Privacy Policy

SECTION 1 — INFORMATION WE COLLECT

When you place an order or create an account, we collect personal information including your name, email address, billing and shipping address, phone number, and order details. We also collect technical data such as IP address, browser and device type, and usage data generated by your interaction with the storefront.

SECTION 2 — CONSENT

By completing a transaction or creating an account, you consent to our collecting and using your information for order fulfillment, customer support, fraud prevention, and legal compliance. For marketing communications such as email newsletters, we request separate consent and provide an opt-out option in every message.

SECTION 3 — HOW WE USE YOUR INFORMATION

• Process and fulfill orders, payments, and delivery requests.
• Verify age eligibility as required by federal law for smokable hemp products.
• Provide customer service and respond to support inquiries.
• Maintain account functionality and storefront security.
• Detect, investigate, and prevent fraud, abuse, or unauthorized activity.
• Meet tax, accounting, legal, and regulatory obligations, including hemp compliance recordkeeping.
• Send transactional emails (order confirmations, shipping updates) and, with your consent, marketing communications.

SECTION 4 — DISCLOSURE

We do not sell your personal information to third parties. We share information only with service providers that support store operations:

• Authorize.Net — payment processing. Authorize.Net is PCI-DSS compliant. We do not store full card numbers.
• SendGrid — transactional and marketing email delivery. Your email address is used to send order confirmations and, if opted in, newsletters.
• ShipStation / UPS — order fulfillment and shipping. Your name, shipping address, and order details are shared with the carrier to complete delivery.
• Medusa Commerce — our backend commerce platform stores order, account, and cart data in a secure hosted database.

We may also disclose information if required by law, subpoena, or legal process, or to protect the rights, safety, and security of our business, customers, or the public.

SECTION 5 — SECURITY

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information. Payment card data is handled exclusively by Authorize.Net under PCI-DSS standards and is never stored on our servers. No transmission or storage system is guaranteed 100% secure.

SECTION 6 — COOKIES AND TRACKING

We use cookies and similar technologies to maintain sessions, keep carts active, secure account access, and understand how the storefront is used. You can manage cookie settings in your browser at any time, but disabling cookies may affect storefront functionality such as cart persistence and checkout.

SECTION 7 — DATA RETENTION

We retain personal information for as long as reasonably necessary for the purposes described in this policy — including fulfilling orders, maintaining records, resolving disputes, enforcing agreements, and meeting legal and regulatory obligations including hemp compliance recordkeeping.

SECTION 8 — AGE REQUIREMENT

You must be 21 years of age or older to use this site and purchase our products. We do not knowingly collect personal information from individuals under 21. If you believe we have inadvertently collected such information, contact us at hello@sobersativas.com and we will delete it promptly.

SECTION 9 — YOUR PRIVACY RIGHTS (GDPR & CCPA)

You have the right to access, correct, or request deletion of your personal data. Depending on your jurisdiction, you may also have rights to data portability, objection, restriction of processing, and to limit certain uses of sensitive personal information.

California residents may request details about the categories of personal information we collect, disclose, and share. We do not sell personal information for monetary consideration.

SECTION 10 — HOW TO EXERCISE YOUR RIGHTS

To submit a privacy request — including data access, correction, or deletion — contact us at hello@sobersativas.com. We may verify your identity before completing your request and will respond within the timeframes required by applicable law.

SECTION 11 — POLICY CHANGES

We may update this policy from time to time. Changes become effective when posted to this page unless otherwise required by law. We encourage you to review this policy periodically.