1. Introduction
Welcome to Hash & Flowers. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our online shop at shop.hashandflowers.com, our informational website at hashandflowers.com, or place an order with us (together, the “Site”). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Site.
We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the “Effective Date” of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates.
Who we are: The Site is operated by Trinity Alps Farms, Inc., DBA Hash and Flowers, Trinity County, CA, which holds California Department of Cannabis Control license C12-0000296-LIC (Commercial Microbusiness, Adult-Use + Medicinal). You can reach us at info@hashandflowers.com. Trinity Alps Farms, Inc. is the business responsible for the personal information described in this policy (“we,” “us” or “our”).
2. Information We Collect
We may collect information about you in a variety of ways. The information we may collect on the Site includes:
a) Information You Provide Directly
- Account and Profile Information: When you register a customer account, we collect your name, email address, password, phone number, and date of birth. Your date of birth is required so that we can verify that you are at least 21 years of age, as required by law.
- Age and Identity Verification Documents: To comply with California cannabis regulations, you may upload a copy of a government-issued photo identification (such as a driver’s license or passport) and, if applicable, a physician’s recommendation or medical marijuana identification card to your account. These documents are used solely to verify your age, identity, and eligibility to purchase.
- Order and Delivery Information: When you place an order, we collect your billing and delivery address, selected pickup location (if applicable), the contents of your order, your order history, and any delivery instructions you provide.
- Payment Information: We currently accept payment in cash on delivery or at pickup, so we do not collect or store payment card details through the Site. If we add online payment methods in the future, payments will be processed by a payment provider and this policy will be updated accordingly.
- Communications: When you use our contact form or otherwise contact us (for example, about an order), we collect your name and email address along with any message you choose to send, and we keep a record of the correspondence.
- Email Subscription: If you choose to subscribe to our email list, we collect your email address. We will use it to send you newsletters, updates, and promotional information only with your explicit consent, which you can withdraw at any time.
b) Information Collected Automatically
- Log and Usage Data: Like many websites, we automatically collect information your browser sends whenever you visit our Site. This may include your computer’s Internet Protocol (IP) address, browser type, browser version, the pages of our Site that you visit, the time and date of your visit, the time spent on those pages, and other statistics.
- Location Information: We use your location to determine which of our locations serves you and whether your address is within a delivery area. We use your precise location only if you grant your browser’s permission; otherwise we use the address or ZIP code you enter. To find the map location of an address or ZIP code, and to suggest addresses as you type, we send it to Google Maps Platform. You can decline the browser location prompt and instead enter your address or ZIP code manually.
- Cookies and Tracking Technologies: We use cookies and similar technologies to operate the Site and understand how it is used. These include a cookie that remembers that you confirmed you are 21 or older, cookies that keep track of your shopping cart and login session, and a preference for your selected store location. We do not use Google Analytics or any advertising or cross-site tracking cookies; our own analytics is described below. Our forms are protected by Google reCAPTCHA, which may set its own cookies; Google’s use of that information is governed by the Google Privacy Policy. For more detail, see our Cookie Policy.
- Our Own Analytics: To count visits, see which pages are used, and find problems with the Site, we use our own analytics tool. It runs on our own server, and nothing it collects is shared with any analytics or advertising company. For each page you view it records the page address (without search terms or other query parameters), the type of page, the name of the website that sent you (if any), your device type (mobile, tablet or desktop), your browser and operating-system family (for example “Chrome” or “Windows”, never the version or the full browser string), your screen size, and how quickly the page loaded; if a page fails, it records a short technical error message with web addresses and e-mail addresses removed. It also records site events: a sign-in or failed sign-in, an account being created (with its account number), an item being added to a cart, an order being placed (with its order number), checkout errors (error codes only, never what you typed), and whether our anti-spam check passed. To tell visits apart it uses a random identifier for the current browser tab, kept in your browser’s session storage (not a cookie) and deleted when you close the tab, and a code calculated from your IP address and browser details that changes every day. Your IP address itself is not stored. Because an order and your visits on the same day share that daily code, our statistics can connect that day’s visits to the order you placed. Detailed records are deleted after 60 days; after that we keep only daily totals that cannot be connected to anyone. Opting out: if your browser sends a Global Privacy Control or Do Not Track signal, our analytics does not record your visit at all.
- Order Source: When you visit, our shop software (WooCommerce) sets short-lived cookies (
sbjs_*) that note how you arrived at the Site (for example from a search engine, another website, or a link in one of our e-mails, including any campaign tags in that link), your device type and browser string, and how many pages you viewed in that visit. If you place an order, this is saved with the order so we can tell which channels bring orders. These are our own cookies, they are not shared with advertisers, and they expire within 30 minutes.
3. How We Use Your Information
We use the information we collect or receive:
- To process, fulfill, and deliver your orders, including arranging delivery or pickup and communicating with you about order status.
- To verify your age, identity, and eligibility to purchase cannabis products, as required by law.
- To create and manage your customer account.
- To determine whether we can serve your area and which of our locations serves you.
- To respond to your comments or inquiries submitted via the contact form or customer service channels.
- To comply with legal and regulatory requirements applicable to licensed cannabis retail, including record-keeping and reporting obligations.
- To detect and prevent fraud, unauthorized purchases, and abuse of the Site.
- To monitor and analyze usage and trends to improve your experience with the Site, using our own analytics tool described in Section 2.
- To send you emails and newsletters, such as updates or promotional information, only with your explicit consent. You can unsubscribe at any time.
4. Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it:
- Performance of a Contract: We process your account, order, delivery, and payment information because it is necessary to fulfill our contract with you when you place an order.
- Legal Obligation: We process your date of birth, identity documents, and order records where necessary to comply with age-verification, record-keeping, and other obligations under applicable law.
- Consent: We rely on your explicit consent to process your email address for sending newsletters and promotional emails, and to access your precise location. You can withdraw your consent at any time.
- Legitimate Interests: We process information from the contact form and automatically collected data (like analytics) based on our legitimate interests in operating our website, responding to user inquiries, preventing fraud, and improving our services, provided these interests are not overridden by your data protection interests or fundamental rights and freedoms.
5. Data Sharing and Disclosure
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We may share information we have collected about you in certain situations:
- With Licensed Retail Partners: Orders placed through the Site are fulfilled by licensed cannabis retailers. To fulfill your order, we share with the fulfilling retailer the information they need to prepare, verify, and hand over your order: your name, contact details, delivery address (for delivery orders), date of birth and verification status, and the contents of your order.
- With Delivery Personnel: For delivery orders, the driver completing your delivery receives your name, delivery address, phone number, and order details so they can complete the delivery and verify your identification at handover.
- With Service Providers: We may share your information with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. These include our retail point-of-sale and order-management platform (BLAZE), which receives your order and the customer details needed to fulfill it; our website hosting provider (Vultr); Google, which provides reCAPTCHA protection against spam and abuse on our forms, Google Maps Platform address suggestions and lookup, and the web fonts the Site loads; and our e-mail delivery provider. We do not use third-party analytics or advertising services. These service providers are obligated to protect your data and use it only for the purposes for which it was disclosed.
- With Regulators or as Required by Law: Licensed cannabis retail is a regulated activity. We and our retail partners may disclose order and verification records to state and local authorities where required by California cannabis regulations, and we may share your information to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, as permitted or required by any applicable law, rule, or regulation.
- Business Transfers: If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or in the uses of your personal information.
6. Data Retention
We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. Specifically:
- Account information is retained while your account remains active. You may request deletion of your account at any time.
- Order and verification records are retained for as long as required by applicable law. California commercial cannabis regulations currently require sales and compliance records to be kept for seven (7) years, so these records may be retained even after your account is deleted.
- Identity documents uploaded to your account are stored in access-controlled, non-public storage and retained while your account is active or as required by law. You may request their removal, subject to our legal retention obligations.
- Email subscriptions: we retain your email address until you unsubscribe.
- Analytics records from our own analytics tool are deleted after 60 days; only daily totals that cannot be connected to anyone are kept after that.
- Server logs (your IP address, the page requested, your browser type and the time) are kept for up to 14 days to keep the Site secure and working, then deleted automatically.
7. Your Data Protection Rights (GDPR & CCPA Focus)
Depending on your location, you may have the following rights regarding your personal information:
- The right to access – You have the right to request copies of your personal data.
- The right to rectification – You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete. You can also update most account information directly from your account settings.
- The right to erasure (Right to Delete) – You have the right to request that we erase your personal data, under certain conditions. Note that we must retain certain order and compliance records for the periods required by law, as described in Section 6.
- The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
- The right to object to processing – You have the right to object to our processing of your personal data based on legitimate interests, under certain conditions. You have the absolute right to object to processing for direct marketing purposes.
- The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
- The right to withdraw consent – You have the right to withdraw your consent at any time where we relied on your consent to process your personal information.
- California Residents (CCPA/CPRA): In addition to the above, California residents have the Right to Know what personal information is collected, used, shared, or sold, and the Right to Non-Discrimination for exercising their privacy rights. We collect the categories of information described in Section 2, for the purposes described in Section 3, and disclose them as described in Section 5. We do not sell personal information or share it for cross-context behavioral advertising. Where we collect sensitive personal information (such as government identification or precise geolocation), we use it only to provide our services and to comply with the law.
To exercise any of these rights, please contact us at info@hashandflowers.com. We will respond to your request within the timeframe required by applicable law. We may need to verify your identity before acting on a request.
8. Cookies and Tracking Technologies
We use cookies for site operation (age confirmation, login session, shopping cart, store-location preference) as described above. We do not use analytics or advertising cookies; our own analytics tool uses only a temporary identifier kept for the current browser tab, and it does not record your visit at all if your browser sends a Global Privacy Control or Do Not Track signal. Our shop software also sets short-lived order-source cookies, described in Section 2. For the full list of cookies and similar technologies we use, see our Cookie Policy. You can control and/or delete cookies as you wish. Most web browsers allow some control of most cookies through the browser settings; note that blocking operational cookies may prevent parts of the shop (such as the cart) from working. Google reCAPTCHA may set its own cookies when a page with a protected form loads. To find out more about cookies, visit www.aboutcookies.org.
9. Data Security
We use administrative, technical, and physical security measures to help protect your personal information. Identity documents are stored in a protected, non-public directory on our server that the web server refuses to serve directly, and are accessible only to your authenticated account and authorized staff. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse.
10. International Data Transfers
Your information, including personal data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. As our business is based in the United States, if you are located outside the United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to the United States and process it there. We will take steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.
11. Age Policy
Our Site is intended solely for adults 21 years of age or older, and we do not knowingly collect personally identifiable information from anyone under the age of 21. Confirming your age on the Site is not the final check: on every order, a member of staff or the delivery driver checks the recipient’s valid government-issued photo identification in person at pickup or delivery, and the order is not handed over to anyone who is under 21 or cannot be verified (see our Terms of Use). If you become aware that a person under 21 has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from a person under 21, we take steps to remove that information from our servers and close any associated account.
12. Contact Us
If you have questions or comments about this Privacy Policy, or wish to exercise any of your rights, please contact Trinity Alps Farms, Inc., DBA Hash and Flowers, at: info@hashandflowers.com