Effective Date and Scope
This Privacy Policy (“Policy”) is effective as of August 10, 2026. It explains how Holyoke Cannabis, Inc. (“Holyoke Cannabis,” “we,” “us,” or “our”) collects, uses, shares, retains, and protects your personal information.
This Policy applies to all of the following:
- Our website at https://holyokecannabis.com (the “Site”), including the online ordering menu embedded on it;
- The Holyoke Cannabis mobile application for Android and iOS (the “App”), including account creation, ordering, order status, and notifications;
- Our in-store point-of-sale and customer accounts at our licensed dispensary at 380 Dwight St. #3, Holyoke, MA 01040.
We refer to the Site, the App, and our in-store systems together as the “Services.” By using any of the Services, you agree to this Policy. If you do not agree, please do not use the Services.
Who We Are and How to Reach Us
Holyoke Cannabis, Inc. is a licensed adult-use cannabis retailer in the Commonwealth of Massachusetts. We are the party responsible for the personal information described in this Policy (the “data controller”).
For any privacy question, data access request, or deletion request, contact us at:
Holyoke Cannabis, Inc.
380 Dwight St. #3, Holyoke, MA 01040
Email: info@holyokecannabis.com
Phone: (413) 322-8611
Contact form: https://holyokecannabis.com/contact/
We respond to privacy requests within 30 days of receipt.
Age Restriction — 21 and Older Only
The Services are intended solely for adults twenty-one (21) years of age or older. We do not knowingly collect personal information from anyone under 21, and we do not knowingly collect personal information from children under 13 as defined by the Children’s Online Privacy Protection Act (COPPA).
Both the Site and the App require age verification before you can browse products or place an order. Valid, government-issued photo identification is required at every in-store pickup. If we learn that we have collected information from a person under 21, we will delete that information promptly. If you believe a minor has provided us with personal information, contact us at info@holyokecannabis.com.
Information You Provide to Us
When you create an account, place an order, sign up for messages, or contact us through the Site or the App, we collect:
- Identity information — your name and date of birth.
- Contact information — your email address, phone number, and, where applicable, mailing or billing address.
- Age and identification information — information from your government-issued photo ID used to verify that you are 21 or older, as required by Massachusetts law.
- Account credentials — your username and a securely hashed password.
- Order and purchase information — the products you order, order totals, pickup times, and your purchase history.
- Payment information — processed by our payment providers. We do not store full payment card numbers on our own systems.
- Communications — messages, questions, reviews, or feedback you send us.
What the Mobile App Collects
In addition to the information above, the App collects the following categories of data. This section is provided so you can see exactly what the App accesses on your device, and corresponds to the disclosures in our Google Play Data safety listing.
- Personal identifiers — name, email address, phone number, and date of birth, tied to your account.
- Device identifiers — a mobile advertising identifier, an app-instance identifier, and a push notification token used to deliver notifications to your device.
- Device and technical information — device model, operating system and version, app version, language setting, network type, and IP address.
- Approximate location — used to identify the nearest store, confirm you are ordering within a jurisdiction we are licensed to serve, and display accurate pickup information. The App does not collect precise background location. If you grant location permission, you can revoke it at any time in your device settings; the App remains usable with location turned off.
- Purchase history — the products you have ordered and purchased, used to show order history, reorder items, and support loyalty and promotional offers.
- App activity and usage — screens viewed, features used, products browsed, items added to cart, search terms entered within the App, and session length.
- Diagnostics and crash data — crash logs, error reports, and performance data used to fix bugs and improve stability.
The App does not collect your contacts, calendar, photos, camera roll, microphone audio, SMS messages, call logs, health data, or files stored on your device.
Information Collected Automatically on Our Website
When you visit the Site, we and our service providers automatically collect:
- Cookies and similar technologies — including a cookie that records that you passed our 21+ age gate, so you are not asked on every page.
- Device and browser information — browser type, operating system, screen size, referring page, and IP address.
- Usage information — pages viewed, links clicked, time on page, and general navigation patterns.
You can control cookies through your browser settings. Blocking cookies may prevent the age gate and online menu from functioning correctly.
How We Use Your Information
We use the information described above to:
- Verify that you are 21 years of age or older, as Massachusetts law requires;
- Create and maintain your account;
- Process, prepare, and fulfill your orders for in-store pickup;
- Send you transactional messages about your order — order confirmations, readiness alerts, and pickup reminders;
- Provide customer support and respond to your questions;
- Operate loyalty, rewards, discount, and promotional programs you choose to join;
- Send you marketing messages, but only where you have opted in, and only until you opt out;
- Understand how the Site and App are used so we can improve them, fix bugs, and keep them secure;
- Detect, investigate, and prevent fraud, abuse, and unauthorized access;
- Comply with our obligations under Massachusetts Cannabis Control Commission regulations (935 CMR 500.000), tax law, and other applicable federal and state law.
Push Notifications
If you allow notifications, the App may send you push notifications about order status, pickup readiness, and — where you have opted in — promotions and new product drops.
To deliver these, we store a push notification token associated with your device. You can turn push notifications off at any time in your device settings or in the App’s notification preferences, without losing access to the rest of the App. Turning off marketing notifications does not stop essential transactional messages about an order you have already placed.
Third-Party Services We Use
We use the following third-party services to operate the Services. Each one is named here so you know exactly who may process your information on our behalf. Each operates under its own privacy policy.
- Dutchie (Courier Plus, Inc.) — powers our online menu, mobile app, customer accounts, ordering, and point-of-sale. Dutchie processes your account details, age verification information, order and purchase history, and payment information in order to provide these functions to us. Privacy policy: https://dutchie.com/privacy
- Google — Analytics, Play Services, and Firebase Cloud Messaging — website and app analytics, app distribution and integrity checks, crash reporting, and delivery of push notifications. Privacy policy: https://policies.google.com/privacy
- Automattic (Jetpack) — website security, uptime monitoring, and aggregate site statistics. Privacy policy: https://automattic.com/privacy/
- UserWay — the accessibility toolbar on our website. Privacy policy: https://userway.org/privacy/
- WP Engine — our website hosting provider, which stores website data and server logs on our behalf. Privacy policy: https://wpengine.com/legal/privacy/
- Payment processors — used to authorize and settle payments. Card details are handled by the processor; we do not store full card numbers.
We require these providers to protect your information and to use it only to provide services to us — not for their own independent marketing purposes.
How We Share Your Information
We do not sell your personal information, and we do not share it with advertising networks for cross-context behavioral advertising or targeted advertising.
We share personal information only in these circumstances:
- With the service providers named above, strictly to operate the Services on our behalf.
- To comply with the law — including reporting and record-keeping required by the Massachusetts Cannabis Control Commission, state and federal tax authorities, and lawful requests from law enforcement, subpoenas, or court orders.
- To protect rights and safety — where we believe in good faith that disclosure is necessary to prevent fraud, enforce our Terms and Conditions, or protect the safety of any person.
- In a business transfer — if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred, subject to this Policy and any required regulatory approval.
- With your consent — where you have asked us to share information with a third party.
Data Retention — How Long We Keep Your Information
We keep personal information only as long as we need it for the purposes described in this Policy, and then delete it. Specifically:
- Account data (name, email, phone, date of birth, account credentials, saved preferences) — retained while your account is active. If you delete your account, this data is deleted within 30 days.
- Order and purchase history — retained while your account is active and, after account deletion, deleted within 30 days, except for the transaction records described below.
- Age and identification verification records — retained only as long as required to demonstrate compliance with Massachusetts age-verification requirements, then deleted.
- Push notification tokens — deleted within 30 days of you disabling notifications, uninstalling the App, or deleting your account.
- App analytics, usage, and diagnostic data — retained in identifiable form for no more than 14 months, after which it is deleted or retained only in aggregate, non-identifiable form.
- Marketing preferences and opt-out records — retained indefinitely where necessary to honor your opt-out (so we do not contact you again in error).
- Transaction and sales records — Massachusetts Cannabis Control Commission regulations (935 CMR 500.000) and federal and state tax law require licensed cannabis retailers to retain sales and inventory records for a minimum period set by those rules. Where a record is subject to that requirement, we retain it for the required period even after you delete your account, and we restrict its use to regulatory compliance only. We delete it once the required period ends.
- Legal holds — if information is subject to an active legal claim, investigation, audit, or preservation order, we retain it until that matter is resolved.
Backup copies are overwritten on our providers’ normal backup cycles and are fully purged within 90 days of deletion from our live systems.
How to Delete Your Account and Your Data
You can delete your account and the personal data associated with it at any time. There are two ways to do it, and both are self-service.
Option 1 — Delete from within your account (website or App):
- Open the My Account menu.
- Select Account Details.
- Select Delete Account, next to the Save button.
- Confirm when prompted. Your account and associated data will be deleted.
Option 2 — Delete from the web privacy portal:
- Go to https://privacy.dutchie.com/
- Select the Erase your data tile.
- Enter your name and the email address associated with your account.
- Enter the verification code sent to that email address.
- Your data will then be deleted. This action cannot be undone.
The same portal also lets you request a copy of your data and manage your consent settings.
What gets deleted: your account profile, contact details, saved preferences, order and purchase history, and push notification tokens.
What is retained: only the transaction and sales records we are legally required to keep under Massachusetts Cannabis Control Commission and tax rules, plus any information subject to a legal hold, as described in the Data Retention section above. These are retained for regulatory purposes only and are deleted when the required period ends.
How long it takes: deletion requests are processed and completed within 30 days. You will receive a confirmation when the deletion is complete.
If you have trouble with either method, or would prefer we handle the request for you, email info@holyokecannabis.com from the email address on your account, or call (413) 322-8611, and we will process the deletion for you within 30 days.
Your Privacy Rights
Regardless of where you live, you may ask us to:
- Access the personal information we hold about you, and receive a copy of it;
- Correct information that is inaccurate or incomplete;
- Delete your account and personal information, using the methods in the section above;
- Opt out of marketing emails, text messages, and promotional push notifications at any time;
- Withdraw consent you previously gave, without affecting processing that already took place.
Massachusetts does not currently have a comprehensive consumer privacy statute. If you are a resident of California, Colorado, Connecticut, Virginia, or another state with applicable privacy legislation, you may have additional rights, including the right to opt out of any sale or sharing of personal information and the right to appeal a denied request. We do not sell personal information and we do not use it for cross-context behavioral advertising.
To exercise any right, use https://privacy.dutchie.com/ or contact us at info@holyokecannabis.com. We will not discriminate against you for exercising your privacy rights. We may need to verify your identity before acting on a request.
How We Protect Your Information
We use administrative, technical, and physical safeguards designed to protect your personal information, including encryption of data in transit (HTTPS/TLS), encryption of stored account data, access controls limiting employee access to what each role requires, and regular review of our providers’ security practices.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by Massachusetts law.
Marketing Communications and Your Choices
We send marketing messages only to people who have opted in. You can opt out at any time:
- Email — click the unsubscribe link in any marketing email.
- Text messages — reply STOP to any marketing text.
- Push notifications — disable them in your device settings or the App’s notification preferences.
- All channels — email info@holyokecannabis.com and ask to be removed.
We will still send you transactional messages about orders you have placed.
Third-Party Links
The Site and the App may link to third-party websites and services we do not control. This Policy does not apply to those services. We encourage you to read the privacy policy of any third-party service before providing it with personal information.
Changes to This Policy
We may update this Policy from time to time. When we do, we will revise the Effective Date at the top of this page. If we make a material change to how we collect, use, or share your personal information, we will provide additional notice — such as a notice on the Site, an in-App message, or an email to the address on your account — before the change takes effect.
We encourage you to review this Policy periodically. Your continued use of the Services after an update takes effect means you accept the revised Policy.
Contact Us
If you have any question, concern, or complaint about this Policy or how we handle your personal information, contact us:
Holyoke Cannabis, Inc.
380 Dwight St. #3, Holyoke, MA 01040
Email: info@holyokecannabis.com
Phone: (413) 322-8611
Website: https://holyokecannabis.com
Contact form: https://holyokecannabis.com/contact/
To delete your account or request a copy of your data directly, visit https://privacy.dutchie.com/
We respond to all privacy inquiries within 30 days.
