Privacy Policy

Section 01

What We Collect

We collect only the information necessary to operate this site and fulfill your orders. Here is a full breakdown of what that includes:

Section 02

How We Collect It

We collect information in three ways:

• Directly from you — when you create an account, place an order, fill in a contact form, or communicate with our support team. This is the primary source of your personal data.
• Automatically — when you browse the site, our servers and analytics tools collect technical data such as your IP address, browser type, device type, pages visited, and time spent on the site. This happens via cookies and similar tracking technologies — see Section 6 for full details.
• From third parties — our payment processor confirms payment status and card validity. Our age-verification provider confirms whether you meet the minimum age requirement. Our shipping carrier confirms delivery status. We receive only the data we need from each of these providers.

Section 03

How We Use Your Information

We use the data we collect strictly for the following purposes:

• Order fulfillment — processing payment, picking and packing your order, coordinating shipment, and providing tracking information.
• Age and eligibility verification — confirming you meet the legal minimum age and that delivery to your location is permitted under applicable law.
• Customer support — responding to enquiries, processing warranty claims, and resolving order issues.
• Account management — if you create an account, maintaining your login, order history, and preferences.
• Site improvement — using anonymized technical data to understand how customers use the site, identify issues, and improve the experience.
• Legal compliance — retaining records as required by applicable law, particularly around age-restricted product sales and financial transactions.
• Fraud prevention — detecting and preventing fraudulent orders, chargebacks, or misuse of the site.

We do not use your personal data for targeted advertising, behavioral profiling, or any purpose beyond what is listed above without obtaining your explicit consent first.

Section 04

Who We Share It With

The categories of third parties we work with are:

• Payment processors — to securely handle your transaction. They receive only what is necessary to authorize payment and never store your full card details on our behalf.
• Shipping carriers — your name and delivery address are shared with the carrier to ship your order. Carriers may also require age-verification at delivery.
• Age-verification providers — to confirm you meet the legal minimum age requirement before your order is processed.
• Website hosting and infrastructure providers — our site is hosted on servers that process technical and transactional data as part of normal operation.
• Analytics providers — anonymized or aggregated site usage data may be processed by analytics tools to help us understand site performance.

All third-party service providers are bound by contractual obligations to handle your data securely and only for the specific purpose for which it was shared. They are not permitted to use your data for their own marketing or commercial purposes.

We may also disclose personal information if required to do so by law, court order, or government authority, or where we believe disclosure is necessary to protect the safety of any person or to prevent fraud or illegal activity.

Section 05

Age Verification Data

To comply with the federal Tobacco 21 law in the United States and applicable provincial regulations in Canada, we are required to verify that every customer meets the minimum age requirement before completing a purchase. This may involve:

• Collecting your date of birth at checkout.
• Passing that information to a third-party age-verification provider for confirmation.
• In some cases, requiring government-issued ID verification at the point of delivery through our carrier partner.

Age verification data is used solely for the purpose of confirming eligibility. It is not used for marketing, profiling, or any other purpose. Retention of this data is subject to the same security and access controls as all other personal information we hold.

If an age verification check cannot be completed or fails, the order will not be processed and will be refunded in full.

Section 06

Cookies & Tracking

Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies to keep the site functional, remember your session, and understand how customers use the site so we can improve it.

Here is a breakdown of the types of cookies we use:

You can manage or disable cookies at any time through your browser settings. Please be aware that disabling essential cookies will affect core site functionality including checkout and age verification. Instructions for managing cookies vary by browser — search your browser’s help documentation for “manage cookies” for specific steps.

We do not use cookies to collect sensitive personal information such as payment details, government ID data, or precise location beyond what your IP address indicates at a regional level.

Section 07

Data Security

We take the security of your personal information seriously and have put technical and organizational measures in place to protect it against unauthorized access, loss, alteration, or disclosure. These measures include:

• SSL encryption — all data transmitted between your browser and our site is encrypted using industry-standard SSL/TLS protocols. You’ll see the padlock icon in your browser’s address bar confirming this.
• Secure payment processing — payment transactions are handled by a PCI-DSS compliant payment gateway. We never see or store your full card number on our servers.
• Access controls — personal data is accessible only to team members who need it to perform their role. Access is logged and reviewed regularly.
• Regular security reviews — we review our data handling practices and technical infrastructure on an ongoing basis to identify and address potential vulnerabilities.

While we take every reasonable precaution, no method of electronic transmission or storage is 100% secure. In the unlikely event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law — including GDPR obligations for Canadian customers and state breach notification laws for U.S. customers where applicable.

You also play a role in keeping your data secure. If you have an account, choose a strong password, don’t share your login credentials, and contact us immediately via our contact page if you suspect your account has been accessed without your authorization.

Section 08

How Long We Keep Your Data

We keep your personal information only for as long as it is needed for the purpose it was collected, or as required by law. Here is a general guide to our retention periods:

When data is no longer required, it is securely deleted or anonymized so it can no longer be linked back to you. If you would like to request deletion of your data before the end of its standard retention period, see Section 9 below — though please be aware that some data may need to be retained for legal compliance reasons even after a deletion request.

Section 09

Your Rights

Customers in the United States and Canada have the following rights regarding their personal data, subject to applicable law:

• Right to access — you can request a copy of the personal data we hold about you at any time.
• Right to correction — if any information we hold is inaccurate or incomplete, you can ask us to correct it.
• Right to deletion — you can request that we delete your personal data. We will honor this request unless we are required to retain certain data by law (for example, transaction records for tax purposes).
• Right to data portability — you can request that we provide your data in a structured, commonly used format so you can transfer it to another service if you wish.
• Right to restrict processing — you can ask us to stop using your data for certain purposes while a dispute or correction request is being handled.
• Right to object — you can object to the use of your data for any purpose beyond order fulfillment and legal compliance — including any marketing communications.
• Right to withdraw consent — where we rely on your consent to process data (for example, for marketing emails), you can withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us via our contact page and clearly state your request. We will respond within 30 days. In some cases we may need to verify your identity before processing your request to ensure we are disclosing or deleting the right person’s data.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of personal information we collect and the right to opt out of the sale of personal information. We do not sell personal information, so the opt-out right does not currently apply — but all other CCPA rights are fully honored.

Canadian customers have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. These rights are substantially similar to those listed above and are fully honored by our data practices.

Section 10

Children’s Privacy

This website sells age-restricted nicotine and tobacco products and is intended exclusively for adult consumers who meet the minimum legal purchase age in their jurisdiction — 21 in the United States and 18 or 19 in Canada depending on province. We take this obligation seriously and have age-verification measures in place at checkout to enforce it.

We do not knowingly collect, store, or process personal information from anyone below the applicable minimum age. If you are a parent or guardian and believe your child has provided personal information to this site or attempted to place an order, please contact us immediately via our contact page and we will investigate and delete any such data without delay.

If our age-verification systems detect that a user does not meet the minimum age requirement, the order will be cancelled, any data collected during that session will be deleted, and the individual will be blocked from completing a purchase.

Section 11

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the way we operate the site. When we make changes, we will update the “Last updated” date at the top of this page.

For significant changes — such as a new category of data being collected, a new third-party partner being introduced, or a change in how long we retain data — we will make reasonable efforts to notify registered account holders by email in advance of the change taking effect.

Your continued use of this site after any updated Privacy Policy has been posted constitutes your acceptance of the revised policy. If you do not agree with any changes, you may close your account and request deletion of your data by contacting us via our contact page.

We recommend reviewing this page periodically so you are always aware of how your information is being handled. Previous versions of this policy are available on request.

Section 12

Contact & Data Requests

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please reach out through our contact page. We aim to respond to all privacy-related enquiries within 30 days.

When submitting a data request — such as access, correction, deletion, or portability — please include the following in your message so we can handle it efficiently:

• Your full name as used when placing orders on this site.
• The email address associated with your account or order.
• A clear description of your request (e.g. “I would like a copy of all data you hold about me” or “Please delete my account and all associated data”).

We may need to verify your identity before processing your request to ensure we are acting on the correct account. This is a security measure to protect you and will not be used to delay or obstruct a legitimate request.

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. In the United States this may be the Federal Trade Commission (FTC) or your state attorney general’s office. In Canada this is the Office of the Privacy Commissioner of Canada (OPC) or your provincial equivalent.