Privacy Policy

Account information — name, email address, phone number, and date of birth when you create an account or place an order. Identity verification — cannabis law requires us to verify age and identity in person before completing every sale; we record that a valid ID was checked and its type and expiry status. Order and purchase history — the products you order, totals, taxes, discounts and loyalty activity, fulfillment details, and — for delivery orders — the delivery address and notes you provide. Payment information — see Section 3; we store which payment method type you used, the account-holder name and bank name for a linked bank account, and transaction outcomes — never bank credentials or full account numbers. Technical data — standard web logs (IP address, browser type, pages viewed) and the cookies described in Section 8.

Fulfilling your orders and sending transactional messages; legal compliance (reporting sales to the state's cannabis track-and-trace system as required by law, enforcing state purchase limits, age verification records, tax reporting, and responding to lawful requests from licensing authorities); your account features (loyalty points, store credit, saved addresses, order history); marketing only with your consent — every message includes an opt-out, and declining marketing never affects your ability to order; and security and fraud prevention. We do not use your cannabis purchase history for third-party advertising, and we do not build or share advertising profiles from it.

Online bank payments (“Pay by Bank”) are processed by Aeropay, Inc. When you link a bank account, you do so through Aeropay's secure linking flow: your online-banking credentials are entered directly with Aeropay and its bank-connection partners and are never seen, transmitted, or stored by the Dispensary or RootPoint. What we receive and store is limited to a payment token, the account-holder name, the bank name and account type, and the status of the link.

Aeropay's handling of your information is described in Aeropay's Privacy Policy, and your use of Aeropay is governed by Aeropay's Terms of Service. We share with Aeropay only what is needed to process your payments: your name, the contact details used for verification, and transaction amounts.

We share personal information only with: state regulators and track-and-trace systems as required by cannabis law (sale reporting is generally at the transaction level; where the state requires customer-level data, such as medical patient allotments, we report only what the law mandates); Aeropay for payment processing as described in Section 3; service providers — hosting, infrastructure, error monitoring, and messaging providers operating under contracts limiting their use of your data (RootPoint is the primary such provider); our own delivery staff, who see the name, address, and order contents needed to complete a delivery; and legal process where required by subpoena, court order, or applicable law. We do not sell or rent your personal information to anyone, and we do not share your purchase history with data brokers or advertisers.

We retain order and sale records for as long as state cannabis regulations and tax law require, and account information for as long as your account is active. When retention periods expire, records are deleted or irreversibly anonymized. Payment tokens are deleted when you unlink a bank account, subject to records of past transactions we must keep.

You may at any time: access and update your account information from your profile; request a copy of the personal information we hold about you; request deletion of your account and personal information — honored except for records we are legally required to keep (state-mandated sale records, tax records), which are retained for the mandatory period and then deleted; opt out of marketing via the link in any email, by from your account settings; and unlink a bank account from your account's payment methods or by asking staff. To exercise these rights, contact us using the details in Section 11.

We protect your information with industry-standard measures: encryption in transit and at rest for sensitive fields, role-based access controls so staff see only what their job requires, tamper-evident audit logging of access to sales records, and hardened, monitored infrastructure. No system is perfectly secure; if a breach affecting your personal information occurs, we will notify you and the authorities as required by law.

The Site uses strictly necessary cookies (sign-in session, shopping cart) and basic, privacy-respecting analytics. We do not use third-party advertising cookies or cross-site trackers. You can clear or block cookies in your browser; sign-in and the cart require the necessary ones to function.

This Site is intended solely for adults 21 and older (or registered medical patients as permitted by law). We do not knowingly collect information from anyone under 21; if we learn we have, we delete it.

We may update this policy from time to time. The effective date above reflects the latest revision; material changes will be announced on the Site or by email before they take effect.

Geo Ganja · 456 Beach Ave, Santa Cruz, CA 95062 · (503) 555-0117 · hello@geoganja.example. Platform & data processor: RootPoint.