Privacy Policy | Mary Jane OS

1. Introduction

Mary Jane OS ("MJOS", "we", "us", "our") is a cannabis operations management platform operated by The Green Truth NYC Inc. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application at mjos.app and maryjaneos.com and our mobile app. Section 4 explains exactly what we do with data from your Google account.

2. Information We Collect

We may collect the following types of information:

Account Information: Name, email address, and profile picture, provided when you sign up or through Sign in with Google.
Google Services Data: If you choose to connect your Google account, we use Gmail (to send only), Google Calendar, Google Tasks, and Google Drive files you pick, only to provide the features described in Section 4.
Business Data: Sales orders, account information, delivery routes, inventory data, and team activity that you enter into the platform.
Usage Data: Basic analytics about how you interact with the application.

3. How We Use Your Information

To provide, operate, and maintain the MJOS platform
To authenticate your identity and manage your account
To send email from your own Gmail address when you send it from MJOS
To show and create pop-up and activation bookings on the Google Calendar you choose
To keep MJOS tasks in sync with your "MJOS Tasks" list in Google Tasks
To open Google Drive files you pick, for example to attach them to an email
To improve and personalize your experience

Data we receive from Google is used only as described in Section 4.

4. Google User Data

MJOS connects to Google in two separate ways, and each one is your choice:

Sign in with Google. Uses your Google name, email address, and profile picture (the openid, email, and profile permissions) to create your MJOS login and sign you in. Nothing else.
Connect Google. An optional connection you start from Settings in MJOS. It asks Google for permission to send email from your Gmail address, see your list of calendars, view and create events on your calendars, manage your Google Tasks, and open the specific Google Drive files you pick. What we do with each is below.

4.1 Gmail

What we access and why. MJOS only sends email from your own Gmail address, when you send something from MJOS: a message you compose, an invoice to a store, or a payment reminder. MJOS builds the message and hands it to Gmail to send, and only when you tell it to. MJOS cannot read, list, or search your inbox or any message you receive.
What we store. MJOS keeps its own record of each email you send through it, in your email log: recipients, subject, the message body MJOS built, the send time, whether it went out, and Gmail's message ID. If open and click tracking is on for that email, we also record when a recipient opens it or clicks a link (time, IP address, and browser or device details). Attachments are not kept. We store nothing from your inbox or from messages you receive.
Who can see it. Sent-email records are business records of your company's MJOS workspace, visible to people in that workspace who can see email history.

4.2 Google Calendar

What we access and why. MJOS reads your list of calendars so you can pick the one that holds your pop-ups and activations. It reads the events on that calendar to show your bookings in MJOS, and it creates events when you book a pop-up or activation, inviting the attendees you choose (such as the assigned rep). Google sends those invitations.
What we store. The ID of the calendar you or your workspace picked, and the Google event IDs of bookings, linked to the MJOS records they belong to (for example a pop-up's checklist). Event details are read from Google when you view them and are not copied into our database. Booking details you type into MJOS are stored as MJOS records.
Who can see it. Events are shown to you. Bookings you create in MJOS are visible to your company's MJOS workspace, and the Google events are visible to whoever can see that calendar in Google.

4.3 Google Tasks

What we access and why. MJOS keeps its tasks in two-way sync with a single list in your Google Tasks called "MJOS Tasks", which MJOS creates if it does not exist. Tasks in your other lists are not synced.
What we store. For tasks in that list: title, notes, status, due date, and Google's task and list IDs, saved as MJOS tasks assigned to you.
Who can see it. You, and people in your company's MJOS workspace who can see tasks.

4.4 Google Drive

What we access and why. MJOS can open only the Drive files you pick with Google's file picker, and files MJOS itself created in your Drive, for example to attach a file to an email or share its link. MJOS cannot browse or search the rest of your Drive. A file is read only when you pick or attach it.
What we store. The IDs and names of files you pick, where MJOS needs to remember them. Attached files go out with your email and are not kept by MJOS. We do not copy your Drive files into our database.
Who can see it. A file you pick is shown to you, and to the people you send it to or share its link with.
Company Drive (separate). A company can also connect its own company Google Drive to MJOS, at the organization level, to power its brand media and content library. That connection is set up by the company's admin with the company's own Google credentials, not through Connect Google. Files in the folders the company links are shown to its MJOS workspace and, in the store portal's Media tab, to the stores and brand partners it works with.

4.5 Limited Use

Mary Jane OS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our use of Google Workspace data also follows the Google Workspace API User Data and Developer Policy.

4.6 What we never do with Google user data

We use it only to provide and improve the user-facing features described above.
We do not sell it, and we do not use it for advertising, including retargeting or personalized or interest-based ads.
We do not use it to determine credit-worthiness or for lending.
We do not use it to develop, improve, or train generalized AI or machine-learning models, and we do not transfer it to third-party AI tools.
We do not include it, or anything derived from it, in the aggregated or de-identified datasets described in Section 6.
We transfer it to others only as needed to provide the features above (through the service providers listed in Section 6), to comply with the law, to protect against security threats or abuse, or as part of a merger, acquisition, or sale of assets, only after notifying you and getting your explicit consent.

4.7 Human access

No person at MJOS reads your Google user data, unless: you give us permission for specific items or files (for example, when you ask for support); it is needed for security purposes, such as investigating abuse or a bug; it is needed to comply with the law; or the data has been aggregated and anonymized and is used for our internal operations, as Google's policy allows.

4.8 Keeping and deleting Google user data

Disconnecting. You can disconnect Google at any time in Settings in MJOS. We then delete your stored Google tokens and revoke MJOS's access with Google, and MJOS stops using your Gmail, Calendar, Tasks, and Drive. You can also remove MJOS's access at myaccount.google.com/permissions.
Records already made. Sent-email records, synced tasks, and booking links are part of your company's business records in MJOS. They stay until they are deleted in MJOS, your company's workspace is closed, or you ask us to delete them.
Asking us to delete. Email omar@thegreentruthnyc.com from the address on your MJOS account. We delete your Google tokens and the Google-derived records described in this section within 30 days, and confirm when it is done.

5. Data Storage & Security

Your data is stored with Supabase, our database provider, on Amazon Web Services in the United States (us-east-2), with row-level security policies that limit each company to its own data. The MJOS web app runs on Google Cloud (Firebase App Hosting). All data moves over encrypted connections (TLS), and our providers encrypt stored data at rest.

Google OAuth tokens are kept only on our servers, in a table that no signed-in user can read, and are never sent to your browser or phone. Only MJOS's server-side service can use them, and only to perform the features in Section 4. Access to production systems is limited to the people who run MJOS and only as needed.

6. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We share data with service providers who help us operate the platform, only as necessary to provide our services:

Supabase (database, hosted on Amazon Web Services in the United States)
Google Cloud / Firebase App Hosting (web hosting and servers)
Resend (delivery of emails MJOS sends from its own address, such as notifications, and of emails you send when your Gmail is not connected)

Aggregated and de-identified data. We combine business data across customers into aggregated, de-identified datasets, and we may use, publish, and sell insights derived from them — for example category trends, pricing benchmarks, and market share reporting. These datasets never identify you, your business, your customers, or your individual transactions. This does not apply to personal information, or to mobile numbers and SMS consent data, which are never shared or sold. It also does not apply to Google user data: data received from Google APIs, and anything derived from it, is never included in these datasets and is never sold. See Section 5 of our Terms of Service.

Text messages. Mobile phone numbers and SMS opt-in consent collected on the Platform are used only to send the account and order notifications you have agreed to receive. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

6a. SMS Notifications

Mary Jane OS can send account and order notifications by text message: order confirmations and delivery updates, requests to approve a quote or order, invoice and payment reminders, payment receipts, visit and appointment reminders, sign-in links and security codes, account alerts, and (for staff) assignment and schedule alerts and work messages from their team. We never send marketing or promotional texts. You receive these only after opting in: by ticking the unchecked text-updates box when you set up your store's account, by turning on texts on your store's Account page, or (for staff) under Text notifications in Settings. Consent is never required to use the Platform. Message frequency varies with your account activity. Message and data rates may apply. Reply STOP to any message to opt out at any time, and HELP for help, or email omar@thegreentruthnyc.com. Carriers are not liable for delayed or undelivered messages. Full details: mjos.app/sms.

7. Your Rights

Access, update, or delete your personal information
Disconnect Google services at any time
Request a copy of your data
Revoke app permissions through your Google Account settings

To make a request, email us at the address below. We respond within 30 days.

8. Contact Us

If you have questions about this Privacy Policy, please contact us at: omar@thegreentruthnyc.com

The Green Truth NYC Inc., 22 Wright Ave, Staten Island, NY 10303