Privacy Policy

1. Introduction

RootLeaf ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website and purchase products from us. By using our services, you consent to the data practices described in this policy.

This Privacy Policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation in Canada.

2. Information We Collect

2.1 Personal Information You Provide

We collect personal information that you voluntarily provide when you create an account, place an order, or interact with our services. This information may include your name, email address, phone number, shipping address, billing address, payment information, and date of birth for age verification purposes.

For wholesale accounts, we additionally collect business information including business name, business type, tax identification number, business license number, and business contact details.

2.2 Automatically Collected Information

When you visit our website, we automatically collect certain information about your device and browsing behavior. This includes your IP address, browser type, operating system, referring URLs, pages viewed, time spent on pages, and other diagnostic data. We use cookies and similar tracking technologies to collect this information.

2.3 Age Verification Information

To comply with tobacco sales regulations, we collect and verify your date of birth. This information is used solely to confirm you meet the legal smoking age in your province or territory and is not used for marketing purposes.

2.4 Transaction Information

We collect information about your purchases, including products ordered, quantities, prices, payment method, order history, and shipping details. For wholesale customers, we also track volume purchases, payment terms, and tier status.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Order Processing: To process and fulfill your orders, communicate order status, and provide customer support
• Age Verification: To verify you meet legal age requirements for purchasing tobacco products
• Payment Processing: To process payments securely through our payment processors (Stripe and e-Transfer)
• Account Management: To create and manage your customer or wholesale account
• Loyalty Program: To track your purchases, calculate loyalty points, determine tier status, and provide rewards
• Communication: To send order confirmations, shipping updates, payment reminders, and important account notifications
• Marketing: To send promotional emails about new products, special offers, and loyalty rewards (with your consent)
• Analytics: To understand how customers use our website and improve our services
• Fraud Prevention: To detect and prevent fraudulent transactions and protect our business
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

4. How We Share Your Information

We do not sell your personal information to third parties. We may share your information with the following categories of recipients:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including payment processing (Stripe), shipping and logistics (ShipStation and carriers), email delivery, cloud hosting, and analytics. These providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.2 Business Transfers

If we are involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, such as court orders, subpoenas, or government investigations. We may also disclose information to protect our rights, property, or safety, or that of our users or the public.

4.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

5. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to enhance your experience on our website. Cookies are small text files stored on your device that help us remember your preferences, maintain your session, and analyze website traffic.

We use the following types of cookies:

• Essential Cookies: Required for the website to function properly, including session management and age verification
• Analytics Cookies: Help us understand how visitors use our website and improve performance
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Track your browsing activity to deliver relevant advertisements (with your consent)

You can control cookies through your browser settings. However, disabling certain cookies may limit your ability to use some features of our website.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of sensitive data (such as payment information), secure socket layer (SSL) technology, access controls, and regular security audits.

Payment information is processed through Stripe, a PCI-DSS compliant payment processor. We do not store complete credit card numbers on our servers. For e-Transfer payments, we provide secure instructions and do not collect banking credentials.

While we strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your data.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Information: Retained while your account is active and for a reasonable period after account closure
• Transaction Records: Retained for at least seven (7) years to comply with tax and accounting requirements
• Age Verification Records: Retained to demonstrate compliance with tobacco sales regulations
• Marketing Preferences: Retained until you withdraw consent or request deletion

When we no longer need your information, we will securely delete or anonymize it.

8. Your Privacy Rights

Under Canadian privacy law, you have the following rights regarding your personal information:

• Access: You can request access to the personal information we hold about you
• Correction: You can request correction of inaccurate or incomplete information
• Deletion: You can request deletion of your personal information, subject to legal retention requirements
• Objection: You can object to certain processing of your information, such as marketing communications
• Portability: You can request a copy of your information in a structured, machine-readable format
• Withdrawal of Consent: You can withdraw consent for processing that requires consent

To exercise these rights, please contact us using the information provided in Section 13. We will respond to your request within thirty (30) days. We may need to verify your identity before processing your request.

9. Marketing Communications

With your consent, we may send you promotional emails about new products, special offers, loyalty rewards, and other updates. You can opt out of marketing communications at any time by clicking the "unsubscribe" link in any promotional email or by updating your account preferences.

Please note that even if you opt out of marketing emails, we will still send you transactional emails related to your orders, account, and customer service inquiries.

10. Third-Party Links

Our website may contain links to third-party websites, including social media platforms and payment processors. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

11. Children's Privacy

Our services are not intended for individuals under the legal smoking age. We do not knowingly collect personal information from anyone under the age of 18 (or 19, depending on provincial requirements). If we become aware that we have collected information from a minor, we will take steps to delete that information immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website with a new "Last Updated" date. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at:

RootLeaf Privacy Officer
Email: [email protected]
Website: rootleaf.ca

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.