Privacy Policy

1. Introduction

Budify.uk ("we", "us", "our") operates the Budify.uk website and mobile application. This Privacy Policy explains what data we collect, why we collect it, how long we keep it, and how you can request its deletion. By using our Service you agree to this policy.

2. Data We Collect

2a. Account & Identity Data

• Email address (collected at registration)
• Display name / username (optional, set by you)
• Profile photo (optional, uploaded by you)
• Account role (e.g. "user" or "admin")

2b. Health-Related Data

Because Budify.uk is a platform for UK medical cannabis patients, some features involve health-related information. Specifically:

• Medical symptoms and conditions — when you write a strain review you may optionally disclose symptoms or conditions (e.g. chronic pain, PTSD) that the product helped with. This information is stored as part of your review and may be displayed publicly.
• Product preferences — your likes/dislikes for specific medical cannabis products are stored against an anonymous device identifier.

We do not require you to provide health data. All health-related fields in reviews are optional. If you choose to include them, you are voluntarily making that information public on the platform.

2c. User-Generated Content

• Strain reviews, clinic reviews, ratings, and images you upload
• Poll votes (stored with an anonymous device ID or your email if logged in)
• Favourites and bookmarks
• Contact form messages

2d. Technical & Analytics Data

• Anonymous device/guest identifier stored in your browser's local storage (used to prevent duplicate votes)
• Basic analytics events (e.g. registration event containing email and role) used by the platform to monitor app health
• IP address and browser/device type collected automatically by our hosting infrastructure

3. How We Use Your Data

• To create and manage your account
• To display your reviews and content on the platform
• To prevent duplicate votes and maintain the integrity of community ratings
• To send transactional emails (e.g. reply notifications) where you have opted in
• To monitor platform health and improve our Service
• To comply with legal obligations

We do not sell your personal data to third parties. We do not use your health-related data for advertising or profiling purposes.

4. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service:

• Account data (email, username, profile photo) — retained until you delete your account.
• Reviews and user-generated content — retained until you delete them individually or delete your account.
• Health-related content in reviews — retained as part of the review until the review or account is deleted.
• Anonymous device identifier (guestId) — stored only in your browser's local storage; automatically removed when you clear your browser data. We do not store this server-side beyond individual vote records.
• Analytics events — retained for up to 24 months for platform monitoring purposes, then automatically purged.
• Contact form submissions — retained for up to 12 months, then deleted.

5. Data Deletion

You have the right to request deletion of your personal data at any time. You can do this in the following ways:

• Delete your account — go to your Profile page and select "Delete Account". This will permanently remove your account and all associated personal data including reviews, votes, and profile information.
• Delete individual reviews — you can delete any review you have written from your Profile page at any time.
• Clear local storage — to remove the anonymous device identifier, clear your browser or app local storage/cache in your device settings.
• Contact us — if you need assistance with data deletion, contact us via our Support page and we will process your request within 30 days.

Upon account deletion, all personally identifiable information is permanently removed from our systems. Anonymised, aggregated statistics (e.g. total review counts) may be retained but cannot be linked back to you.

6. Data Sharing

We do not sell or rent your personal data. We may share data with:

• Base44 (our hosting platform) — your data is stored on Base44's infrastructure. Their privacy policy governs their handling of data.
• Law enforcement — only where required by law or valid legal process.

7. Security

We use industry-standard security measures including encrypted connections (HTTPS) and access controls. While we strive to protect your data, no method of Internet transmission is 100% secure.

8. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data ("right to be forgotten")
• Object to or restrict certain processing
• Lodge a complaint with the ICO (ico.org.uk)

To exercise any of these rights, contact us via our Support page.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or in-app notification. Continued use of the Service after changes constitutes acceptance.

10. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us through our Support page.