What we will and will not tell you about compliance

A matched phone number is not SMS consent

This is the most important sentence on this site. If Leafprint matches a visit to a phone number, that person has not agreed to get marketing texts from you. Text marketing generally requires prior express written consent under federal law, along with whatever your state and your carriers require. Your consent records have to come from your own signup process.

Do not import matched numbers into your SMS platform. Do not tell your team, your clients, or your investors that identified contacts flow into your text list. Read the full explanation.

Disclose it in your privacy policy

Your visitors should be able to find out what you do. Your policy should explain that you use a visitor identification pixel, what it records, that visits may be matched to information held by data providers, why you use it, and how people can opt out or ask for deletion. You can see how we describe it in our own privacy policy.

Honor requests

Someone at your business should own opt-out and deletion requests, and should know how to respond within the time your applicable law requires. Requests must reach every place the data has gone, including any systems you connected through webhooks.

Check your state privacy laws

A growing number of states have consumer privacy laws that give residents rights over their personal information, and some carry specific rules on sale, sharing, targeted advertising, or sensitive data. Whether they apply to you depends on your size and activity. California's rules are often the most discussed, but do not assume that is the only one that matters.

Check your cannabis advertising rules

Each legal market has its own limits on cannabis marketing, including rules on reaching minors and on what you may say. Identification does not change those rules. Before you use data for any outreach, confirm that the audience, channel, and message are all allowed.

What we do not claim

• We do not claim Leafprint guarantees compliance, because no tool can control how you use it or what your state requires.
• We do not make technical privacy claims about how the product tracks visitors unless we have verified them for your setup.
• We do not provide legal advice. This page is general information, so talk to your own counsel about your program.

Questions to take to counsel

• Which state privacy laws apply to our business, and does this use trigger any of their obligations?
• What should our privacy notice say about the pixel and about matching?
• Do we need a banner or an opt-in on our site before the pixel runs in any of our markets?
• What outreach, if any, can we do based on matched information, and on which channels?
• Who handles requests, and how do we document them?