1. Scope
This Policy applies to information we collect from Consumers, Licensed Retailers, Delivery Partners, applicants, and visitors of the Platform. It does not apply to third-party services (e.g., PayPal, Google, your mobile carrier), which have their own privacy policies.
2. Information We Collect
a. Information you provide. Name, date of birth, email address, mobile phone number, delivery address(es), account password (stored hashed), photo of government-issued ID and optional selfie for age verification, retailer license information (for Licensed Retailer applicants), driver license and vehicle information (for Delivery Partner applicants), Order details, product reviews, chat messages sent to Buddy AI, and any communications you send us.
b. Information collected automatically. Device and browser type, operating system, IP address, approximate geolocation (city / ZIP derived from IP or, with your permission, precise geolocation for delivery), language, referrer URL, pages viewed, session duration, cookies and similar identifiers, and error and performance logs.
c. Information from third parties. Payment status and last-4 / brand of saved cards from PayPal (never the full card number); identity verification signals from our automated verification provider; map and geocoding data from Google Maps; SMS delivery status from SMS providers; authentication identifiers from social sign-in providers (e.g., Google, Apple) when you use them.
3. Sensitive Information
Under New York and California law, certain information we collect is considered sensitive, including government-issued identifiers, biometric-adjacent identifiers (ID photo and optional selfie used solely for age/identity verification), and precise geolocation used to fulfill delivery. We do not use sensitive information for purposes other than those described in this Policy or permitted by law.
4. How We Use Information
- Create and manage your account and Orders.
- Verify age and identity (a legal requirement under New York cannabis law).
- Facilitate payment processing and tax collection.
- Facilitate delivery, including sharing your address with the fulfilling Licensed Retailer and Delivery Partner.
- Provide customer support and respond to inquiries.
- Send transactional communications (order updates, receipts, account and security notices).
- Send marketing communications where you have opted in (unsubscribe anytime).
- Improve, personalize, and secure the Platform (including analytics and fraud prevention).
- Operate Buddy AI features and improve model responses (see Section 12).
- Comply with OCM reporting requirements and other legal obligations.
- Enforce our Terms of Service and applicable policies.
5. Legal Bases (for users protected by GDPR / UK GDPR)
Where applicable, we rely on: (a) performance of a contract (to provide the Platform and fulfill Orders); (b) legal obligation (e.g., age verification, tax, OCM reporting); (c) legitimate interests (fraud prevention, security, service improvement); and (d) consent (marketing, precise geolocation, biometric-adjacent identifiers).
6. How We Share Information
We do not sell your personal information for money. We share personal information only as follows:
- Licensed Retailers — Your Order details, name, delivery address, and phone number to enable them to fulfill your Order.
- Delivery Partners — Your name, delivery address, phone number, and Order details to enable delivery and age verification at drop-off.
- Service providers — Payment processors (PayPal), hosting and database infrastructure, identity verification vendors, map / geocoding providers, email and SMS providers, error reporting, and analytics vendors, each acting under contract on our behalf.
- Regulators — Aggregated or de-identified sales data with the New York State Office of Cannabis Management or other agencies as required by law, and specific records in response to lawful requests.
- Law enforcement — When compelled by valid legal process or to protect the safety of Users or the public.
- Corporate transactions — In connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
- With your consent — Any other sharing you direct or authorize.
7. “Sale” and “Sharing” Under State Privacy Laws
We do not sell personal information in exchange for money. We do not share personal information for cross-context behavioral advertising. Certain disclosures to service providers may nonetheless be treated as “sharing” or “sale” under some state definitions. You may opt out of any such activity by emailing privacy@oven.tools with the subject line “Do Not Sell or Share My Personal Information.”
8. Cookies and Similar Technologies
We use first-party cookies and localStorage for authentication, cart persistence, session management, security, and basic analytics. We do not use third-party advertising trackers. Where required by law, we present a cookie notice and, where applicable, honor Global Privacy Control (GPC) signals.
9. Data Retention
We retain personal information only as long as necessary for the purposes described in this Policy or as required by law:
- Account data — for the life of your account and up to 7 years thereafter for tax and regulatory compliance.
- Order and transaction records — 7 years (New York tax law).
- ID verification records — deleted within 90 days of successful verification, except where required to be retained under OCM rules.
- Chat messages — up to 24 months.
- Server, security, and error logs — up to 24 months.
10. Security
We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS 1.2+), encryption at rest for identity documents, hashed passwords, least-privilege access controls, audit logging, and regular vulnerability scanning. No system is 100% secure, and we cannot guarantee absolute security.
11. Age Restriction
The Platform is not directed to anyone under 21, and we do not knowingly collect information from anyone under 21. If we learn that we have collected information from a person under 21, we will delete it and terminate the account.
12. Buddy AI
When you interact with Buddy AI, your messages, related Order context (if any), and Platform metadata are sent to the AI provider we use (currently the Lovable AI Gateway) to generate a response. We do not use your chat content to train third-party foundation models beyond ephemeral inference. We may retain chat transcripts to improve service quality, safety, and personalization. Buddy AI is informational and does not provide medical, legal, or professional advice.
13. Your Privacy Rights
Depending on your jurisdiction, you may have the right to (a) know what personal information we hold; (b) access or receive a copy; (c) correct inaccurate information; (d) request deletion; (e) opt out of “sale,” “sharing,” or targeted advertising; (f) limit use of sensitive personal information; (g) withdraw consent; and (h) not be discriminated against for exercising rights. To exercise a right, email privacy@oven.tools. We may need to verify your identity before responding. You may designate an authorized agent. If we decline your request, you may appeal by replying to our response.
14. California Residents (CCPA / CPRA)
In addition to Section 13, California residents may request the categories and specific pieces of personal information collected, the sources, business purposes, and categories of third parties with whom the information is shared. We do not knowingly sell or share personal information of consumers under 16.
15. Other State Privacy Laws
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights substantially similar to those in Section 13, subject to state-specific limitations. Contact privacy@oven.tools to exercise these rights.
16. International Users
The Platform is intended for use within the State of New York. If you access it from elsewhere, you understand that your information may be transferred to and processed in the United States, which may have different privacy laws than your jurisdiction.
17. Third-Party Links & Services
The Platform may link to third-party websites or services. Their privacy practices are governed by their own policies. We are not responsible for their content or privacy practices.
18. Do Not Track
We do not currently respond to browser “Do Not Track” signals but do honor Global Privacy Control (GPC) signals where legally required.
19. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will notify you by email or in-app notice at least seven (7) days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance.
20. Contact Us
Oven LLC
Privacy inquiries: privacy@oven.tools
General support: support@oven.tools
Website: www.oven.tools
This Privacy Policy is the Platform’s public-facing statement and is not legal advice. Oven LLC recommends that Users consult qualified counsel regarding their individual rights.