Kief

Kief Privacy Policy

Effective date: 2026-09-26 Last updated: 2026-09-26

This policy explains what information Kief collects, where it comes from, how it is used, who can see it, and the choices you have. Kief is the staff sales rewards platform at kief.app.

1. Who we are

Kief is operated by OCC ABQ LLC, doing business as Oasis Cannabis Co. EMPOCC LLC is the hiring organization that employs the Oasis staff who use Kief and assigns them to work at Oasis Cannabis Co. stores. In this policy, "Oasis," "we" and "us" mean OCC ABQ LLC and EMPOCC LLC. Kief is Oasis's own platform. It is not a third-party service.

Kief is a business tool for three groups: Oasis staff who take part in the Kief rewards program ("Employees"); cannabis brands and suppliers Oasis invites to fund incentive campaigns, and their staff ("Vendors"); and people who visit our public pages or ask for vendor access ("Visitors"). Kief is not a consumer service. Kief is only for people 21 or older.

2. What we collect and where it comes from

2.1 Employees

We receive Employee information from Oasis's own HR system (HRIS) and point-of-sale (POS) system, and Kief creates records as the program runs:

(a) From the HRIS: first and last name, HRIS employee ID, store, role, active status, whether the role can approve campaigns or payouts, and the POS login IDs linked to the Employee.

(b) From the POS: sale lines rung under the Employee's POS login, including transaction and line IDs, store, product, quantity, net sale amount, whether the line was a sale, void or return, whether it was a medical or adult-use sale, and the date and time. Kief does not receive customer names or customer contact details with these sale lines.

(c) Created in Kief: Campaign participation, goal progress and leaderboard standings; Earnings and their status; payout records, store credit postings and payroll batch records; payout preferences; dispute notes and outcomes; review holds and fraud-review flags; the avatar illustration or initials the Employee chooses; sign-in and session records; and an audit trail of actions.

Kief does not hold Employee pay rates, home addresses, personal email addresses or phone numbers, Social Security numbers, or other government ID numbers.

2.2 Vendors

(a) Account information: each Vendor User's work email address, role, and the Vendor company they belong to; the Vendor's name, logo and approved email domains.

(b) Sign-in and security information: sign-in events and times, the second-factor (authenticator app) enrollment held by our sign-in provider, active sessions, and a record of the devices used to sign in, stored as a one-way hash of a random device identifier, not a hardware ID.

(c) Business information: product claims, Campaigns, budget caps, statements, credits and adjustments, and an audit trail of actions.

2.3 Visitors who request vendor access

The access request form collects company name, contact name, work email, phone number (optional), brands or products, and a message. We also store a shortened form of your IP address (the first three parts of an IPv4 address, or the first three groups of an IPv6 address), which identifies a network, not a household, and the review status and decision on your request.

2.4 Technical information

To deliver and protect Kief, our hosting and security providers process technical information such as IP address, browser type and request logs. Kief uses your full IP address briefly to limit repeated sign-in and form attempts and to run the bot check described in Section 6. The access request record keeps only the shortened IP address described above.

3. How we use information

We use information to:

(a) run the Kief rewards program under the Kief Rewards Program Policy (SOP 1-20), including attributing sales, computing Earnings, settling leaderboards, and paying Earnings through payroll or store credit;

(b) let Vendors create and fund Campaigns and receive their monthly statements;

(c) review and respond to vendor access requests;

(d) keep Kief secure, including sign-in checks, second-factor authentication, rate limits, bot checks, fraud review and audit logs;

(e) keep payroll, tax, accounting and other business records and meet legal obligations; and

(f) resolve questions, disputes and errors.

We do not use Kief information for advertising.

4. Who can see what

4.1 Employees

(a) You can see your own Campaigns, Earnings, payout records and preferences.

(b) On a leaderboard Campaign, other participants on the same board can see your first name, last initial, avatar or initials, store, rank and the sales measure being ranked. Goal and commission Campaigns are private to you.

(c) Store managers, program administrators and other authorized Oasis staff can see Earnings and related records for the stores and Campaigns they oversee, as needed to run the program.

4.2 Vendors

Vendors receive only the following from Kief:

(a) Sales: units and net sales totals, and period comparisons, by store and product, for the Vendor's own approved products at the stores it may sponsor;

(b) Inventory: quantity on hand of those products at those stores;

(c) Its own Campaigns, statements and credits, with reward totals by Campaign and month, split between store credit and payroll; and

(d) Staff names while building a Campaign: the first name, last initial and role of eligible staff at the stores the Vendor may sponsor, so the Vendor can see who a Campaign covers.

Vendors do not see any Employee's individual Earnings, individual sales, leaderboard rank or pay, and they do not see Employee HRIS or POS IDs. Vendors never see another Vendor's data.

4.3 Service providers

We use service providers that process information for us, only to provide their services to Oasis:

  • Supabase — Database, sign-in and file storage (United States)
  • Vercel — Website hosting and scheduled jobs (United States)
  • Cloudflare — Domain name service, and the Turnstile bot check on the vendor sign-in and access request pages
  • Upstash — Short-lived counters that stop repeated sign-in and form attempts (United States)
  • Resend — Sending sign-in codes and service emails from kief.app
  • Anthropic — Optional campaign-writing suggestions. It receives campaign details only, never Employee names, with email addresses and phone numbers removed.
  • Push Operations — Payroll processing for Earnings paid through payroll

Oasis's own HRIS and POS systems also exchange information with Kief as described in Section 2.1.

4.4 Other disclosures

We may disclose information (a) to Oasis's accountants, auditors and legal advisers; (b) when the law, a court or a regulator requires it, including the New Mexico Cannabis Control Division; (c) to protect the rights, safety or property of Oasis, its staff or others, or to investigate fraud; and (d) to a successor in a merger, reorganization or sale of the business, subject to this policy.

5. We do not sell your information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising. Kief has no advertising and no advertising or analytics trackers.

6. Cookies and browser storage

Kief uses only the cookies and browser storage needed to sign you in, keep your session secure, and remember your display settings. Kief does not use advertising cookies or analytics cookies.

  • kief_staff_session (Cookie) — Keeps an Employee signed in after opening Kief from the HRIS. Duration: About 12 hours.
  • Sign-in cookies with names beginning "sb-" (Cookie) — Keep a Vendor User signed in. Duration: Set by our sign-in provider for the session.
  • kief_brand_last_activity (Cookie) — Signs a Vendor User out after 60 minutes of inactivity. Duration: 13 hours.
  • kief_device (Cookie) — Recognizes a device a Vendor User signed in from before, so a new device can be flagged for security. Duration: 400 days.
  • Cloudflare Turnstile (Security check) — Checks that a person, not a bot, is using the vendor sign-in or access request form. Cloudflare may use its own cookies or storage for this check. Duration: Set by Cloudflare.
  • kief-theme (Browser storage) — Remembers your light or dark display choice. Duration: Until you clear it.
  • Campaign list column settings (Browser storage) — Remembers which columns you chose to show. Duration: Until you clear it.
  • kief-legal-notice (Browser storage) — Remembers that you dismissed the notice banner on our home page. Duration: Until you clear it.

These items are strictly necessary for the service or store a setting you chose. Blocking cookies will prevent sign-in.

7. How long we keep information

We keep information for as long as needed for the purposes in Section 3, including running the rewards program, handling questions and disputes, and meeting payroll, tax, accounting, regulatory and other legal record-keeping requirements. When information is no longer needed, we delete it or keep it in a form that no longer identifies you.

8. Security

We use reasonable administrative, technical and physical safeguards appropriate to the information, including encrypted connections, second-factor authentication for Vendors, role-based access controls and audit logs. No system is perfectly secure, and we cannot guarantee security. If a security breach affects your information, we will notify you as the law requires.

9. Your choices and rights

(a) Employees may review their Earnings and payout records in Kief, change their payout preference as the Rewards Policy allows, and ask HR about any record at hr@oasiscannabisnm.com. An Employee may opt out of the program as the Rewards Policy describes.

(b) Vendors may update their account information in Kief or by contacting us, and may ask us to remove a Vendor User.

(c) Anyone may ask us to correct information that is wrong.

(d) Depending on where you live, the law may give you additional rights over your personal information. If it does, contact us as described in Section 12, and we will respond as that law requires. We may need to verify your identity before acting on a request.

10. Age

Kief is only for people 21 or older. We do not knowingly collect information from anyone under 21. If we learn that we have, we will delete it.

11. Changes to this policy

We may update this policy. We will post the new version with its effective date. For a material change, we will give notice in Kief or by email before the change takes effect.

12. Contact us

Privacy questions and requests: support@kief.app or help@oasiscannabisnm.com. Employees: hr@oasiscannabisnm.com. Legal notices must be delivered on paper to: OCC ABQ LLC and EMPOCC LLC, 315 San Pedro Blvd NE, Albuquerque, NM 87108.

Version 2026-09-26