Services are not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete it promptly. If you believe a child has provided information to us, contact hello@distru.com.

‍15. Visitors Outside the United States Our Services are hosted in the United States and we process and store the information we collect from you, regardless of your location, in the U.S. If you are based outside the U.S., we transfer your personal information to, and process your personal information on, servers located in the U.S., a jurisdiction that may not provide equivalent levels of data protection as your home jurisdiction. Your personal information may also be transferred to, stored and processed in the U.S. or other jurisdictions where the third parties are located or from which the third parties provide us services. Such transfers and processing of your personal information are necessary to provide our Services. By submitting your personal information to us, you understand and consent to the transfer of such information as described above. 

‍16. Contact UsIf you would like to exercise any rights pertaining to personal information we collect from you, register a complaint, or simply want more information, you can contact us by emailing us at hello@distru.com or writing to us at the below address.Distru Corp. Attn: Privacy Compliance Officer 2044 Franklin St, Oakland CA 94612 If you require this Privacy Policy in an alternative format due to a disability, please contact us through one of the above methods.

‍
Revision HistoryRevisionDateDescription
‍1.0 November 12, 2019

2.0 April 23, 2026 Revision to align with evolving privacy and CIPA standards