Privacy notice

Version 2026-09-10.

Raiden Investments LLC operates Waputu. This notice explains how we handle information for the website, signup process and customer workspaces. Contact help@waputu.com for privacy questions or requests.

Information we process

We process account email, name and organization details; verification and account-recovery records; roles and facility permissions; connected inventory and traceability records; customer-entered product and label facts; QR destinations; saved jobs, outcomes, print-download events and audit records. Security and service records may include IP addresses, timestamps, request identifiers, errors and device or browser information supplied with requests. Support messages contain information you choose to send. Passwords and authentication sessions are handled through our authentication provider. Stored state-connection tokens are encrypted; that protection does not make an authorized connected account risk-free.

Sources and purposes

Information comes from you and your authorized users, the connected state system, and normal operation of the website and service. We use it to verify accounts, prepare workspaces, enforce access, retrieve and process authorized records, create labels, transmit instructed actions, reconcile uncertain outcomes, support users, investigate problems, protect the service and meet legal obligations. Customer organizations determine which records and users belong in their workspaces. We also process account and security information for our own service administration.

We do not need patient medical histories, government identity documents or payment-card numbers for the current inventory and labeling workflows. Do not send them through product fields or support unless we have expressly arranged an appropriate supported process. Labels, QR links and exported files can expose information to people outside your workspace when you share or print them.

Service providers and disclosures

Supabase provides database and authentication services, and Vercel hosts the application. Email delivery may use an enabled provider such as Resend. Authorized requests and required data go to NMS2S or another integration you configure. These providers process information needed for their services. Authorized Company personnel and contractors may access relevant records for support, maintenance, security and lawful operations, subject to appropriate restrictions.

We may disclose information when reasonably necessary to comply with law or valid legal process, protect rights and safety, investigate abuse, or carry out a business transfer with appropriate safeguards. We do not sell customer content or disclose it to third parties for their targeted advertising. Customer content is not licensed by these terms for unrelated model training. If we introduce a materially different use or optional integration, we will give the notice and obtain consent required by law.

Cookies and storage

The service uses session cookies and related browser storage for sign-in, security and the operation of requested features. Blocking required cookies may prevent login or other functions. This notice does not describe an advertising-cookie program. If optional tracking is introduced, we will provide applicable notice and choices before using it where required.

Retention and account closure

We retain information for the time reasonably needed to provide the service, maintain job and audit integrity, address disputes, protect security and meet legal obligations. Retention depends on the data type, account status, applicable requirements and backup cycles; there is no blanket promise of immediate deletion or a fixed seven-year archive. Deleted active records may remain in backups until the relevant backup cycle expires, with access restricted. Legal holds and required records may be retained longer.

Workspace owners may request closure and an export of available customer records under the Service terms. Verify your own required business-record retention and keep appropriate independent copies. We cannot delete or change a record already submitted to a state system, remove a printed label, or control a third-party QR destination on your behalf merely by closing Waputu access.

Your choices and requests

Owners can manage team access and facility permissions. Users may request access, correction, deletion or other applicable privacy rights by emailing help@waputu.com. We may verify your identity and authority, coordinate with the customer organization that controls the workspace and retain information where the law or legitimate security and recordkeeping needs permit or require it. Rights and exceptions vary by jurisdiction. We will respond within the period required by applicable law; we do not require you to waive lawful rights to make a request.

Security and location of processing

We use access controls and technical safeguards appropriate to the service, but no system or transmission can be guaranteed secure. Protect your accounts, use required multi-factor authentication and promptly report suspected compromise. We will provide notices of a security incident as required by applicable law. Providers may process data in the United States and other locations where they operate; this notice does not promise a particular geographic residency or a certification that has not been separately agreed.

Business users and updates

The service is intended for authorized adult business users, not children or a consumer cannabis marketplace. If you believe a child has supplied personal information, contact us. We may update this notice as the service changes. We will identify the revised version and provide additional notice or choices for material changes when required. Privacy commitments are not overridden by a general warranty disclaimer in the Service terms.

Operator: Raiden Investments LLC. Privacy contact: help@waputu.com.