Privacy policy

• What you give us to place an order: your name, email, phone number, shipping and billing address, and what you bought.
• Account details: your email or, if you sign in with a crypto wallet, that wallet's public address; and anything you add, such as saved addresses, a username, a profile picture, favorites, reviews and notification settings. There are no passwords: you sign in with a link we email you or by signing a message with your wallet.
• Rewards: your BUBO balance and history, the Budbo Wallet address we create for you, any wallets you connect, referrals, and affiliate activity. Transactions on a public blockchain are public by nature and can't be erased by us.
• How you use the site: pages viewed, items added to the cart, checkout steps, the link or campaign that brought you here, your device and browser type, approximate location from your IP address, and error reports when something breaks.
• Messages: what you send us by email or through the wholesale form.

• A random visitor ID kept in your browser, so the app can remember your swipes, puffs and cart without an account.
• Your swipes: which strains and products you passed on or puffed, to build your deck, your Puffs list and Strain Match.
• Location: an approximate location from your IP address, or your device location or a city you choose if you share it, to show nearby dispensaries and distances. It stays in your browser; we use it only to answer that request.
• Your Budbo cart: items you add are held in a cart on budbo.com, and checkout happens there under the rest of this policy.
• Dispensary menus, prices and stock in the app come from the stores' public menus and may be out of date; orders at dispensaries are placed with the store, not with us.

Card details go straight from your browser to our payment processor, Authorize.Net. They never reach or rest on our servers. If you start a subscription, Authorize.Net stores the card so renewals can be charged; we keep only a reference to it, the card brand and the last four digits.

• To take, pack, ship and support your orders, and to confirm an adult is ordering.
• To run your account, your rewards and any subscription.
• To send order and account emails, and, if you've said yes to them, offers and reminders.
• To see what is working on the site, fix what isn't, and prevent fraud and abuse.
• To meet tax, accounting and legal obligations.

We share information only with companies that help us run the store, and only what each needs:

• Authorize.Net, for card payments.
• ShipStation and the carrier (UPS or USPS), for labels and delivery: your name, address and phone number.
• Printful, which prints and ships merch: your name and address, for merch orders only.
• Resend, which delivers our email and tells us whether it was delivered, opened or clicked.
• Google, for address suggestions at checkout (what you type in the street field is sent to Google to find matches) and for Google Analytics.
• PostHog, for product analytics, and Sentry, for error reports.
• Vercel, Railway, Render and Cloudflare, which host the site, its database and its files.

We may also disclose information when the law requires it, or to protect our customers, our business or others from fraud or harm. If the business is sold or merged, customer information may transfer with it.

We keep a few things in your browser so the site works: your cart, your sign-in, that you confirmed you're 21 or over, and the order you just placed. If you arrive through a friend's or partner's link, we remember that link so they can be credited, and we note the campaign that brought you. Analytics tools set their own cookies. You can clear or block these in your browser; the cart and sign-in won't work without them.

• Every marketing email has an unsubscribe link, and the unsubscribe button in your mail app works too. You can also change what we send in your notification settings. We'll still send emails about orders and your account.
• You can see and edit most of what we hold in your account.
• To get a copy of your information, correct it, or have it deleted, email support@budbo.com from the address on your account. We'll act on it within 45 days. We don't treat you differently for asking.

Order and payment records are kept as long as tax and accounting rules require, even after an account is closed. Account details are kept while the account is open. Analytics data is kept in a form that isn't tied to your name where we can.

The site is served over HTTPS, payments are handled by a PCI-DSS compliant processor, and access to customer data is limited to the people and systems that need it. No system is perfectly secure; if something affects your information, we will tell you.

The site is for adults 21 and over. We don't knowingly collect information from anyone younger. If you believe we have, tell us and we'll delete it.

If we change this policy we'll update the date at the top. If a change matters, we'll say so on the site or by email.