Privacy Policy

• We do not sell your personal information.
• We send marketing emails and text messages only to people who have signed up for them, and you can stop them at any time.
• To reserve a pickup order we need your name, contact details, date of birth and government ID. Those go to our point-of-sale system. This website does not keep your date of birth, ID number or ID photo.
• With your permission, we use Google Analytics to understand how the site is used and which of our marketing leads to sales. It stays off unless you click Accept on our cookie notice. Google never receives your name, contact details, date of birth or ID from us.

Age confirmation. When you confirm you are 21 or older (or a medicinal patient), a cookie remembers that choice for 30 days.

Your cart. If you add items, a cookie identifies your cart for 30 days and the cart's contents are stored on our servers so it is still there when you come back.

Analytics, if you accept. If you click Accept on our cookie notice, then on public pages such as the menu, product pages and deals, Google Analytics records how the site is used: the pages you view, the products and lists you look at, searches (including the words you search for), filters you apply, items you add to your cart, and deals you click. Google also collects standard technical information such as your browser, device type and approximate location derived from your IP address, and sets cookies containing a random identifier. See Google Analytics and how we measure orders below.

With your permission, Surfside shows sponsored menu ads and measures views, clicks, product browsing, cart changes, checkout starts and accepted online orders. It receives product identifiers, prices, quantities, a random browser identifier, and technical information such as your IP address and browser. This information can be used for advertising measurement and relevant ads. Advertising identifiers and activity may constitute sharing for targeted advertising.

We do not send Surfside your name, contact details, government ID, date of birth, account credentials or private order link. Its scripts do not load on checkout or account pages. If you consent, we record its browser identifier on your reservation so our server can report the purchase conversion when our point of sale accepts the online order, before payment at pickup.

Decline optional cookies or use the footer's Do not sell or share setting to turn off future advertising tracking. We honor Global Privacy Control for Surfside even if you previously accepted cookies. Previous Google-only consent does not enable Surfside; we ask again.

We collect your first and last name, email address, mobile number, date of birth, government ID number, a photo of your government ID, and the items you are reserving. We use them to find or create your customer record in our point-of-sale system (Treez), hold your order, confirm you are old enough to buy, and check you in at pickup. Collecting this is part of selling cannabis lawfully.

This website keeps:

• the order itself — items, prices, totals, status and timestamps;
• the customer number our point-of-sale system assigns you;
• one-way codes derived from your details, stored instead of the details themselves, used to avoid creating duplicate customer records and to stop abuse;
• if you accepted analytics, the Google Analytics identifiers already in your browser (see below).

For a guest order, this website does not keep a copy of your name, email address, mobile number, date of birth, ID number or ID photo. Your order confirmation link stops working 45 days after you place the order.

Store staff see your order and the details needed to prepare it and hand it over. Printed order tickets show your first name and last initial.

Your ID photo is checked and re-encoded in memory, then sent to our point-of-sale system. This website does not store the photo. It keeps only a one-way digest of it, used to avoid uploading the same photo twice, and a record of whether the upload succeeded. Your ID number is sent to the point-of-sale system and is not stored by this website. We use your ID information only to verify your eligibility and fulfill your order. Staff check your physical ID at pickup in every case, so an order still stands if the photo upload fails.

An account is optional. You can create one on the account page or by choosing to save your details at checkout. We keep:

• your email address, first and last name, and mobile number;
• your password, stored only as a one-way hash that no one can read;
• sign-in sessions: a label for your browser and device, a one-way code of your IP address, and when you signed in;
• your order history, favorite products and brands, and preferences;
• loyalty points and stamps earned on paid orders, and rewards you redeem;
• notes and tags store staff may add to help serve you.

Account emails are for account security only: to confirm your email address and to reset your password. They are sent whether or not you have signed up for marketing. We link your account to your point-of-sale customer record only after verifying it is you.

If you sign up, we may send you emails and text messages about deals, new products, events and rewards. We send marketing text messages only to people who have given us their consent to receive them. Signing up is never required to shop with us.

• To stop emails, use the unsubscribe link in any marketing email. To stop text messages, reply STOP to any of them. You can also ask us in the store or using the contact details below.
• Message frequency varies. Message and data rates may apply. Reply HELP for help.
• Stopping marketing does not stop account emails, which we send only for account security.
• We do not sell or share your mobile number or text message sign-up with anyone for their own marketing. The companies that send our messages receive your contact details only to send them on our behalf.

To limit repeated or automated attempts at checkout and sign-in, and to keep an audit trail of account changes and staff actions, we record one-way codes of IP addresses and of the details entered at checkout, never the addresses or details themselves. Rate-limiting records are deleted automatically once they expire.

Google Analytics is off until you choose. The first time you visit, a notice at the bottom of the page asks whether you accept analytics cookies. Until you click Accept, no Google Analytics code loads and no Google cookie is set. If you click Decline, or your browser sends a Global Privacy Control signal, it stays off.

You can change your choice at any time with Cookie settings, also linked at the bottom of every page. Declining after accepting deletes the Google Analytics cookies from your browser, and we stop reporting your orders.

Even when you accept, Google Analytics loads only on public pages. It never runs on the checkout, account, order or staff pages.

Because orders are paid in the store, the browser is long gone by the time a sale happens. So we measure orders from our own server:

• When you place an order, and only if you accepted analytics, our server reads the Google Analytics identifiers your browser already has from browsing our public pages, and saves them with the order.
• When you pay for that order in the store, our server tells Google a purchase happened: the order total, the currency, the items (product names, brands, sizes, prices and quantities), our internal order number, and those identifiers.
• Reservations that are never paid for are not reported. If you declined analytics, or your browser had no Google Analytics identifiers, your order is not reported at all.

This tells us which of our marketing leads to real sales. Google never receives your name, email address, mobile number, date of birth, ID number or ID photo from us. Google processes analytics data under its own terms and privacy policy. You can also block Google Analytics everywhere with Google's opt-out browser add-on.

Our service and advertising providers include:

• Treez, our point-of-sale system: your order, customer details, ID number and ID photo.
• Google: analytics, if you accept it, as described above.
• Surfside: sponsored ads and measurement as described above.
• Twilio SendGrid: delivers account emails, so it receives your email address and the message.
• Email and text message providers: send our marketing messages if you have signed up, so they receive your email address or mobile number and the message.
• Railway: hosts this website and its database.

Product images may load from our point-of-sale provider's image servers, which, like any server you load content from, can see your IP address. We also disclose information when the law requires it, including to California cannabis regulators.

• We do not sell your personal information.
• Optional advertising measurement stays off until you accept it.
• We do not send marketing text messages without your consent, and we never make signing up a condition of buying.
• We do not store payment card numbers. You pay in the store.
• We do not give Google or any advertising company your name, contact details, date of birth, ID number or ID photo.

The cookies we set ourselves are needed for the site to work and are always on. Google Analytics and Surfside cookies are optional and set only if you accept them.

nh_age_ok · set by us

Remembers your age confirmation for 30 days.

nh_cart · set by us

Keeps your cart for 30 days.

nh_customer_session · set by us

Keeps you signed in to your account until you sign out, or after 30 days without use.

Staff sign-in · set by us

Used only by store staff signing in to manage the store.

nh_analytics_consent · set by us

Remembers whether you accepted or declined analytics cookies, for 365 days. After that we ask again.

nh_surfside_consent · set by us

Remembers your advertising choice for 365 days.

surfid.*, surfses.*, surf* · set by Surfside

Optional browser and session identifiers for ads and ecommerce measurement, set only after you accept. Browser identifiers can last up to 2 years; session cookies expire after 30 minutes without activity.

_ga, _ga_<ID> · set by Google

Optional. Google Analytics identifiers, set on public pages only if you accept analytics, typically kept for up to 2 years. Deleted if you later decline.

Change your analytics choice with Cookie settings. You can also clear or block cookies at any time in your browser settings.

• Cookies last for the periods listed above. Signed-in sessions end after 30 days without use.
• Expired sign-in sessions, expired email links and expired rate-limiting records are deleted automatically.
• Guest order confirmation links stop working 45 days after the order.
• Orders, accounts and saved carts have no fixed deletion date. We keep them while needed to run the service, meet California cannabis record-keeping rules and resolve disputes, and you can ask us to delete your account information.
• Google keeps analytics data according to our Google Analytics settings.
• Records in our point-of-sale system, including ID information sent there at checkout, are kept under the store's point-of-sale and compliance policies.

If you live in California, you can ask us to:

• tell you what personal information we collect, use and disclose about you;
• delete personal information we hold about you;
• correct inaccurate personal information.

We will not treat you differently for making a request. You can opt out of advertising sharing through Cookie settings. We do not sell personal information, and we use your ID information only to verify your eligibility and fulfill your order. Some records must be kept by law even after a deletion request; if so, we will tell you which.

To make a request, call us at (951) 521-1379, or visit us at 570 Central Ave, Lake Elsinore, CA. We will verify your identity by matching information we already hold. Someone you authorize in writing may make a request for you.

If your browser sends a Global Privacy Control signal, we treat it as declining analytics: Google Analytics does not load and we do not ask. You can still turn analytics on with Cookie settings if you want to. Surfside advertising remains off whenever Global Privacy Control is enabled. We do not sell personal information. The site does not respond to “Do Not Track” signals, but Google Analytics, which collects information about your activity on this site over time, runs only if you accept it.

This website is for adults. Orders require you to be 21 or older, and we do not knowingly collect information from anyone under 18.

The site uses encrypted connections. Passwords are stored only as one-way hashes, ID photos are not stored, IP addresses are stored only as one-way codes, and staff access is limited by role, with contact details hidden from staff who do not need them. No system is perfectly secure, but we design the site to hold as little about you as it can.

When we change this policy, we update the date at the top of this page. Significant changes will be described here.

For questions about this policy or your information, call us at (951) 521-1379, or visit us at 570 Central Ave, Lake Elsinore, CA.