Privacy Policy

This Privacy Policy explains how Orqestra LLC (operating as Unify) collects, uses, and shares your personal information when you use the Unify platform — including our website at weunify.io and our mobile applications. We've written this in plain English so it's easy to follow. If anything is unclear, email us at support@weunify.io.

1. Who we are

Unify is a cannabis labor network that connects independent contractors with state-licensed cannabis operators in New Mexico. Workers sign up to find shifts; cannabis businesses sign up to post jobs and review applicants. The legal entity running Unify is Orqestra LLC, a New Mexico Limited Liability Company. Our business address is 1209 Mountain Road Pl NE, Albuquerque, NM 87110.

2. What we collect

The information we collect depends on whether you're a contractor, a company representative, or just browsing.

All users

• Account information: name, email address, phone number, password (stored hashed — we never see your plain-text password).
• Authentication metadata: sign-in timestamps, IP address, device type, and browser fingerprint, used to keep your account secure.
• Communications: any messages, support tickets, or feedback you send us.

Contractors (workers)

• Identity documents:photos or scans of government-issued ID (driver's license, state ID, passport), food handler card, and proof of background check completion. These are required for compliance with cannabis industry regulations and labor verification.
• Profile information: address, date of birth, work history, skills, and a profile photo.
• Location data:when you check in or check out of a shift, we capture your GPS coordinates to verify you're physically at the job site (geofence verification, typically a 200-foot radius). We do nottrack your location continuously or when you're not on an active shift.
• Earnings and payout information: hours worked, pay rates, completed shifts, and the bank routing and account number you provide so we can send your payouts. Account numbers are encrypted at rest (AES-256-GCM) and can only be decrypted by authorized payout administrators at the moment a transfer is sent.
• Background-check results: when you consent to a background check, our partner (Checkr) returns a report which we store for the duration of your active account.

Companies (operators)

• Business information: company name, EIN, cannabis license number and expiration, and address.
• Compliance documents: proof of cannabis licensure issued by the New Mexico Cannabis Control Division, and any other documents required by state or federal law.
• Job posting details: shift dates, hourly or per-pound rates, location, and special instructions.
• Billing information:for wallet deposits that fund jobs and for Unify Pro subscriptions. Deposit payment details (card or bank account) are entered on our payment processor Greencard's secure checkout page — along with any identity fields its banking partner requires for verification — and never touch our servers. We store only the transaction amount, status, and a reference ID.

Automatic collection (analytics + reliability)

• Error reports: when something crashes or throws an error, we collect a stack trace, browser version, and the page you were on. This helps us fix bugs faster.
• Cookies and similar technology: we use a session cookie to keep you signed in. We do notuse third-party advertising cookies and we don't track you across other websites.

3. How we use your information

We use the information we collect to:

• Run the platform — match contractors with jobs, schedule shifts, process payouts, and resolve disputes.
• Verify identity and eligibility under New Mexico cannabis labor regulations.
• Send you transactional emails about your account, applications, payouts, and disputes. (You can opt out of non-essential emails in your notification settings; legally required notices still go through.)
• Detect fraud and abuse, enforce our Terms of Service, and protect users.
• Improve the product — analyze how features are used, prioritize fixes, and respond to support requests.
• Comply with legal obligations and respond to lawful requests from courts or regulators.

4. Who we share information with

We don't sell your personal information. We share it only in the following narrowly defined cases:

Other users on the platform

• When a contractor applies to a job, the company sees the contractor's name, profile photo, Unify Score, work history with that company, and (after approval) home address and phone number for shift coordination.
• When a contractor is approved for a shift, the contractor sees the company name, exact job address, scheduler contact name and phone number, and check-in instructions.
• We deliberately hide each side's rate from the other — companies pay us; we pay contractors.

Service providers (sub-processors)

We use a small set of third-party services to operate the platform. Each one only receives the minimum data they need to do their job:

• Supabase — database, authentication, file storage. Hosts your account, documents, and shift records.
• Vercel — application hosting. Routes web and API traffic.
• Stripe — Unify Pro subscription billing and (in the future) identity verification. Card data is tokenized; we never store or see full card numbers.
• Resend — sends transactional emails like account approvals and shift reminders.
• Sentry — error monitoring. May receive error stack traces and the URL you were on when an error occurred. Does not receive your password, ID documents, or financial details.
• Stytch — phone verification. Receives your phone number to deliver the one-time SMS code that confirms your number at signup.
• Checkr— background check service. Used only when you actively consent to a check during signup. We send Checkr your name, email, phone, and zip code; you provide your SSN and date of birth directly on Checkr's own secure form, not ours.
• Greencard Payments— payment processing for company wallet deposits. Payment details, plus the identity fields its banking partner (MX) requires for verification, are entered on Greencard's hosted checkout page. We receive transaction status and a reference ID — never full card or bank numbers.
• Anthropic (Claude API)— assists with document review by analyzing uploaded ID images for authenticity. Documents are sent only when an admin triggers a check; results aren't stored at Anthropic and the API doesn't use your data to train models.
• Nominatim (OpenStreetMap) — geocoding. Converts job-site street addresses into map coordinates for shift geofencing. Job addresses only — contractor home addresses are never sent.
• OneSignal / Google Firebase Cloud Messaging — will send mobile push notifications about shift reminders and account updates once push launches in our mobile apps. Not active today.
• Aeropay (or equivalent) — planned processor for contractor ACH payouts. Until it launches, payouts are sent as standard bank transfers initiated by our team, and your bank identifiers stay within Unify.

Legal and compliance

We may share information when required by law — for example, to respond to a subpoena, court order, or lawful government request. We may also share information to investigate fraud or to protect our rights, your safety, or the safety of others.

Business transfers

If Orqestra LLC is acquired or merges with another company, user information may transfer to the new operator, subject to this Privacy Policy or one with equivalent protections. We'll notify you in advance if this happens.

5. How long we keep information

Account data: as long as your account is active, plus a reasonable period after closure for fraud investigation, tax records, and legal compliance — typically seven years for tax-relevant payout records (1099 reporting), shorter for non-financial data. You can request earlier deletion (see Section 8).

Identity documents (driver's license, food handler card, etc.): kept while your account is active. After account closure, we retain these for one year and then delete them, unless we have a legal hold.

Background check results: retained while your account is active and disposed of in compliance with the federal Fair Credit Reporting Act after closure.

Server logs and error reports: typically 30–90 days, depending on the system.

6. How we protect your information

• All traffic to weunify.io and our APIs uses HTTPS. Data moves between you and us encrypted in transit.
• Personal information at rest is stored on Supabase, which encrypts data and applies row-level access controls.
• Admin access to financial data and identity documents is restricted, audit-logged, and protected by mandatory two-factor authentication.
• We follow the principle of least privilege — staff only see the data they need to do their jobs.
• We can't guarantee perfect security. Use a strong password and don't share your account.

7. Children's privacy

Unify is not intended for children. You must be at least 21 years old to use the platform — both because cannabis workers in New Mexico must be 21+, and because we comply with COPPA. We don't knowingly collect information from anyone under 21. If you believe a child has provided information through Unify, email us at support@weunify.io and we'll delete it promptly.

8. Your rights

Depending on where you live, you may have legal rights over your personal information. We honor these for all users regardless of state:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to fix inaccurate information.
• Deletion: ask us to delete your account and associated data, subject to limits set by retention law (e.g., we must keep tax records for seven years). See our account deletion page for step-by-step instructions.
• Portability: get a machine-readable copy of the information you provided.
• Opt-out of marketing:we don't do advertising, but if we ever do, you can opt out from every marketing email or in your settings.

To exercise any of these rights, email support@weunify.io from the email associated with your account. We'll verify identity and respond within 30 days.

9. International users

Unify operates in the United States and serves users located in New Mexico. Our systems are hosted in the U.S. If you access the platform from outside the U.S., your information will be transferred to and processed in the United States.

10. California, Colorado, Virginia, Connecticut, Utah residents

Residents of states with comprehensive privacy laws (CCPA / CPRA, CPA, VCDPA, CTDPA, UCPA) have the rights listed in Section 8 plus the right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising. To exercise any right, contact support@weunify.io.

11. Changes to this policy

We may update this policy from time to time. When we do, we'll change the "Effective" date at the top and, if the changes are material, notify you by email or through the app. Continued use of Unify after a change takes effect means you accept the new policy.

12. Contact us

Questions, requests, or concerns about this Privacy Policy or how we handle your data:

Orqestra LLC
Attn: Privacy
1209 Mountain Road Pl NE
Albuquerque, NM 87110
Email: support@weunify.io