Privacy Policy

01Who Is Responsible For Your Information

Dispensary Rank is operated by Nizam Uddin, who decides how the information described here is used and is responsible for it. Questions, requests and complaints about your information go to hello@dispensaryrank.com, and they are answered by the operator directly.

This policy covers the website, its free tools, the report emails and the audit and contact forms. Paid engagements are covered by their own written agreement, and other websites you reach from here have their own policies.

02Tools That Send Nothing To This Site

These tools run entirely on your own device. What you type, paste or select is processed in your browser and is never transmitted to this server, so there is nothing to store, log or hand over:

• Cannabis Compliance Checker
• GBP Suspension Risk Checker
• Dispensary Schema Generator
• Cannabis SERP Snippet Preview
• Keyword Cannibalization Mapper
• Reconsideration Request Builder

This is a design decision rather than a promise. These tools are meant for unpublished copy and live keyword strategy, and they would be useless if you had to think twice before pasting a draft.

03What The Scanners Record

The Site Check, the Menu Visibility Checker, the AI Answer Readability Checker and the Location Page Similarity Checker cannot work without fetching the site you name. When you run one, this server requests the public page you entered, and where a check needs them, that site's robots.txt, its sitemap and the store pages it links to, then analyzes the HTML it receives.

The result is saved so its report link keeps working. Each scan record holds:

• the address you scanned and the site it belongs to
• the findings and the date and time of the scan
• a random token that forms the unlisted report link
• a salted, one way hash of the address you connected from

The hash is used for two things: rate limits, so nobody can overload the scanners, and confirming that only the person who ran a scan can have it emailed. It is built from your IP address, or for IPv6 from your network, combined with a secret key held on the server, so it cannot be turned back into an address. Rate limit counters use the same salted form and expire within a day. Your IP address is not stored in readable form by the site itself, although the hosting provider's server logs record it for every visitor, as they do on almost any website.

04Report Requests By Email

After a scan you can ask for the report to be emailed. If you do, the name, email address, company and number of locations you enter are added to that scan record, and the email address is used to send you the report.

A separate tick box asks whether you are happy to be contacted about the report and how to fix what it found. Nobody is followed up unless that box was ticked, and consent is never assumed from a visit. A copy of the request is also sent to the operator so it can be answered.

05Audit Requests And Enquiries

The free audit and contact forms ask for your name, email address and website, and optionally the states or countries you operate in, how many locations you have and a message. You confirm that you are happy to be replied to before the form will send.

The enquiry is stored privately in the site's admin area, emailed to the operator so it can be answered, and kept with a one way hash of the address you connected from, to stop the form being abused. Your IP address itself is not stored. It is not added to a mailing list and it is used for nothing other than the conversation you started.

06Cookies, Analytics And Fonts

The theme sets no cookies of its own for visitors. WordPress sets its own cookies only for people who log in to manage the site.

The site can use Google Analytics 4 to see which pages are useful and which are ignored. When it is switched on it sets first party analytics cookies and sends Google limited information about your visit, such as the pages viewed, your approximate location and your device type, which Google may process in the United States. It does not run while the operator is logged in, and the theme adds no advertising or remarketing tags alongside it.

The typefaces are served by Google Fonts, so your browser requests them from Google's servers, which receive your IP address in the process as they would for any request.

Blocking cookies or analytics in your browser changes nothing about how the site works. Every tool functions the same with them refused.

07How Information Is Used

• to run the tools and keep your report links working
• to send reports you asked for, and follow up only where you agreed
• to answer audit requests and enquiries
• to keep the tools available by rate limiting and blocking abuse
• to understand which pages are useful, where analytics is switched on

It is never sold, rented or traded, never shared for cross context behavioural advertising, and never used to build a profile of you.

08Who Else Handles It

Scan records and enquiries live in the site's own database on its hosting account, and only the operator can reach them. A small number of service providers process information on the operator's behalf, and only as far as their service needs:

• the hosting provider, which stores the site and its database
• the email service that delivers reports and enquiry notifications
• Google, for fonts and, where switched on, analytics

Information is disclosed to anyone else only where the law requires it, and then no more than it requires.

09The Legal Grounds For Using It

Where the GDPR or the UK GDPR applies, information is handled on one of three grounds:

• steps you asked for, when you request a report by email or send an audit request or enquiry
• consent, for follow up emails about a report, which you give by ticking the box, and for analytics cookies where the law requires consent for them
• legitimate interests, for scan records and the salted hash behind rate limiting, because keeping free tools available depends on them
• contract, for details exchanged once a paid engagement begins

Consent can be withdrawn at any time by replying to any email or writing to hello@dispensaryrank.com. Withdrawing it stops further use from that point.

10How Long It Is Kept

• scan records without an email address: deleted automatically after one year
• scan records with a name and email attached: deleted automatically after two years
• audit requests and enquiries: kept while the conversation and any work that follows reasonably need them
• anything at all: deleted sooner on request

11How It Is Protected

The site is served over an encrypted connection. IP addresses are kept only as salted hashes, report links are long random tokens that search engines are told not to index, the scanners refuse private and internal addresses, and access to stored records is limited to the operator's account.

No system is perfectly secure. The strongest protection here is that very little is collected in the first place.

12Your Rights

You can ask to see what is held about you, have it corrected, have it deleted, receive a copy in a portable format, object to how it is used, or withdraw consent. Write to hello@dispensaryrank.com and say what you would like done. Requests are answered within 30 days and usually far sooner, and nothing is charged for them.

Depending on where you live, laws such as the GDPR in the EU, the UK GDPR, or the California Consumer Privacy Act as amended by the CPRA may give you further rights. The same rights are offered to everyone who asks, wherever they are, and nobody is treated differently for using them. Because nothing is sold or shared for advertising, there is nothing to opt out of on that front.

13Where Information Travels

This site is operated from outside the United Kingdom, the European Economic Area and the United States, and its hosting and email providers may process information in other countries again. Where information about someone in the UK or the EEA is involved, it is handled to the standard those rules require, wherever the processing physically happens.

14Sites You Scan

When you run a scanner, the request to the site you named comes from this server, not from your device, so that site's logs show this server's address rather than yours.

The main request identifies itself as the DispensaryRank site check. Some checks repeat the request with the user agent string of Googlebot or an AI search crawler, to see whether the site treats them differently. Those requests still come from this server and are not sent by Google or any AI company.

15No Automated Decisions About You

Nothing here profiles you or makes an automated decision with a legal or similarly significant effect on you. The tools analyze the website you name, not the person running them.

16Children

This site is intended for licensed cannabis businesses and adults aged 21 and over. It is not directed at children, and no information is knowingly collected from anyone under 21. If you believe a child has submitted information, write to hello@dispensaryrank.com and it will be deleted.

17If Something Goes Wrong

If information held here were exposed in a way likely to affect you, you would be told directly and promptly, with a specific account of what was affected and what was not, and the relevant regulator would be notified where the law requires it.

18Complaints

Raise any concern with hello@dispensaryrank.com first, because most are settled faster that way. You also have the right to complain to a data protection authority, such as the Information Commissioner's Office in the United Kingdom, your national supervisory authority in the EEA, or the California Privacy Protection Agency.

19Changes To This Policy

When this policy changes, the updated date at the top of the page changes with it. A material change to how information is handled is described here in plain words rather than slipped in quietly.