Who this policy covers

This policy describes information handling by Upstate Canna Co. in connection with upstate-canna.co, customer communications, and our adult-use cannabis retail services. References to “we,” “us,” and “our” mean Upstate Canna Co. Information handling can differ between browsing our website, visiting our store, placing an order, and joining a loyalty program.

Our online menu at shop.upstate-canna.co and connected services may involve outside platform providers. Those providers may process information on our behalf or for their own purposes under their own notices. Review the notices presented when you use their services.

Information connected with your interactions

The information involved depends on the service you request. It may include:

• Contact details: your name, email address, telephone number, and information you send in a message.
• Order and service details: products selected, purchase history, pickup preferences, delivery address, instructions, and communications about your order.
• Age and identity details: information needed to check eligibility for adult-use cannabis purchases. Staff must verify acceptable identification. An age confirmation on the website does not replace that check.
• Account and loyalty details: registration information, account identifiers, rewards activity, and preferences submitted through the relevant service.
• Payment-related details: transaction amounts, payment status, and information handled by the payment method or provider used for a purchase.
• Website activity: IP address, browser and device information, pages requested, referring links, timestamps, and information from cookies or similar technologies used by a website or connected service.

Please do not send identification documents, payment credentials, or medical records through ordinary email unless we have provided an appropriate method for that information.

Why information is used

Information may be used to respond to questions, manage customer accounts, process eligible purchases, coordinate pickup or delivery, administer loyalty participation, and resolve service issues. Other purposes include maintaining website operation, investigating suspected fraud or misuse, keeping required business records, and meeting legal or regulatory obligations.

Marketing communications and related tracking must follow the choices presented at signup or through the relevant service. A request for assistance or an order inquiry does not by itself authorize unrelated promotional messages.

When information is disclosed

Information may be disclosed to providers that support the service you use, such as website hosting, online ordering, customer communications, loyalty administration, payment processing, and delivery coordination. The information needed varies with the provider’s role.

Disclosure may be required to respond to a lawful request, comply with cannabis retail obligations, protect customers or business systems, or investigate suspected unlawful conduct. A business transfer may involve customer records, subject to applicable protections and notice requirements.

Third-party tracking can raise separate privacy questions, including whether a disclosure is treated as a sale, sharing, or targeted advertising under a law that applies to a particular activity. Contact us to ask about the services used in your interaction or to submit an applicable opt-out request.

Cookies and connected websites

Cookies and similar technologies can support website functions, preferences, measurement, or features supplied by other services. You can review, delete, or restrict stored cookies through your browser settings. Those choices may affect sign-in, saved preferences, or shopping functions. Contact us for questions about tracking on a particular page. A link to an outside website does not place that website under this policy.

Marketing and loyalty choices

Use an email’s unsubscribe link to stop promotional email. For promotional texts, use the opt-out instructions in the message or contact us for assistance. Service messages connected with a current order or legal obligation may still be needed after a marketing opt-out.

Loyalty participation follows the terms displayed for that program. Ask us about account changes, ending participation, or the effect of deletion on recorded rewards. Any required incentive notice must be provided for a program to which that requirement applies.

Retention and security

Retention depends on the purpose of the record and applicable obligations. Order records, communications, account data, technical logs, and regulatory records may have different retention periods. A deletion request may be limited by requirements to preserve particular records.

No website, email system, or electronic record can be guaranteed free from security risks. Use a unique password for any account, keep login details private, and contact us if you suspect unauthorized activity. Do not use ordinary email to send sensitive credentials.

Requests about your information

Contact us to request access to, correction of, or deletion of information related to you, or to ask about an applicable privacy opt-out. Rights and exceptions depend on the law that applies, the activity involved, and the information held. Where a law provides portability, an authorized-agent process, or an appeal right, requests will be handled under that law.

Use “Privacy Request” in your email subject and describe the request and the service involved. We may need to verify your identity or an agent’s authority before releasing or changing records. Please do not attach a copy of your ID to the initial email. We will explain any further verification needed and respond within applicable legal time limits.

Adults 21 and older

Our cannabis shopping services are intended for adults 21 years of age or older. People under 21 should not create shopping accounts or submit information for a cannabis purchase. If you believe a person under 21 has submitted information through these services, contact us so the matter can be reviewed and addressed under applicable requirements.

Updates and contact

Changes to this policy will be posted on this page with an updated date. Material changes will receive any notice or consent required by applicable law. Contact us with privacy questions or requests: