Paperwork, once.
Regulated retail runs on documents — licences, certificates, prescriptions, IDs. Budy collects each one a single time, checks it at the moment it actually matters, and keeps the smallest possible trace of it afterwards.
- Write-once
- Lot provenance, frozen at receipt
- On-device
- Passport and ID reading
- Five minutes
- Document links expire
- Redact
- Retention strips the person, keeps the proof
Budy gives you the controls and the records. It does not provide legal advice and it cannot make a shop compliant on its own — what your licence requires is between you, your regulator and your counsel.
Where a gram came from, frozen the day it arrived.
When stock is received, Budy takes a snapshot of its origin — the farm, its licence, the counterparty and the certificate exactly as they stood at that moment — and writes it onto the lot. That snapshot can never be written a second time.
History cannot be restated
Renewing a licence does not quietly rewrite every label you have already printed, and a lot received under a licence that has since been revoked still reads the way it did on the day it arrived.
Splits and transfers carry it
Break a lot down, move it between locations or convert it into another product and the origin travels with it. A pre-roll rolled from a traceable lot does not come out anonymous.
Two farms never merge into one lot
Topping up an existing lot with stock from a different site forces a new lot instead. Merging them would destroy the one question the record exists to answer.
And it prints on the label
Sample label data. Ten provenance fields resolve into any template, alongside your own text, barcodes and QR codes.
- Farm
- {farmName} Doi Saket Collective
- Licence
- {farmLicence} TH-CN-2024-0881
- Province
- {farmProvince} Chiang Mai
- COA
- {coaNumber} COA-24-11-0417
- Issued by
- {coaIssuer} Bangkok Analytical Lab
- THC
- {labThc} 18.4%
- CBD
- {labCbd} 0.6%
- Tested
- {labTestedDate} 2024-11-08
Attach the paperwork to the person, not the sale.
A membership in Budy is not a points gimmick. It is where a customer’s documents live, so the second visit does not have to repeat the first.
The best check is the one nobody notices
When an attached member’s documents already satisfy every active rule, the sale simply goes through. No sheet, no interruption, and no queue building up behind them.
Created at the counter, offline
A member is written locally the moment you add them — no round trip and no waiting on a connection. Photograph an ID to fill the form, or type it in.
Renewals stack, they do not overwrite
A replacement document is a new record linked to the one it supersedes, so the history of what you saw, and when, stays intact.
Tap to recall
NFC cards and search-as-you-type at the till, so finding a member takes a second rather than a conversation.
Read the document. Trust the checksum, not the guess.
Budy reads passports and ID cards on the terminal itself. The machine-readable zone along the bottom of a passport carries its own check digits, so the device can tell a field it decoded from a field it inferred — and it always says which.
Every field says how sure it is
- High Check digits agree
- The machine-readable zone parsed cleanly and its own checksums validate. This is the only read Budy treats as certain.
- Medium Matched by pattern
- No usable machine-readable zone, so the text was matched against known formats — a Thai thirteen-digit number, a Buddhist-era date. Plausible, and flagged for a human.
- Low Inferred from position
- A date found with nothing labelling it. Shown, never trusted, and never applied on its own.
A birthday needs a human
A date of birth is the one field that can quietly become permanent — get it wrong and the customer is age-verified forever. So it never reaches a profile from a scan alone. Somebody has to look at the document and tick the box.
When the device cannot read it
A low-confidence read, or a terminal without a capable camera, can fall back to a cloud text service. The parsing still happens on your device, so the answer is the same either way — and the fallback stays a fallback, not the default.
- Passport
- National ID card
- Driving licence
- Residence permit
- Other document
Where a prescription actually goes.
A scanned prescription is among the most sensitive things a shop will ever hold. Budy keeps it in a private store that has no public address at all, hands out links that die in five minutes, and writes down every single time somebody looks.
- No public address
- Public access is switched off at the storage level. There is no URL to guess, and the record holds a path rather than a link — a leaked database would not hand anyone a document.
- Links expire in five minutes
- Opening a document mints a signed link on demand that stops working almost immediately. Nothing long-lived is ever handed out.
- Every view is logged
- The access record is written before the image renders, so a view that happened cannot fail to be recorded.
- One shop cannot reach another
- Every read and write is checked against the requesting shop’s own path prefix before it touches storage.
- Fingerprinted on the way in
- The exact file that gets stored is hashed, so you can prove a document recovered later is the one that was seen at the counter.
- Encrypted at rest and in transit
- Storage is encrypted by default, and everything moves over TLS.
Deleting the person, keeping the proof
When a record ages past your retention window, Budy destroys the images first and only then strips the personal fields — the name, the prescriber, the clinic, the issuing country, the last four digits. What remains is that a check happened, when, under which rule, and the hash. Erasing the row outright would erase the evidence of compliance along with the person.
If an image cannot be destroyed, the record is left alone and retried rather than stripped into an orphan. And an unreadable retention setting keeps everything — a purge cannot be undone, so it is never the fallback.
Built for GDPR
Compliance is a property of how you run your shop, not something software can certify on your behalf. What Budy can do is make the defensible choice the default one. Here is how the design maps onto the principles.
| Principle | How Budy is built |
|---|---|
| Art. 5(1)(c) Data minimisation | The record keeps conclusions, not source data: a yes-or-no for age, four digits of a document number, and no date of birth at all. The full number is never even hashed — an unsalted digest of a national ID is reversible by brute force, so recording nothing is the safer answer. |
| Art. 5(1)(e) Storage limitation | You set the retention window per shop. A sweep runs at every launch, so a till that has been switched off for a week catches up on its own. |
| Art. 5(1)(f) Integrity and confidentiality | Private storage with public access prevented, short-lived signed links, per-view access logging, per-shop path isolation, and a hash on every stored file. |
| Art. 17 Right to erasure | Redaction removes the person while the attestation survives, so you can honour an erasure request without destroying the evidence that you checked. |
| Art. 25 Protection by design | The limits live in the code rather than in a policy document: the build fails if the record ever starts storing a date of birth or a public URL. |
Bring it to your counter.
Tell us what your licence asks for and we will show you how Budy handles it.
Budy gives you the controls and the records. It does not provide legal advice and it cannot make a shop compliant on its own — what your licence requires is between you, your regulator and your counsel.