What Bloom does with data

Verifying age and recording who somebody is are two different things, and most systems do the second while meaning the first. Bloom records the outcome of the check, the age it derived from the date of birth, the document type and the expiry date. It does not store the document number and it does not store an image.

Oregon draws the line further back than that. ORS 475C.217 says a retailer may not record, retain or transfer information from a consumer's identification, while still requiring that the identification be checked. Those two obligations together are easy to fail in either direction, so on an Oregon licence Bloom keeps the outcome alone.

A receipt records what was sold, under which rule, at which tax rate. Whether it records a person is a separate question and the default answer is no: the customer field is nullable and the customer class is not. That is enough to price the basket, enforce a purchase limit and file the report, and it is not enough to build a profile.

A purchase limit still has to be enforced across a window, which normally means knowing that two visits were the same buyer. Bloom keys that ledger by the kind of subject the rule actually names, which for an anonymous adult-use sale is the receipt and for a patient is the registry number the state already holds. The limit works without the identity because the rule never asked for one.

There is no third party analytics script on a tenant storefront and no setting that adds one. Washington's My Health My Data Act, in force since March 2024, treats information about somebody's cannabis purchases as consumer health data, requires consent to collect or share it, bans geofencing around health facilities, and carries a private right of action. A class action against a Seattle dispensary began with tracking pixels on its website.

The in-store screens log that a creative played, on which screen and for how long, because that is what an advertiser is billed from and what an inspector may ask about. They do not know who was standing in front of them. There is no camera, no face detection and no audience measurement, and none is planned.

Every table holding licensee data carries the licence it belongs to, and a database policy compares that against the licences the caller actually holds. A query that forgets its filter returns nothing rather than everything, which is the failure direction that matters. This is a property of the database rather than a rule the application follows, so it does not depend on a reviewer catching an omission.

Nine tables had drifted out of that set and were closed on 7 September 2026, including the play log the advertising statements are built from. What was added alongside them matters more than the nine: a test that asks the database which tables carry licensee data and fails if any of them is unprotected.

A licensee is required to keep certain records for a period their state sets, and those periods are rows in the same regulatory corpus as the purchase limits and the tax rates, carrying the same citation and the same date the source was last read. So a deletion request is answered against the actual rule: what must be kept is kept and named, and everything else goes.

A licensee's data belongs to the licensee. It exports in full, on request, in a format that opens without Bloom. That is a term of the contract and not a courtesy, because a system that holds a shop's history hostage is a system nobody should put their history into.

It is a description of how the software behaves, not legal advice, and it is not the contract. A licensee remains responsible for their own compliance with the privacy law of their state, and the terms of service are the document that governs the relationship. Where this page describes a design decision the law forced, the law is cited so it can be checked rather than taken on trust.