Privacy Policy

Last updated: October 1, 2026

This Privacy Notice for Bud City NJ LLC ("we," "us," or "our") describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services") including when you:

• Visit our website at budcitynj.com or any website of ours that links to this Privacy Notice
• Use Bud City's online platform offering a curated selection of cannabis products for adult use (21+) including flower, edibles, concentrates, vaporizers, and accessories
• Engage with us in other related ways, including any sales, marketing, or events

Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. Questions or concerns? Contact us at info@budcitynj.com.

Summary of Key Points

• What personal information do we process? We may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
• Do we process sensitive personal information? No, we do not process biometric, health, or other sensitive information beyond age verification (which is required by NJ law for cannabis sales).
• Do we collect information from third parties? Limited cases: we receive order and loyalty data from Dutchie (our checkout/POS provider) and Alpine IQ (our loyalty program).
• How do we process your information? To process your orders for in-store pickup, run our loyalty program, comply with NJ Cannabis Regulatory Commission requirements, communicate with you, and improve our Services.
• With whom do we share information? Only with service providers strictly necessary to operate the business (see list below) and with regulators when required by law.
• What are your rights? Depending on your state, you may have rights to access, correct, or delete your data. Contact us at info@budcitynj.com.

What Information We Collect

We collect personal information you voluntarily provide when you express interest in our products, participate in activities on the Site, or contact us. This includes:

• Names
• Phone numbers
• Email addresses
• Mailing addresses
• Date of birth (for legally required age verification)
• Government-issued ID (presented at checkout/pickup; we do not store ID images beyond the verification event)
• Payment information (handled by Dutchie; we do not store card numbers)
• Communication preferences

We also automatically collect:

• IP address
• Browser and device information
• Operating system and language settings
• Referrer URLs
• Approximate location (city-level) and usage data

We collect this to ensure security, improve performance, and support analytics.

Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Ensure the website functions properly (essential cookies)
• Analyze traffic and site usage (Google Analytics 4)
• Remember your age verification, location selection, and cart contents

You can control cookies through your browser settings. By continuing to use our site, you consent to our use of cookies as described in this policy.

We also set two first-party measurement cookies to understand how our own website and advertising perform. They contain no name, email, or account information:

• hsh_ssn: a random, anonymous session identifier (no identity attached), stored hashed on our side and kept up to 180 days, used to measure on-site engagement such as add-to-cart.
• hsh_src: the campaign tags (for example utm_source) from the link you arrived through, so we can measure which of our campaigns brought you to the site.

We use these only for our own first-party measurement and to report aggregate, de-identified results (such as total orders or revenue by campaign or brand) to the brands we feature. We do not sell them and do not use them for third-party cross-context behavioral advertising.

Third-Party Service Providers

We share data only with providers strictly necessary to operate the business:

• Dutchie: checkout, payments, order management, age verification, and POS
• Alpine IQ: our rewards program and opt-in marketing communications
• Resend: transactional email delivery (order confirmations, account magic links, deletion-request acknowledgments)
• Text messaging provider: cannabis-compliant text messaging used to deliver transactional order status updates and one-time login codes; we share the recipient phone number and the message content only
• Google: Analytics 4 on the website only (anonymized analytics), Google Business Profile (reviews), and Maps embeds
• Vercel: website + API hosting infrastructure (receives standard server logs)
• Supabase: database hosting (US region)
• Anthropic: powers the AI Budtender assistant. Your typed questions are sent to Anthropic's API to generate a reply; Anthropic does not train its models on this data and does not retain it for its own purposes under our API terms
• OpenAI: generates the search index that matches your AI Budtender question to products on our menu (your text is sent to create a numeric search vector; not used to train models under our API terms)
• NJ Cannabis Regulatory Commission and METRC: sales records as required by N.J.A.C. 17:30 (cannabis track-and-trace)
• Slack: internal staff notifications. When you submit a contact, careers, loyalty-signup, feedback, or kiosk-help form, its contents (which can include your name, email, phone, and message) are posted to our private staff workspace so a team member can respond
• Google Tag Manager: loads and manages our website analytics and Google Ads conversion measurement (it orchestrates Google Analytics 4 and Ads conversion tags); it does not build cross-site advertising audiences
• Vercel Analytics & Speed Insights: privacy-friendly, aggregate website traffic and performance metrics (page views and Web Vitals), with no cross-site identifiers
• Embedded content: some pages embed third-party content that loads from its own servers and therefore receives your IP address and browser type. This includes video players (YouTube in privacy-enhanced mode, Vimeo), QR-code images (api.qrserver.com, used for referral links), and profile-avatar images (Gravatar / Google)

We do not sell personal information. We do not participate in cross-context behavioral advertising.

How We Use Your Information

We process your information to:

• Process your orders for in-store pickup
• Run our rewards program
• Comply with New Jersey cannabis regulations (age verification, sales reporting, METRC)
• Communicate with you about orders, account changes, and (with your opt-in) marketing
• Identify usage trends and improve our Services
• Measure how our own website and advertising campaigns perform, and report aggregate, de-identified results to the brands we feature
• Detect and prevent fraud or abuse

AI Budtender

The AI Budtender is an optional chat assistant that answers product questions using our live menu. To use it on our website you must be signed in to a Bud City NJ account and be 21 or older; on our in-store kiosk it runs as a staff-assisted demo without a personal login. Because it is an automated communication about cannabis products, we keep an auditable record:

• What we save. Your questions, the assistant's replies, the date, and the account they belong to. We save these to your account so you can review your own history under My Account → Budtender chats.
• Why. Quality, accuracy, safety, and compliance with New Jersey cannabis advertising rules (N.J.A.C. 17:30). Staff may review conversations for those purposes.
• Not medical advice. The assistant provides product information only and declines medical questions. It has no internet access and only references products on our menu.
• We never sell these conversations and do not use them for cross-context behavioral advertising.
• Retention. Budtender conversations are retained for up to two years for compliance, then deleted or anonymized. If you delete your account, we remove your identity from these records (the conversation text may be kept in anonymized form as a compliance audit record).

Text Messages (SMS)

If you provide your mobile number (at checkout or when you sign in by phone) and opt in to receive text messages from Bud City NJ, we may send you transactional service texts: order status updates and one-time login codes. These are service messages, not marketing. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for help; if you opt out we will continue to reach you by email where possible. Marketing or promotional texts, where offered, require your separate opt-in and are handled through our loyalty provider. Transactional texts are delivered through a cannabis-compliant messaging provider; we share only your phone number and the message content needed to deliver them.

How We Protect Your Information

We use industry-standard safeguards to protect your data: encryption in transit (HTTPS) and at rest, role-based access controls so only authorized staff can reach personal data, hashed or tokenized identifiers in our analytics, and reputable processors (listed above) bound by data-protection terms. No method of transmission or storage is completely secure, but we work to protect your information and, where a breach affecting your personal data occurs, we will notify you and the appropriate authorities as required by law.

How Long We Keep Your Information

We retain personal data only as long as necessary for the purposes described above, unless a longer period is required by law. In summary:

• Transaction and sales records: retained for at least four years, as required by New Jersey cannabis retailer recordkeeping rules (N.J.A.C. 17:30-14.5).
• Account, loyalty (our rewards program), and order history: kept while your account is active and removed on account deletion, subject to the transaction-record requirement above.
• AI Budtender conversations: up to two years for compliance, then deleted or anonymized.
• Analytics and first-party measurement cookies: up to 180 days.

When data is no longer needed, it is deleted, anonymized, or securely stored until deletion is possible.

Information from Minors

Our Services are intended for adults aged 21 and older. We do not knowingly collect, market to, or sell to anyone under 21. If you become aware that someone under 21 has provided us with personal information, please contact us at info@budcitynj.com and we will delete it.

Your Privacy Rights

Depending on your state of residence, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements above)
• Opt out of marketing communications at any time
• Opt out of non-essential analytics and measurement on our website (we also honor your browser's Global Privacy Control signal automatically): see Your Privacy Choices
• Withdraw consent for processing not required by law

To exercise any of these rights, contact us at:

• Email: info@budcitynj.com
• Phone: +1 (973) 440-5945
• Web: /contact-us/

To request deletion of your account, your rewards program balance, your order history, and your saved items, visit budcitynj.com/account/delete/ at any time. Requests are confirmed within 5 business days and completed within 30 days.

We will respond within 30 days. If we cannot verify your identity, we may ask for additional information limited to what we need to confirm who you are.

Authorized agents. You may use an authorized agent to submit a privacy request on your behalf. The agent must provide written, signed permission from you, and we may still ask you to verify your own identity directly with us before we act on the request.

Right to appeal. If we deny a request, you may appeal that decision by replying to our response or contacting us again at the address above within 60 days. We will explain the reason for any denial and, where required by your state's privacy law, inform you how to contact your state's attorney general if you remain dissatisfied with our final decision.

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act. The categories of personal information we collect, in CCPA terms:

• A. Identifiers (name, address, phone, email): Yes
• D. Commercial Information (purchase history, payment metadata): Yes
• F. Internet Activity (browsing on budcitynj.com): Yes
• G. Geolocation Data (city-level only): Yes
• K. Inferences (loyalty preferences): Yes
• All other CCPA categories (biometric, sensitive PI, education, employment, sensory): No

We do not sell personal information. We do not use personal information for cross-context behavioral advertising. To exercise CCPA rights, contact us at info@budcitynj.com.

Other State Privacy Laws

If you reside in a state with a comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, Texas), you may have similar rights to access, correct, delete, and opt out of certain processing. Use the contact information above to exercise these rights.

Specific state-level rights you may also have:

• California: right to limit the use and disclosure of sensitive personal information; right to know the specific third parties with whom we have shared your data.
• Minnesota: right to question and obtain an explanation of any profiling that produces legal or similarly significant effects.
• Florida: right to opt out of the collection of personal data through voice or facial recognition technologies.
• Delaware, Maryland, Oregon: right to access the categories of personal data we hold and the specific third parties with whom we have shared it.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time. The "Last updated" date at the top reflects the most recent change. Continued use after changes are posted constitutes acceptance.

Contact Us

If you have questions or concerns about this Privacy Notice or your data:

Bud City NJ LLC
117 Water Street
Newton, NJ 07860
Email: info@budcitynj.com
Phone: +1 (973) 440-5945