Privacy Policy

10. Template notice

This privacy policy is a template. It describes a typical cannabinoid e-commerce data flow, not the actual processing carried out by any particular operator.

Before launch it must be checked against the operator's real systems, its data inventory and processing records, its vendor contracts and its disclosure practices, and it must be reviewed by qualified counsel. US privacy law is state law: the obligations differ by the state your customers live in, and the thresholds that trigger them differ too.

21. Controller and contact details

The business responsible for the processing described here is [COMPANY LEGAL NAME], [REGISTERED ADDRESS], entity number [ENTITY NUMBER].

Privacy contact: info@leafystores.com. Our privacy officer, where one is appointed, is [PRIVACY OFFICER NAME AND CONTACT]. Requests may also be sent by mail to the address above or by phone on (303) 961-1895.

We are subject to the Federal Trade Commission's authority over unfair and deceptive practices, and to the consumer privacy statutes of the states our customers live in — among them the California Consumer Privacy Act as amended by the CPRA, and the comprehensive privacy acts of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the other states that have enacted one. You may complain to the consumer protection division of your state attorney general, to the California Privacy Protection Agency if you are a California resident, or to the FTC.

32. Categories of personal data we process

We collect data you give us, data generated by your use of the site, and data we receive from service providers such as payment and verification partners.

We do not ask for health data and you should not send it to us. If you volunteer health information in a message, we delete it from the ticket once the query is resolved.

• Identity and contact data: name, date of birth or age-band result, email, phone, billing and delivery address
• Order data: items, quantities, prices, currency, order and invoice numbers, delivery instructions
• Payment data: payment method type, last four digits, authorisation and settlement references, chargeback records. We never store full card numbers
• Verification data: age-gate outcome, the reference returned by the verification provider, and where a document check is required, a pass/fail result and check reference
• Account data: credentials in hashed form, saved addresses, wishlist, order history, marketing preferences
• Technical data: IP address, device and browser type, language, referring page, pages viewed, session identifiers
• Communications data: emails, contact-form messages, chat transcripts, review and rating content
• Compliance data: destination-country checks, order-volume flags used to detect resale, and records of refused or cancelled orders

43. Purposes and lawful bases

We process personal information only for the purposes listed below, and only for as long as section 8 says. Where a state privacy law requires a legal basis, an opt-out or an opt-in, the basis we rely on is named.

• Taking and fulfilling your order, delivery, returns and customer service — necessary to perform the contract you entered into
• Age verification and refusing sales to minors — required by law and necessary for lawful trading
• Delivery-state legality screening and resale detection — necessary for lawful, compliant distribution
• Invoicing, accounting, sales-tax filing and state reporting — required by law
• Fraud prevention, chargeback defense and site security — necessary to protect the store and our customers
• Non-essential cookies, analytics and advertising — your opt-in where your state requires one, and always subject to the "Do Not Sell or Share My Personal Information" and Global Privacy Control opt-outs
• Email marketing to customers about similar products — your sign-up, or the existing-customer relationship permitted by the CAN-SPAM Act, always with a working unsubscribe link
• Product reviews you choose to publish — your submission, which is voluntary
• Defending or bringing legal claims — our legitimate business interest and legal obligations

54. Where our legitimate interests apply

Where we rely on legitimate interests, we have balanced our interest against your rights and freedoms and concluded the processing is proportionate, expected in an e-commerce context, and limited to what is necessary.

You may object to legitimate-interest processing at any time by writing to info@leafystores.com. We will stop unless we can show compelling grounds that override your interests, or the processing is needed for legal claims. Objections to direct marketing are always honoured.

65. Age verification and special categories

Verifying that a customer is 21 or older requires date-of-birth or document data. We keep the minimum: the outcome of the check and a provider reference. Where a document image is used, it is handled by the verification provider and is not retained by us.

We do not infer, record or trade in health data, and we do not build profiles about medical conditions. Cannabinoid purchase history is treated as ordinary order data, and we do not use it to draw conclusions about health.

We do not carry out automated decision-making with legal or similarly significant effects. A failed age or fraud check that blocks an order is reviewable by a human on request.

76. Recipients and processors

We share personal data with service providers who process it on our instructions under Article 28 contracts, and with third parties where the law requires it.

We do not sell personal data and we do not disclose it for third-party marketing.

• Hosting, CDN and application monitoring — [HOSTING PROVIDER]
• Payment service providers and acquirers — [PSP NAMES]; they act as independent controllers for their own compliance duties
• Age and identity verification — [VERIFICATION PROVIDER]
• Carriers and fulfilment partners — [CARRIERS], who receive name, address, phone and any adult-signature requirement
• Carriers and their delivery agents, who receive the name, address, phone number and adult-signature instruction
• Email, ticketing and review platforms — [PROVIDERS]
• Analytics and advertising partners, only after consent — [PROVIDERS]
• Accountants, auditors, insurers and legal advisers, under duties of confidentiality
• Law enforcement, tax authorities and state regulators where a valid subpoena, warrant or legal obligation exists

87. International transfers

We and our vendors are established in the United States, and personal information collected here is stored and processed in the United States. Some vendors operate support or infrastructure functions in [OTHER COUNTRIES].

Where a vendor processes data outside the United States, the transfer is covered by contractual data protection terms, a vendor security assessment, and technical measures including encryption in transit and at rest. We do not transfer personal information to a jurisdiction we have not assessed.

You may request a copy of the safeguards used for a particular transfer by writing to info@leafystores.com.

98. Retention

We keep personal data only as long as needed for the purpose it was collected for, or as long as a law requires.

• Order, invoice and tax records — [6–10] years from the end of the financial year, as required by local accounting law
• Age-verification outcomes and references — 5 years, as evidence that a sale was lawful
• Account data — until you delete the account, then 30 days in backups
• Customer-service tickets — 24 months from closure
• Marketing sign-ups and unsubscribes — 3 years after the last interaction, then deleted
• Analytics data — 14 months maximum, in aggregated form thereafter
• Fraud and chargeback records — 6 years, for claims defence
• Server and security logs — 90 days

109. Security

We use TLS for all traffic, encryption at rest for the order database, hashed and salted passwords, role-based access control, multi-factor authentication for staff, and least-privilege access for support agents.

Access to age-verification results and payment references is restricted to staff who need it. Access is logged.

No system is perfectly secure. Where a breach affects personal information, we notify affected individuals and the state authorities required to be told, in the form and within the deadline each state's breach-notification statute sets — in several states that is without unreasonable delay and no later than 30 to 60 days, and some states also require notice to the attorney general above a victim threshold. We notify the card networks and our acquirer where payment data is involved.

1110. Your rights

The rights below are the ones state privacy laws most commonly give. Which of them you have depends on the state you live in, and some apply only above a statutory threshold. We honor every request we are required to and, where we reasonably can, we honor the rest too. We answer within 45 days, extendable once by a further 45 days for complex requests, and we may ask you to verify your identity first. Exercising a right never costs you anything and never changes the price you pay or the service you get.

• Know and access — a copy of the personal information we hold and the categories we collected, used, disclosed and sold or shared
• Rectification — correction of inaccurate or incomplete data
• Erasure — deletion where the data is no longer needed and no legal duty requires us to keep it
• Limit sensitive information — restrict our use of sensitive personal information to what is necessary to provide the service
• Portability — receive the information you gave us in a portable, readily usable format
• Opt out — of the sale or sharing of your personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects
• Withdraw consent — at any time, including by using the Global Privacy Control signal, without affecting processing already carried out
• Non-discrimination and appeal — we will not deny service, charge a different price or give you a lower quality of service for exercising a right, and where your state provides an appeal you may appeal our decision to us before going to your attorney general

1211. Cookies and similar technologies

We set strictly necessary cookies to run the cart, the session, the age gate and fraud prevention. Everything else — analytics, personalisation, advertising — runs only after you consent through the cookie banner.

You can change or withdraw consent at any time through the cookie settings link in the footer. The Cookie Policy lists each category and the retention period.

1312. Children

This store is not intended for anyone under 21 and we do not knowingly process the data of minors.

If we learn that a minor has created an account or placed an order, we cancel the order, close the account and delete the data except what we must keep as evidence that the sale was refused.

A parent or guardian who believes a minor has given us data should write to info@leafystores.com.

1413. Changes to this policy

We update this policy when our processing changes. The effective date is shown at the top of the page and we keep previous versions available on request.

Where a change materially affects you, we tell you by email or a prominent site notice before it takes effect.