1. Introduction & Scope

Smoke & Sativa is committed to protecting the privacy of our users in full compliance with PIPEDA (where it applies) and any applicable provincial privacy laws, as well as the age verification, record-keeping, and other obligations under the Cannabis Act and provincial/territorial cannabis regulations. We collect the minimal amount of personal information necessary to provide our Service securely and in compliance with these laws.

This policy applies to all personal information collected through:

Our mobile application (iOS/Android)
Website and any associated web portals
Customer support interactions
Email/SMS communications
Any future features or integrations

It does not apply to information collected directly by licensed cannabis retailers or delivery partners once the transaction leaves our platform (though we require them contractually to adhere to strict privacy and security standards consistent with applicable law).

2. Consent

Under PIPEDA and applicable provincial privacy laws, we are required to obtain **meaningful consent** from individuals before collecting, using, or disclosing their personal information, except where collection, use, or disclosure is permitted without consent (e.g., for legal compliance purposes such as age verification under the Cannabis Act).

2.1 What is Meaningful Consent?

Consent is meaningful when it is informed, voluntary, current, and given by an individual who understands the nature, purpose, and consequences of the collection, use, or disclosure of their personal information. To ensure consent is meaningful, we follow the guidance from the Office of the Privacy Commissioner of Canada (OPC), including the Guidelines for obtaining meaningful consent.

Key elements we consider and implement to obtain meaningful consent include:

Emphasis on key information: We present the most important details about our data practices (what we collect, why, how it will be used, who it will be shared with, and retention periods) up front in clear, plain language, often through layered notices, just-in-time disclosures, or prominent banners.
Allowing individuals to review information easily: Our full Privacy Policy is always accessible via a link in the app footer, account settings, and during onboarding. We use clear headings, bullet points, and avoid legal jargon where possible.
No bundling of unrelated purposes: We seek consent for specific, distinct purposes. For example, consent for location tracking for delivery purposes is separate from consent for marketing communications.
Express consent for sensitive information: For sensitive personal information — such as precise geolocation data, medical cannabis documentation (if applicable), or detailed order history that could reveal health-related information — we obtain express (explicit) consent. This may involve affirmative actions like checking a box, toggling a switch, or confirming via a pop-up dialog with clear options to accept or decline.
Granularity: Where feasible, we provide options to consent to certain uses while declining others (e.g., opt-in for personalized recommendations based on order history, while still allowing core delivery services).
Ease of withdrawal: Consent can be withdrawn at any time (subject to legal or contractual restrictions and reasonable notice) by adjusting app settings, contacting our Privacy Officer, or unsubscribing from communications. We explain the implications of withdrawal (e.g., loss of certain features like real-time tracking if location consent is revoked).
Capacity: We ensure that consent is obtained from individuals who have the capacity to understand the information provided. Our Service is restricted to adults meeting provincial cannabis age requirements.

2.2 Forms of Consent

Express Consent: Required for sensitive collections (e.g., precise location data for delivery matching and tracking, medical cannabis order details, or marketing use of personal information). Examples include: toggling on location services with a clear explanation popup, checking a box during account creation for marketing emails/SMS, or confirming age/ID upload.
Implied Consent: May be relied upon for less sensitive or expected uses, such as providing a delivery address to complete an order, or basic device/usage data needed for app functionality and security. Implied consent arises from the context (e.g., continuing to use the app after clear notice of practices).

2.3 Specific Examples in Our Service

Location Data: We request express consent via your device’s permission prompt when you first attempt to place an order or enable tracking. We explain that precise location is used only for matching you with nearby licensed retailers/delivery partners, providing real-time ETA, and completing delivery — not for unrelated purposes like advertising without separate consent.
Age & Identity Verification: By uploading government-issued ID or consenting to age verification during signup, you provide express consent for us to collect and process this sensitive information solely for compliance with the Cannabis Act and provincial regulations.
Marketing & Personalization: We obtain express opt-in consent (e.g., via checkbox or toggle) before using your order history or preferences for personalized product recommendations or sending promotional communications. You can withdraw this consent at any time without affecting core service access.
Transactional Processing: Providing payment details or a delivery address to complete an order constitutes implied consent for the necessary use and limited disclosure to process that transaction.

2.4 Withdrawal of Consent

You may withdraw consent for any collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions (e.g., we may need to retain certain transaction records for Cannabis Act compliance). To withdraw consent:

Adjust permissions in your device settings (e.g., disable location access)
Update preferences in your account settings within the App
Contact our Privacy Officer (see Section 12) for assistance

We will respect your withdrawal promptly and inform you of any consequences (e.g., inability to use real-time delivery tracking if location consent is withdrawn). Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

3. Information We Collect

3.1 Information You Provide Directly

Account & Profile Data: Full name, email address, mobile phone number, date of birth, delivery address(es), username/password, profile photo (optional), and service preferences.
Age & Identity Verification: Government-issued identification and/or other proof of age to confirm you meet the provincial/territorial minimum age requirement (typically 19+, 18+ in Alberta/Quebec, or 21+ in Quebec for certain periods/rules), as required under the Cannabis Act and provincial laws.
Order Information: Cannabis products selected, quantities, special instructions, order notes, and (for medical cannabis) any relevant medical document information if ordering through licensed medical channels.
Payment Data: Billing/shipping address and payment method details (processed securely via PCI DSS compliant third-party providers; we do not store full card numbers).
Communications: Messages sent via in-app chat, support tickets, feedback, or product reviews.
Delivery Partner Data (if applicable): Driver’s license, vehicle registration, insurance details, background check consent/results (as required for cannabis delivery licensing in relevant provinces).

3.2 Automatically Collected Information

Location Data: Precise geolocation (GPS) when you enable location services for order placement, real-time delivery tracking, and matching with nearby licensed retailers/delivery partners (collected only with your express consent).
Device & Usage Data: IP address, device type/model, operating system version, unique device identifiers, browser type, app version, pages viewed, session duration, clickstream data.
Analytics & Cookies: Usage information collected via analytics tools (e.g., Google Analytics, Firebase) for performance monitoring, crash reporting, and feature usage. We use cookies and similar tracking technologies (see our separate Cookie Notice for details). You can manage cookie preferences through your browser settings.

3.3 Information from Third Parties

Age and identity verification services
Payment processors (transaction confirmations and status)
Licensed cannabis retailers (inventory availability, order fulfillment status)
Social login providers (if you sign in via Google or Apple)
Background screening vendors (for delivery partners only, where required by provincial regulations)

4. How We Use Your Information

We process your information for the following purposes, which a reasonable person would consider appropriate in the circumstances:

Verify age and eligibility to purchase/possess cannabis under the Cannabis Act and provincial/territorial laws
Create, maintain, and secure your user account
Process orders, payments, and coordinate deliveries from licensed sources
Provide real-time order tracking and estimated arrival times
Match orders with licensed retailers and available delivery partners
Provide customer support, handle inquiries, refunds, and resolve disputes
Personalize your experience (saved addresses, order history, product recommendations where permitted)
Detect, prevent, and investigate fraud, abuse, or illegal activity
Comply with legal and regulatory obligations under the Cannabis Act, provincial cannabis regulations, tax laws, and record-keeping requirements
Improve the Service through aggregated usage analytics, bug fixes, and new feature development
Send essential transactional notifications (order confirmations, driver updates) — marketing messages require your separate opt-in consent

5. Sharing & Disclosure of Your Information

We share your personal information only when necessary, with appropriate safeguards, and in compliance with PIPEDA principles:

With Licensed Retailers & Delivery Partners: Name, delivery address, phone number (last 4 digits), order contents, and delivery instructions needed to fulfill your order.
Service Providers: Payment processors, cloud infrastructure, analytics providers, email/SMS services, fraud prevention tools — all bound by confidentiality agreements and PIPEDA-compliant obligations.
Legal & Regulatory Authorities: To comply with Cannabis Act tracking requirements, court orders, government inspections, or lawful requests from law enforcement or regulatory bodies.
Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets.
Aggregated/De-identified Data: For industry research, reporting, or marketing insights in a form that does not identify individuals.

We do not sell your personal information to third parties.

6. Data Security & Retention

We implement commercially reasonable technical, administrative, and physical safeguards appropriate to the sensitivity of the information (e.g., cannabis purchase data is considered sensitive), including encryption in transit and at rest, access controls, regular security assessments, and monitoring to protect against unauthorized access, disclosure, or loss.

We retain your information only as long as necessary to fulfill the purposes outlined in this policy, to comply with legal and regulatory requirements (including Cannabis Act record-keeping obligations, which may require retention for several years), or to resolve disputes. After that period, data is securely deleted, destroyed, or anonymized.

7. Your Privacy Rights & Choices

Under PIPEDA (and any applicable provincial law), you have the right to:

Access your personal information held by us
Request correction of inaccurate or incomplete information
Withdraw consent for certain uses (subject to legal or contractual restrictions)
Challenge our compliance with privacy obligations
Opt out of marketing communications or certain non-essential data uses (e.g., non-essential location tracking via device settings)

To exercise these rights or file a complaint about our privacy practices, contact our Privacy Officer (details below). We will respond within 30 days (or as required by law). If unsatisfied, you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy authority. Note that certain information (e.g., age verification records, transaction logs required by cannabis regulations) may not be deletable due to legal retention obligations.

8. Children's Privacy

The Service is strictly for adults who meet the applicable provincial/territorial minimum age for cannabis (typically 19+, 18+ in some provinces). We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected information from a child under 18, we will delete it promptly. Contact us if you believe a minor has provided us with information.

9. Third-Party Services & Links

Our Service may contain links to third-party websites or services (e.g., licensed retailers' sites). We are not responsible for their privacy practices. We encourage you to review their privacy policies. Additionally, we may integrate third-party services (e.g., payment gateways) that have their own privacy policies, but we require them to comply with applicable privacy laws.

10. International Data Transfers

Smoke & Sativa may store or process personal information outside Canada (e.g., with service providers in the United States or elsewhere). In such cases, we use appropriate contractual or other safeguards to ensure the protection of your information in a manner consistent with PIPEDA requirements. Note that data stored outside Canada may be subject to foreign laws and accessible to foreign governments.

11. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated version will be posted here with a revised effective date. For material changes, we may provide additional notice via email, in-app notification, or on the Service. Your continued use after changes constitutes acceptance.

Privacy Policy

Smoke & Sativa Privacy Policy

Table of Contents