PIPE420 PRIVACY POLICY

Pipe420 Inc. ("Pipe420," "we," "us," or "our") respects the privacy of our users ("user" or "you"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website pipe420.com and any related mobile applications, social pages, storefronts, marketing channels, or services, including any other media form, media channel, mobile website, or mobile application related or connected thereto (collectively, the "Site").

Please read this Privacy Policy carefully.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last Updated" date of this Privacy Policy. Any changes or modifications will be effective immediately upon posting the updated Privacy Policy on the Site, and you waive the right to receive specific notice of each such change or modification. You are encouraged to periodically review this Privacy Policy to stay informed of updates. You will be deemed to have been made aware of, will be subject to, and will be deemed to have accepted the changes in any revised Privacy Policy by your continued use of the Site after the date such revised Privacy Policy is posted.

1. Collection of Your Information

We may collect information about you in a variety of ways. The information we may collect on the Site includes:

Personal Data

Personally identifiable information, such as your name, shipping address, billing address, email address, telephone number, date of birth, and demographic information, such as your age, gender, hometown, and interests, that you voluntarily give to us when you register with the Site, place an order, create an account, sign up for marketing, or when you choose to participate in various activities related to the Site, such as online chat, reviews, surveys, giveaways, loyalty programs, or customer support.

You are under no obligation to provide us with personal information of any kind; however, your refusal to do so may prevent you from using certain features of the Site, including checkout, shipping, account creation, promotions, or support.

Derivative Data

Information our servers automatically collect when you access the Site, such as your IP address, browser type, device type, operating system, referring URLs, access times, pages viewed, session duration, clicks, cart activity, and interaction data before and after accessing the Site. This includes device identifiers, advertising IDs, approximate geolocation data (city/state), fraud-risk indicators, behavioral analytics, and session fingerprinting used for security, analytics, personalization, advertising, and fraud prevention.

Financial & Transaction Data

When you place an order, we collect order history, product selections, shipping method, IP address, and payment authorization data. Pipe420 does not store or process full credit card numbers. Payments are processed by third-party payment processors such as Shopify Payments, Stripe, PayPal, Apple Pay, Google Pay, and Affirm, which process your payment information in accordance with their own privacy policies.

Data from Contests, Giveaways, and Surveys

Personal and other information you may provide when entering promotions, giveaways, influencer campaigns, or responding to surveys or marketing research.

Mobile, SMS, and Push Notifications

If you opt into SMS, email, or push notifications, we may collect your phone number, email address, and messaging interaction history. Message and data rates may apply. You may opt out at any time.

Sensitive Personal Information (California CPRA)

We may collect, process, and use Sensitive Personal Information, including but not limited to:

• Account login credentials
• Payment method tokens
• Precise device identifiers
• Approximate geolocation
• Government-issued identification (if required for fraud prevention or legal compliance)
• Age-verification data
• Purchase history and behavioral data

This data is used strictly for security, fraud prevention, legal compliance, order fulfillment, and account protection. California residents have the right to limit the use and disclosure of Sensitive Personal Information as permitted by law.

2. Use of Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. We may use information collected about you to:

• Create, manage, and authenticate your account
• Process and fulfill orders, payments, refunds, and shipping
• Provide customer service and respond to inquiries
• Deliver transactional emails and SMS (order status, receipts, delivery updates)
• Send marketing communications, promotions, and newsletters
• Provide personalized product recommendations
• Deliver targeted advertising on Meta, Google, TikTok, Snapchat, and other platforms
• Prevent fraud, theft, abuse, and unauthorized transactions
• Comply with legal obligations
• Conduct analytics and business intelligence
• Improve Site performance, conversion rates, and user experience
• Enforce our Terms of Use
• Run promotions, sweepstakes, and loyalty programs
• Perform internal business operations
• Support law enforcement or regulatory requests

Automated Decision-Making

We use automated systems to detect fraud, assess payment risk, evaluate order legitimacy, prevent abuse, and determine eligibility for promotions or shipping options. These systems may make decisions based on your device, location, transaction patterns, and behavioral data.

3. Disclosure of Your Information

We may share information we have collected about you in the following situations:

By Law or to Protect Rights

If required to do so by law, subpoena, court order, regulatory authority, or if necessary to investigate fraud, abuse, security incidents, or violations of our policies.

Service Providers

We share data with vendors who help us operate our business, including:

• Payment processors
• Shipping carriers (USPS, UPS, FedEx)
• Fraud prevention services
• Marketing platforms (Meta, Google, TikTok, Klaviyo, SMS providers)
• Website hosting and analytics providers

These vendors are contractually required to protect your data.

Sale or Sharing of Personal Data for Advertising

Under California law, sharing data for cross-context behavioral advertising (including Meta, Google, and TikTok advertising) may be considered a "sale" or "share" of personal information. You have the right to opt out of this data sharing.

Affiliates & Business Transfers

If Pipe420 merges, is acquired, reorganizes, or sells assets, your data may be transferred to the successor entity. We may share your information with our business partners to offer you certain products, services, or promotions.

Other Third Parties

We may share your information with advertisers and investors for the purpose of conducting general business analysis. We may also share your information with such third parties for marketing purposes, as permitted by law.

Sale or Bankruptcy

If we reorganize or sell all or a portion of our assets, undergo a merger, or are acquired by another entity, we may transfer your information to the successor entity. If we go out of business or enter bankruptcy, your information would be an asset transferred or acquired by a third party. You acknowledge that such transfers may occur and that the transferee may decline honor commitments we made in this Privacy Policy.

We are not responsible for the actions of third parties with whom you share personal or sensitive data, and we have no authority to manage or control third-party solicitations. If you no longer wish to receive correspondence, emails or other communications from third parties, you are responsible for contacting the third party directly.

4. Tracking Technologies

We use cookies, pixels, web beacons, and similar technologies to:

• Remember cart and login
• Analyze traffic
• Improve advertising performance
• Measure conversions

You can manage cookies in your browser or device settings.

Global Privacy Control (GPC)

We recognize and honor Global Privacy Control (GPC) signals as valid opt-out requests under applicable law.

5. Third-Party Websites

We are not responsible for third-party sites, including social platforms, payment providers, or external links.

6. International Data Transfers

Your information may be transferred to, processed, and stored in the United States and other countries where our servers, service providers, or partners operate. These countries may have different data protection laws than your country of residence.

7. Data Retention

We retain personal information only as long as necessary for:

• Account maintenance
• Order fulfillment
• Fraud prevention
• Tax and legal compliance
• Dispute resolution
• Marketing (until you opt out)

Certain records may be retained as required by law.

8. Security of Your Information

We use encryption, firewalls, secure servers, and access controls. No system is 100% secure.

9. Policy for Children

As Pipe420, we do not knowingly solicit information from or market to children under the age of 13. If you become aware of any data, we have collected from children under age 13, please contact us using the contact information provided below. We do not knowingly collect data from anyone under 13 or under 21.

Age, ID & Fraud Protection

Pipe420 may collect and verify personal information including name, address, phone number, email, IP address, payment data, and age verification information for the purpose of fraud prevention, legal compliance, payment processing, and fulfillment of regulated hemp-derived products. Pipe420 may use third-party verification services to confirm age, identity, or transaction legitimacy. By placing an order, you consent to this verification process and acknowledge that orders may be delayed, rejected, or canceled if verification cannot be completed.

10. Your Privacy Rights

CCPA & CPRA Rights (California)

California residents have the right to:

• Know what personal data we collect
• Request deletion
• Request correction
• Opt-out of sale or sharing
• Limit use of sensitive personal data
• Not be discriminated against for exercising rights

Submit requests to: [email protected]

California Privacy Rights (Shine The Light)

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with the Site or our mobile application, you have the right to request removal of unwanted data that you publicly post on the Site or our mobile application. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Site or our mobile application, but please be aware that the data may not be completely or comprehensively removed from our systems.

GDDR Rights (EU / UK)

If you are located in the EU or UK, you have the right to access, correct, delete, restrict, or object to processing of your personal data.

Do-Not-Track

We do not currently respond to DNT browser signals, except as required by Global Privacy Control (GPC). Most web browsers and some mobile operating systems and our mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.

11. Options Regarding Your Information

Account Information

You may at any time review or change the information in your account or terminate your account by:

• Logging into user account settings and updating the user account.
• Contacting us using the contact information provided.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or comply with legal requirements.

Emails and Communications

If you no longer wish to receive correspondence, emails, or other communications from us, you may opt-out by contacting us using the contact information provided.

If you no longer wish to receive correspondence, emails, or other communications from third parties, you are responsible for contacting the third party directly.

12. Contact Us

If you have questions or comments about this Privacy Policy, please contact us at: