Privacy Policy

KrystaLeaves — Privacy Policy

Your privacy is important to us. This Privacy Policy explains the personal information that d/b/a KrystaLeaves ("KrystaLeaves," "we," "us," or "our") collects, uses, discloses, protects, and stores when an individual ("you") shops with us or interacts with us — whether through our website at www.krystaleaves.com (the "Website"), our online ordering menu and related e-commerce features (the "Platform"), any mobile application or delivery service we may offer (together, the "Service"), or in person at one of our licensed retail locations ("In-Store"). The Website, Platform, Service, and In-Store experience are referred to collectively as the "Solution."

KrystaLeaves is a cannabis retailer licensed in the State of Colorado. We use third-party technology providers to operate parts of the Solution, including our point-of-sale and e-commerce platform.

Personal Information We Collect

Personal information is information that can be used to identify or contact a specific individual. Depending on how you interact with us, we may collect the following categories of personal information. We have collected these categories within the last twelve (12) months.

Information collected online (Website and Platform)

What we collect How we collect it Why we collect it
Personal identifiers, including name, postal address (where delivery is offered), email address, phone number, and date of birth	You provide this information directly when you create an account, place an order, or contact us	To verify eligibility, create and maintain your customer profile, and complete your transaction
Identity and age verification information, such as an image of a government-issued ID and, where applicable, a medical marijuana card or physician recommendation	You upload or present these documents; we may temporarily retain images	To confirm you are legally eligible to purchase cannabis products under Colorado law
Order details, including items and quantities ordered, pickup or delivery time, and pickup or delivery location	You provide this information as part of placing an order	To process, prepare, and fulfill your order
IP address, device information, browsing and search activity, general location, and information about how you interact with the Solution	Automatically recorded when you use the Website or Platform	To understand, maintain, secure, and improve the Solution
Products purchased or viewed	Automatically recorded as you shop	To understand customer preferences and maintain and improve our product selection
Information you submit through contact, feedback, or sign-up forms	You provide this information directly	To respond to your questions and, where you have opted in, to send you news and offers

Information collected in-store

What we collect How we collect it Why we collect it
Age and identity verification information, such as a valid government-issued ID and, where applicable, a medical marijuana card or physician recommendation	We require customers to present verification documents and proof of age as required by state law	We are required by Colorado law to confirm that customers are of legal age to participate in an adult-use or medical cannabis program
Contact information you choose to provide, such as an email address or phone number	You may choose to provide it at checkout or when enrolling in a loyalty or rewards program	To administer loyalty and rewards programs and to send you information consistent with your preferences
Transaction information, including products purchased, quantities, and amounts	Recorded at the point of sale	To complete your purchase, meet state recordkeeping and reporting requirements, and administer rewards

If you would like more detail about the specific information associated with your account or a particular transaction, please contact us at feedback@krystaleaves.com.

How We Use Personal Information

We use the personal information you provide to communicate with you and to provide the Solution. For example, we use personal information to:

verify your age and eligibility to purchase cannabis products;
create, service, and secure your customer account;
process, prepare, and fulfill your orders, including pickup and, where offered, delivery;
administer loyalty, rewards, and promotional programs;
respond to your questions, requests, and feedback, and provide customer support;
inform you about products, deals, or promotional offers, where permitted and consistent with your preferences; and
operate our business, which includes analyzing performance, meeting our legal and regulatory obligations, and improving our products and service.

Where a third party is involved in fulfilling your order (for example, a delivery provider or payment processor), we share only the information reasonably necessary to complete the transaction.

When we ask you to provide personal information, you may decline. If you do, you may not be able to use certain features of the Solution or complete a purchase.

Compliance With State Law and Regulation

We operate under Colorado cannabis law and regulation, and our collection, use, disclosure, retention, and protection of personal information is designed to comply with those requirements. Certain information — including age and identity verification records and transaction records — is collected and retained because state law requires it. In the event of a conflict between this Policy and any applicable state law or regulation, we will act in accordance with state law and regulation.

Non-Personal Information

We also collect information in a form that does not, on its own, identify a specific individual ("non-personal information"). We may collect, use, transfer, and disclose non-personal information to improve the Solution, customize the customer experience, or for any other legitimate purpose, including aggregating it to track trends and analyze usage patterns. Examples include language, ZIP code, area code, device identifiers, referring URL, general location, and aggregated activity on the Website.

This Privacy Policy does not limit our use or disclosure of non-personal information. If we combine non-personal information with personal information, we will treat the combined information as personal information for as long as it remains combined. We do not currently respond to "do not track" signals sent by web browsers.

Cookies and Other Technologies

We and our third-party providers use cookies, pixels, tags, and similar technologies to understand how the Solution is used, to improve its performance, and to help deliver more relevant advertising. These technologies may collect information such as time of visit, pages viewed, time spent on the Solution, device identifiers, operating system, and other websites you may have visited. Third-party providers may combine information collected through the Solution with information they obtain from other sources.

We do not have access to, or control over, third parties' use of cookies and similar technologies. You may be able to refuse or limit cookies through your browser settings; if you do, some features of the Solution may not function properly. By continuing to use the Solution, you consent to the use of these technologies as described above.

Sharing Information With Third Parties

We may engage third-party companies and individuals to help us operate the Solution and run our business — for example, our point-of-sale and e-commerce technology provider, payment processors, delivery providers, hosting and database providers, analytics providers, marketing and messaging platforms, and state-mandated compliance and inventory tracking systems.

For these business purposes, we may disclose the following categories of personal information: identifiers, customer records information, commercial information, internet or other electronic network activity information, and geolocation data. These third parties receive access only to the extent needed to perform services on our behalf, and we require them by contract to protect and safeguard your personal information in accordance with applicable law. While we require third parties to follow applicable law and do not authorize them to use your information for any purpose other than the one for which it was provided, we are not responsible for the independent acts or policies of third parties.

We do not sell your personal information for money. If our practices change, we will update this Policy and provide any notice and choice required by applicable law.

It may also be necessary for us to disclose your personal information in response to law, legal process, litigation, or a request from a public, regulatory, or governmental authority, or where we determine in good faith that disclosure is reasonably necessary to enforce our terms, investigate suspected fraud, or protect the Solution, our business, our customers, or the public. In the event of a reorganization, merger, financing, or sale of assets, we may transfer personal information to the relevant party.

Messaging

By providing your mobile phone number and/or email address, you expressly consent to receive informational and transactional messages from us at the number or address provided. Consent to marketing messages is not a condition of purchase. Standard call, message, and data rates may apply. You may opt out of marketing messages at any time by following the unsubscribe instructions in the message or by contacting us at feedback@krystaleaves.com.

Protecting Your Personal Information

We and our service providers implement security measures designed to protect your information from unauthorized access, disclosure, or accidental loss or destruction, including appropriate physical, technical, and administrative safeguards. Our systems and those of our technology providers are hosted in secure data centers located in the United States.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please also be aware that certain information you provide in connection with your use of the Solution may be stored on your own device. You are responsible for maintaining the security of your device and your account credentials.

Your Choices Concerning Personal Information

You can make choices about our collection and use of your information. For example, you can:

use the "unsubscribe" link in our emails, or reply with the opt-out keyword to our text messages, to stop receiving marketing communications;
decline to provide optional information, such as contact details for loyalty or marketing purposes;
disable location services on your device to prevent the Website or app from obtaining your location (note that certain features may then be unavailable); and
contact us to request access to, correction of, or deletion of personal information we hold about you.

Not all information can be deleted on request. We are required to retain certain records — including age verification and transaction records — for periods set by Colorado law and regulation.

To exercise any of these choices, or if you have questions about information not covered by the tools above, contact us at feedback@krystaleaves.com.

State Privacy Rights

Depending on where you live, you may have additional rights regarding your personal information — including the right to request the categories and specific pieces of personal information we have collected about you, the categories of sources of that information, the business purposes for collecting it, the categories of third parties with whom we share it, and the right to request correction or deletion of that information. Where applicable law provides these rights, you also have the right to opt out of targeted advertising and the sale of personal information, and the right not to receive discriminatory treatment or a lesser level of service for exercising your rights.

Colorado residents have these rights under the Colorado Privacy Act. Residents of other states may have comparable rights under their own state laws.

To submit a request, email us at feedback@krystaleaves.com with the details of your request. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law. You may use an authorized agent to submit a request on your behalf where the law permits.

Our Policy Concerning Minors

You must be at least 21 years of age — or, where we serve medical cannabis patients, a valid registered patient of the minimum age permitted under Colorado law — to purchase from us or create an account. The Solution is not directed to minors, and we do not knowingly collect or use personal information from anyone under these ages. If we become aware that an underage individual has provided us with personal information, we will delete that information and any associated account.

Users Outside of the United States

The Solution and the servers on which it is hosted are located in the United States and are intended only for use by individuals in the United States. Information you submit through the Solution will be transferred to and stored in the United States. By using the Solution and submitting information, you authorize this transfer. The Solution is not designed for, targeted to, or offering goods or services to individuals located in the European Union.

Changes to This Privacy Policy

We may occasionally update this Privacy Policy. When we do, we will post the updated Policy and revise the "Last Updated" date above. Please review this Policy periodically to stay informed about how we protect the information we collect. If you continue to use the Solution after we post an update, you are indicating your acceptance of the updated Policy.

Contact Us

If you have any questions about this Privacy Policy, or if you would like additional information about how we handle your personal information, please contact us:

KrystaLeaves 755 S Federal Blvd, Unit 4 & 5, Denver, CO 80219 Phone: (303) 802-0026 Email: feedback@krystaleaves.com Web: www.krystaleaves.com

We are happy to provide further detail on request.