Privacy Policy

Holden Leads publishes a business-to-business database of licensed cannabis dispensaries, compiled from official state regulator records. This policy explains what we collect from visitors to holdenleads.com and from people who hold an account.

For any question about this policy or to exercise a right described below, email [email protected].

When you view a page we record the page you viewed, the website that referred you (its domain only — never the full link), any utm_source, utm_medium, or utm_campaign tag in the address, a coarse device type (desktop, mobile, or tablet), and the two-letter country our CDN reports.

We do not use advertising trackers, analytics from third-party providers, social media pixels, session recording, or any form of cross-site tracking. Your IP address is never stored, and your full user-agent string is never stored.

To tell roughly how many people visited rather than how many pages were loaded, we need a way to recognise two page views as belonging to the same visit. We do this without storing anything on your device and without keeping anything that identifies you.

Each day we generate a secret random value — a "salt" — that never leaves our server. When you load a page we combine that day's salt with your IP address and your browser's user-agent string, run the result through a one-way cryptographic hash, and store only the first 16 bytes of the output. The IP address itself is discarded immediately and is never written to a database or a log file.

The salt changes at midnight UTC, and we delete each salt within four days. Once a salt is deleted the corresponding hashes cannot be reversed or re-derived by anyone — including us — even if we knew which IP address to test. In practice this means we cannot follow you from one day to the next: on our side you are a new visitor each day. The one exception is described under "Your rights" below — signing up or starting a checkout links that day's activity to your account.

We rely on our legitimate interest in understanding which pages are useful in order to process this data. Because we set no identifier on your device for this purpose, no consent prompt is required.

We use no advertising, analytics, or tracking cookies of any kind.

Two cookies are set by our sign-in system for every visitor, whether or not you have an account, because they protect the sign-in form itself:

• next-auth.csrf-token — a security token that prevents a third-party site from submitting our forms on your behalf.
• next-auth.callback-url — remembers which page to return you to after signing in.

If you sign in, a third cookie (next-auth.session-token) keeps you signed in. All three are strictly necessary for the site to function, expire when you close your browser or sign out, and cannot be read by JavaScript.

Paying by card takes you to Stripe's own checkout page. Stripe sets its own cookies there, on Stripe's domain, under Stripe's privacy policy — not ours.

If you create an account we store your name, email address, and a cryptographic hash of your password — never the password itself. If you buy access we also store your Stripe customer reference, which plan you hold, your purchase and subscription history, and a record of the exports you download.

If you contact support we keep your message and our replies so we can follow up.

Card numbers never reach our servers. Payments are processed entirely by Stripe.

We keep the number of third parties deliberately small:

• Cloudflare — content delivery and protection against attacks; sees requests in transit.
• DigitalOcean — hosting for our servers and database, located in the United States.
• Stripe — payment processing and billing.
• Our email provider — delivery of support and account email.

We do not sell, rent, or share visitor analytics data with anyone.

Individual page-view records are deleted automatically after 90 days by a scheduled job. What remains after that is an anonymous daily summary — counts per page, per day — with no visitor identifier at all. Daily salts are deleted within four days.

Account information is kept while your account exists. Records of completed purchases are kept longer where tax and accounting rules require it.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it. Email [email protected] and we will respond.

For ordinary browsing we hold nothing that identifies you, so there is no browsing history attached to your name to produce or delete. There is one exception, and we would rather spell it out than let the sentence above imply more than it should: on a day when you create an account or begin a checkout, we store that action alongside both your account and the day's visitor hash, so we can see which page you first landed on that day. That link lasts as long as the page-view records do — 90 days — and only covers the day you signed up or paid. We use it to understand which pages lead to sign-ups, and you can ask us to delete it.

The dispensary records we publish and sell are business contact details for licensed cannabis retailers across 10 states, compiled from public records published by state cannabis regulators and from businesses' own public listings. This is information about businesses, though it can include the name and business contact details of an owner where the regulator publishes them.

If you are named in our database and want your details corrected or removed, email [email protected] with the business name and we will handle it.

This is a business service for licensed cannabis operators and their suppliers. It is not directed at anyone under 21, and we do not knowingly collect information from children.

If we change what we collect or how we use it, we will update this page and the date at the top. Material changes will be announced to account holders by email.