Privacy Policy

We sell licensed cannabis products and serve customers aged 21 and over. The site is not directed to minors, and we do not knowingly collect information from anyone under 21. If we learn that we have, we delete it.

• Order details — first and last name, email address, phone number, delivery address and any delivery notes, plus the items, quantities and amount of your order.
• Photo of your government-issued ID — required to verify that you are 21 or over before a delivery is dispatched. California cannabis regulations require this verification, so we cannot fulfil an order without it.
• Account information — if you create an account, your sign-in credentials, saved delivery addresses and order history.
• Messages — anything you send us by email or phone when you contact support.

• IP address, browser and device type, operating system and referring website.
• Pages and products you view, what you add to the cart, and how you reached the site (search engine, referral link or campaign tags in the URL).
• Identifiers stored in cookies and in your browser storage — see the next section.

We use a small number of cookies and storage keys:

• Essential — keeping you signed in, remembering your cart and your age confirmation. The site does not work without these.
• Analytics — Google Analytics 4 cookies (_ga) that count visits and measure how the shop is used.
• Advertising and measurement — Meta Pixel cookies (_fbp, _fbc) that let Meta recognise a browser and attribute an order to the campaign or link that brought you here.
• First-party attribution — a record in your browser’s local storage of the page you first landed on and where you came from, so we can tell which channels bring customers. It never leaves our own systems.

You can block or delete cookies in your browser settings. Blocking the essential ones will break sign-in and checkout.

• To take, verify, prepare and deliver your order, and to contact you about it.
• To confirm you are 21 or over, as required by California law.
• To operate accounts, saved addresses and order history.
• To measure how the shop performs — which pages, products and channels lead to orders.
• To keep records required by our licence, and to comply with legal requests.
• To detect and prevent fraud and abuse.

We do not sell your personal information for money, and we do not send your name, phone number, email address, delivery address or ID photo to advertising platforms in readable form.

Google Analytics 4. Measures traffic and shop usage. Google receives your IP address, device and browser data, the pages and products you view, and the value and contents of a completed order. It does not receive your name, email address, phone number, delivery address or ID photo.

Meta (Facebook) Pixel and Conversions API. We use Meta’s measurement tools to see which visits and campaigns result in orders. Two things happen when you place an order:

• Your browser sends Meta a purchase event with the order number, the order value and the product identifiers.
• Our server sends Meta the same event, together with your email address, phone number, first and last name, city and ZIP code — hashed (converted with SHA-256 into a fixed string) before they leave our server. Meta uses these hashes to match the order to an account it already knows.

We want to be plain about this: hashing means Meta never receives your details in readable form and cannot recover them from the hash, but it is a matching technique, not anonymisation — Meta can still link the order to an existing profile. This disclosure of identifiers to Meta counts as “sharing” for cross-context behavioural advertising under California law, and you can opt out of it at any time (see below).

Beyond the analytics partners above, we share information only with providers that run the service for us, and only as far as their job requires:

• Our hosting and database provider, which stores the site, your account, your orders and your ID photo.
• Our transactional email provider, which delivers order confirmations to your inbox.
• Our delivery drivers, who receive the name, phone number, address and order contents needed to complete your delivery.
• Regulators, auditors or law enforcement, where the law or our licence requires it.

The photo of your ID is stored in restricted storage that is not publicly accessible. It is used solely to verify your age and identity at the point of sale and delivery, and is available only to staff who need it for that purpose. We keep it for as long as our licence and California record-keeping rules require, and delete it once those obligations end or once you ask us to, whichever is later.

Order records and the verification data attached to them are kept for the period required of a licensed cannabis retailer. Account data is kept while your account exists. Analytics data is kept according to the retention settings of the platform that holds it. When a retention period ends, we delete the data or strip it of anything identifying.

If you are a California resident, you may ask us to tell you what personal information we hold about you and where it came from, to correct it, or to delete it. You may also opt out of the sharing of your identifiers with advertising platforms such as Meta. We will not treat you differently for exercising any of these rights.

To make a request, email us at order@harvesthouse.store with “Privacy request” in the subject line. We may need to confirm your identity — usually by matching the phone number or email on your orders — before we act on it, and we respond within the timeframes California law sets.

You can also limit tracking yourself: block cookies in your browser, use the Google Analytics opt-out browser add-on, or adjust the ad preferences in your Meta account.

Traffic to the site is encrypted, ID photos live in restricted storage, and access to customer data is limited to staff who need it. No system is perfectly secure, so we cannot promise absolute safety — but we do work to keep the amount of data we hold to what the business genuinely needs.

If we change what we collect or who we share it with, we update this page and the date at the top. Material changes will be announced on the site.

Questions about this policy or about your data: order@harvesthouse.store or +1 (626) 655-0055. You can also reach us through our contact page.