Privacy
What we collect, what we deliberately do not, and who it is shared with. Shorter than most, because there is less of it.
What we collect
| When | What | Why |
|---|---|---|
| You place an order | Name, email, phone, delivery address, order contents | To fulfil it, to email your receipt, and to satisfy the record-keeping every cannabis regulator requires |
| You confirm your age | Nothing. A flag is stored in your own browser | So you are not asked again for 30 days |
| You add to your bag or wishlist | Nothing. Both live in your browser | So they survive a page reload |
| You subscribe | Email address | To send the monthly note. One click unsubscribes |
| You visit a page | A page path, a referrer, and a random per-session value | To count visits without identifying you |
What we do not collect
- No third-party analytics. No Google Analytics, no Meta pixel, no advertising identifier, no cross-site tracker.
- No tracking cookies. The visit counter uses a random value in
sessionStoragethat is discarded when you close the tab and is never linked to an order. - No identification documents. ID is checked visually at handover and handed straight back.
- No purchase profile for advertising. We do not build one, and we do not sell one.
Who it is shared with
Three parties, and no others: the delivery driver (name, address, phone — they need to find you); our email relay (your address and the receipt); and the state regulator, where the law requires a record of the sale. We do not sell, rent or trade personal information to anybody, for any purpose.
What the packaging discloses
A delivery is the one part of an order other people can see, so it is treated as a privacy matter and not just a fulfilment one. The outer packaging carries no brand, no leaf, no dispensary name and no product reference — only the address and the carrier label — and every item inside is sealed in an opaque, odour-proof pouch. Drivers use unmarked vehicles, wear nothing branded, and do not say what they are carrying. Nobody handling the parcel learns what is in it from the outside of it.
The exception is the packing note inside, which must carry the batch references and the warnings state law requires. We cannot remove those, and we would rather say so here than let you find out when you open the box. The full detail is in Delivery & shipping.
How long we keep it
Order records are retained for as long as the relevant state requires — typically three to seven years — because a cannabis licence depends on producing them on request. Analytics counters are aggregate and hold nothing that identifies a person. Newsletter subscriptions are held until you unsubscribe.
Your rights
You can ask what we hold about you, ask for it to be corrected, ask for a copy, or ask for it to be deleted. Write to order@virginecannabis.com or call +1 (214) 384-0538 and we will respond within 30 days. Deletion is subject to the retention periods above: we cannot delete an order record the regulator requires us to keep, and we will tell you plainly when that applies.
If you are a California resident, the CCPA gives you these rights explicitly, plus the right not to be discriminated against for exercising them. We do not sell personal information, so there is nothing to opt out of.
Security
Traffic is encrypted in transit. Administrative access requires an account with two-factor authentication, passwords are stored as PBKDF2-SHA256 hashes at 210,000 rounds, every write to the store is recorded in an audit trail, and every file is versioned before it is changed.
Children
This site is not directed at anybody under 21 and we do not knowingly collect information from minors. If you believe a minor has given us information, tell us and we will delete it.