Privacy Policy
Last updated: May 25, 2025
1. Who We Are
CityLeaf ("we," "us," "our") operates the website cityleaf.nyc — a directory of OCM-licensed cannabis dispensaries in New York City. We do not sell cannabis products directly. We are an informational platform for adults 21 and older.
2. Information We Collect
Information You Provide
- Email address — when you sign up for updates via our email capture form.
- Review content — name (optional) and text when you submit a dispensary review.
- Business information — if you claim or advertise a dispensary listing (name, email, business details).
- Payment information — processed via Stripe; we do not store card numbers on our servers.
Information Collected Automatically
- Analytics data — page views, session duration, device type, browser, and approximate location via Google Analytics 4 (GA4). GA4 uses cookies.
- Log data — IP address, referral URL, and browser type collected by our hosting provider (Vercel).
- Cookies — we use functional cookies (age verification, cookie preferences) and analytics cookies (GA4).
3. How We Use Your Information
- To send email updates if you subscribe (you can unsubscribe anytime).
- To display and moderate user reviews of dispensaries.
- To process payments for advertising and listing services via Stripe.
- To analyze site usage and improve our platform via Google Analytics.
- To maintain platform security and prevent abuse.
4. Cookies
We use the following types of cookies:
- Functional cookies — remember your age verification and cookie preferences. These are essential for site operation.
- Analytics cookies — Google Analytics 4 tracks usage patterns to help us improve the site. You can opt out by declining cookies on our cookie banner, or by using the Google Analytics Opt-out browser add-on.
5. Third-Party Services
We use the following third-party services that may process your data:
- Google Analytics 4 — usage analytics. Google Privacy Policy
- Stripe — payment processing. Stripe Privacy Policy
- Supabase — database and backend. Data hosted in the US. Supabase Privacy Policy
- Vercel — website hosting. Vercel Privacy Policy
- Google Places API — used to display dispensary photos from Google Maps.
6. Data Sharing
We do not sell, rent, or trade your personal information to third parties for marketing purposes. We share data only with the service providers listed above as necessary to operate the platform, or if required by law.
7. Your Rights (California & New York Residents)
Under CCPA (California) and New York's SHIELD Act, you have the right to:
- Know what personal data we hold about you.
- Request deletion of your personal data.
- Opt out of any sale of personal data (we do not sell data).
- Correct inaccurate personal data.
To exercise these rights, email us at privacy@cityleaf.nyc.
8. Age Restriction
CityLeaf is intended solely for adults 21 years of age or older. We do not knowingly collect personal information from anyone under 21. If you believe we have inadvertently collected information from a minor, contact us at privacy@cityleaf.nyc and we will delete it promptly.
9. Data Retention
We retain your data only as long as necessary for the purposes described above. Email list subscribers are retained until they unsubscribe. Review data is retained while your review is live on the platform. Payment records are retained as required by law.
10. Security
We use industry-standard security measures including HTTPS encryption, secure database storage, and restricted access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
11. Changes to This Policy
We may update this Privacy Policy periodically. Changes will be posted on this page with an updated date. Continued use of CityLeaf after changes constitutes acceptance of the revised policy.
12. Contact
Questions about this Privacy Policy? Contact us at privacy@cityleaf.nyc or write to CityLeaf, New York, NY.