Privacy Policy

Dirty Flamingo Cannabis Co. (“we,” “us,” or “our”) is a licensed cannabis retailer operating in Maplewood, Minnesota. We are committed to protecting the privacy of our customers, website visitors, and anyone who interacts with our services. This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, how long we keep it, and what rights you have regarding it.

By visiting our website, using our online ordering system, or doing business with us in-store, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services.

Age Requirement: Our business and this website are strictly intended for adults who are 21 years of age or older. Valid government-issued photo identification is required for entry to our retail location and for the purchase of any recreational cannabis products. We do not knowingly collect information from, or direct services toward, anyone under the age of 21.

1. Information We Collect

We collect personal information in several ways:

a. Information You Provide Directly

• Identity & Contact: First and last name, email address, phone number, and mailing address when you contact us, create an online account, or place an order.
• Age Verification: Date of birth and government-issued identification card details to confirm you are 21 years of age or older, as required under Minnesota Statutes § 342. We collect the information necessary to verify your age and eligibility; we do not retain copies of your physical ID beyond what is required by law.
• Medical Cannabis Information: Where applicable under Minnesota law, medical cannabis registry status, medical card information, and physician details necessary to process medical purchases.
• Purchase & Order Information: Products selected, quantities, pickup time, payment method, order numbers, and transaction history.
• Loyalty Program Data: When you enroll in our Loyalty Pass rewards program, we collect your name, email address, phone number, purchase history, points balance, reward redemption history, and digital wallet information (Apple Wallet or Google Pay) to administer the program and deliver your digital loyalty pass.
• Payment Information: Payment method details. ACH/bank transfer payment details are collected and processed directly by our payment processors (see Section 7 below). We do not store full payment card numbers on our own servers.
• Communications: Messages, feedback, or inquiries you submit through our contact form, email, or in-store interactions.
• Account Credentials: Username and password if you create an account on our online ordering platform.
• Marketing Preferences: Opt-in or opt-out preferences for marketing communications.

b. Information Collected Automatically

When you visit our website, we and our service providers automatically collect:

• IP address, browser type, operating system, device type, screen resolution, and device identifier
• Pages viewed, time spent on pages, navigation paths, access times, and referring URLs
• General geographic information (city, state, or region) inferred from your IP address
• Behavioral data such as mouse movements, clicks, and scrolling patterns, collected via session-replay tools (see Section 6 regarding Microsoft Clarity)

This information is collected using cookies and similar tracking technologies. See Section 6 for more detail.

c. Information From Third Parties

We may receive information about you from our service providers, analytics platforms, and payment processors in connection with the services described in this policy.

2. How We Use Your Information

We use your personal information to:

• Verify your age and legal eligibility to enter our store and purchase cannabis
• Process, fulfill, and communicate with you about your orders
• Operate and maintain our website and online ordering system
• Create and manage your online account
• Administer our loyalty rewards program, track your points balance, and deliver rewards and benefits
• Send you loyalty program notifications, point updates, and reward redemption confirmations
• Process payments and prevent fraud
• Send transactional communications (order confirmations, pickup notifications)
• Send marketing communications, where you have opted in
• Maintain records required by Minnesota cannabis regulations and the Minnesota Office of Cannabis Management (OCM)
• Analyze website usage and improve our products, services, and customer experience
• Create anonymized, aggregated, or de-identified data that does not identify any individual, which may be used for business analytics and service improvement
• Enforce our Terms of Use and other applicable agreements
• Comply with applicable state and federal law
• Protect the rights, property, or safety of Dirty Flamingo Cannabis Co., our customers, or others
• Detect, investigate, and prevent fraudulent, harmful, unauthorized, or illegal activity

3. Cannabis Purchase Records & Minnesota Law

Under Minnesota Statutes § 342 and rules promulgated by the OCM, we are required to maintain certain records related to cannabis sales, inventory, and customer transactions. These records may be subject to inspection by the OCM, law enforcement, or other regulatory authorities as required by law.

We do not sell, rent, or share your cannabis purchase history with third parties for marketing or advertising purposes. We treat purchase records with heightened sensitivity and handle them in accordance with applicable Minnesota privacy and cannabis regulations. We retain such records for a minimum of five (5) years as required by law.

4. Online Ordering Platform & Loyalty Program - Flowhub

Our online ordering system and loyalty rewards program are powered by Flowhub Holdings, Inc. (“Flowhub”), a third-party ecommerce and loyalty platform that enables us to build and operate an online storefront, manage inventory, process pickup orders, and administer customer rewards programs. When you use our online ordering system or sign up for our Loyalty Pass rewards program, your personal information is collected and processed by Flowhub on our behalf.

Loyalty Pass Data: When you enroll in our loyalty rewards program, Flowhub collects and processes your name, email address, phone number, purchase history, points balance, and reward redemption history to administer the program. This information is used to track your points, send you rewards notifications, and deliver your digital loyalty pass to your mobile wallet (Apple Wallet or Google Pay).

Dirty Flamingo Cannabis Co. is the owner and controller of the personal information collected through the Flowhub platform. Flowhub processes that information as our service provider, pursuant to a data processing agreement that requires Flowhub to protect and handle your information consistently with applicable law and this Privacy Policy. Flowhub’s privacy practices for the platform are described in the Flowhub Ecommerce Platform Privacy Statement.

Flowhub may retain, use, or disclose your information only as necessary to provide services to us, comply with legal obligations, resolve disputes, and as detailed in our agreement with them. Flowhub is contractually prohibited from selling your personal information or using it for any commercial purpose beyond providing the platform services described here.

Flowhub may also create anonymized, aggregated, or de-identified data derived from information collected through the platform, which does not identify you or Dirty Flamingo Cannabis Co., and may use such data for its own analytics, product development, and business purposes.

5. Subprocessors & Third-Party Service Providers

We and our platform providers work with trusted third-party vendors (“subprocessors”) who process personal information on our behalf. These may include:

• Cloud hosting and infrastructure providers used to store and operate our website and ordering system
• Payment processors (see Section 6 for Aeropay details)
• Email and communications providers used to deliver order confirmations and marketing messages
• Analytics and behavioral analytics tools (see Section 7 for Microsoft Clarity details)
• Point-of-sale (POS) system software used in-store to process transactions and maintain compliance records

Each of our subprocessors is contractually required to implement data protection obligations that are no less protective than those set forth in this Privacy Policy, and to process personal information only as directed by us and in accordance with applicable law. We are not responsible for the independent privacy practices of any third party that you interact with directly outside of our services.

6. Payment Processing - Aeropay (ACH Bank Transfers)

We have partnered with Aeropay to offer ACH electronic bank transfer payments. When you choose to pay via bank transfer through our online ordering system, you will be creating an Aeropay account and connecting your bank account directly with Aeropay.

Your ACH payment details (bank account information) are collected and processed directly by Aeropay. By using bank transfer payments, you authorize us and Flowhub to share your identifying information with Aeropay to open and support your account. You are responsible for ensuring that the information you provide is accurate and complete.

Your use of Aeropay is also subject to Aeropay’s own privacy policy and terms of service, which may be updated from time to time and are incorporated by reference. We are not responsible for Aeropay’s privacy or security practices and encourage you to review Aeropay’s Privacy Policy before using bank transfer payments.

7. Cookies & Tracking Technologies

Our website uses cookies and similar technologies (e.g., local storage, pixel tags) to operate the site, remember your preferences, and understand how visitors use our pages. You may disable cookies in your browser settings; however, doing so may affect the functionality of certain parts of our site, including the online ordering system. We do not use cookies to track you across unaffiliated third-party websites.

Microsoft Clarity: We use Microsoft Clarity, a behavioral analytics service provided by Microsoft Corporation, to understand how visitors interact with our website. Clarity may record mouse movements, clicks, scrolling behavior, and session replays, and generate heatmaps. Data collected by Clarity is associated with a randomly assigned visitor ID and does not include your name, email, or payment information. Microsoft may use this data in accordance with its own Privacy Statement. You may opt out of Clarity data collection by enabling “Do Not Track” in your browser settings or using a script-blocking browser extension.

8. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers & Subprocessors: With vendors who process data on our behalf to operate the website, fulfill orders, process payments, and deliver communications, subject to contractual data protection obligations (see Section 5).
• Platform Providers: With Flowhub as operator of our ecommerce platform (see Section 4).
• Payment Processors: With Aeropay to facilitate ACH bank transfer payments (see Section 6).
• Legal & Regulatory Authorities: With government agencies, the Minnesota OCM, law enforcement, or other authorities when required by law, court order, subpoena, or to comply with our legal obligations as a licensed cannabis retailer.
• As Directed by You: With any third party you expressly authorize when using our services.
• Business Transfers: In connection with a merger, acquisition, consolidation, reorganization, or sale of all or substantially all of our assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change via a notice posted on our website and, where feasible, by email.
• Protection of Rights: When we reasonably believe disclosure is necessary or appropriate to protect the rights, property, or safety ofDirty Flamingo Cannabis Co., our customers, or others; to investigate or prevent fraud, unauthorized activity, or violations of our Terms of Use; or to comply with applicable law.

9. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of data:

• Cannabis sales records: Minimum of five (5) years as required by Minnesota OCM regulations.
• Account information: Retained while your account is active and for a reasonable period thereafter, or as required by law.
• Communications and inquiries: Retained for the period reasonably necessary to respond and for our records.
• Analytics data: Retained per the data retention settings of each analytics provider (e.g., Microsoft Clarity).

Upon termination of services, any personal information held by our processors or subprocessors on our behalf will be deleted or returned as required by our agreements with them.

10. Security

We and our service providers implement commercially reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. These measures include encrypted transmissions (HTTPS/TLS), access controls, and regular security reviews.

In the event that a security incident results in unauthorized access to personal information, we will take reasonable steps to identify the cause, minimize harm, and prevent recurrence. We will notify affected individuals and applicable authorities as required by Minnesota law and applicable data protection regulations.

No transmission over the internet is 100% secure. Despite our safeguards, we cannot guarantee absolute security of your information, and we disclaim liability for breaches that result from factors outside our reasonable control.

11. Your Rights & Choices

Depending on your state of residence and applicable law, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to our legal obligations and regulatory retention requirements (e.g., OCM-mandated sales records).
• Opt-Out of Marketing: Unsubscribe from marketing communications at any time by following the unsubscribe link in any email, or by contacting us directly.
• Data Portability: Where technically feasible, request that we provide your personal information in a portable format.
• Restrict Processing: Request that we restrict certain processing of your personal information, subject to our legal and regulatory obligations.

To exercise any of these rights, please contact us at Support@DirtyFlamingoCannabis.com. We will respond within the timeframes required by applicable law. Note that certain rights may be limited where we are required by law to retain information (e.g., cannabis sales records required by the OCM) or where the information is necessary to complete a transaction you have requested.

Where personal information has been collected and processed through the Flowhub platform, we will coordinate with Flowhub as necessary to fulfill your data rights requests. Dirty Flamingo Cannabis Co. is the data controller for all such information.

12. Minnesota Residents - Additional Disclosures

Minnesota residents have rights under Minnesota law and applicable state regulations governing cannabis retailers. As a licensed Minnesota cannabis retailer, we are subject to oversight by the Minnesota Office of Cannabis Management (OCM) and may be required to disclose certain records to the OCM, law enforcement, or other regulatory bodies.

We will not discriminate against you for exercising any privacy rights afforded to you under Minnesota law. If you have questions about your rights as a Minnesota resident, please contact us at the address below.

13. California Residents - CCPA Disclosures

Although our primary market is Minnesota, to the extent applicable, we honor California Consumer Privacy Act (CCPA) rights for California residents. Our service providers and platform operators (including Flowhub) are contractually prohibited from:

• Selling California personal information
• Retaining, using, or disclosing California personal information for any purpose other than providing the contracted services
• Retaining, using, or disclosing California personal information outside the direct business relationship between parties

California residents may also submit consumer rights requests (access, deletion, opt-out of sale) by contacting us at Support@DirtyFlamingoCannabis.com.

14. Children’s Privacy - Strict Prohibition on Minors

Our website, services, and retail location are STRICTLY PROHIBITED for use by anyone under 21 years of age. This is a legal requirement under Minnesota recreational cannabis law and federal regulations.

We do not knowingly collect, solicit, request, or use personal information from individuals under the age of 21. We do not knowingly allow anyone under 21 to:

• Access or browse this website
• Create an account on our online ordering platform
• Place an order for recreational cannabis products
• Enter our physical retail location
• Purchase or possess recreational cannabis products from our store

If you are under 21 years of age, you are not authorized to use this website or our services, and you must leave immediately.

By using this website, you represent and warrant that you are at least 21 years of age and legally permitted to purchase recreational cannabis under Minnesota law. Any attempt by a minor to access this website, create an account, or place an order may be reported to law enforcement and the Minnesota Office of Cannabis Management.

If a parent, guardian, or authorized adult believes that a minor has provided personal information to us without authorization, or has attempted to access our services, please contact us immediately at Support@DirtyFlamingoCannabis.com. Upon verification, we will take prompt steps to delete that information from our records and block access as appropriate.

Parents and Guardians: It is your responsibility to ensure that minors in your care do not access this website or cannabis products. Keep all cannabis products secured and out of reach of children. If a child accidentally ingests cannabis, seek immediate medical attention by calling 911 or the Minnesota Poison Control System at 1-800-222-1222.

15. Third-Party Links & Integrated Services

Our website and online ordering system may contain links to, or integrate with, third-party websites and services (such as our online menu hosted at maplewood.dirtyflamingocannabis.com). These third-party services operate under their own privacy policies and are not governed by this Privacy Policy.

We are not responsible for the privacy practices, content, or security of any third-party website or service. You should review the privacy policy of any third-party service before providing your personal information to them.

16. Do Not Track

Some browsers transmit “Do Not Track” signals to websites. At this time, we do not alter our data collection practices in response to Do Not Track signals due to the lack of an industry-wide standard for how such signals should be interpreted. However, you may limit data collection via third-party analytics tools such as Microsoft Clarity by enabling Do Not Track or using a script-blocking browser extension.

17. Targeted Advertising, “Sale” & “Sharing” of Personal Information

We use cookies and similar digital tools to operate this site, perform analytics, and-where enabled-deliver advertising. Some of this activity may be considered a “sale” or “sharing” of personal information for cross-context behavioral advertising under certain state privacy laws, even when no money changes hands.

You have the right to opt out of the sale or sharing of your personal information for targeted advertising. You can exercise this right at any time by:

• Selecting “Manage Cookie Preferences” in our website footer and choosing “Essential Only,” which disables analytics and targeted-advertising cookies; or
• Emailing us at Support@DirtyFlamingoCannabis.com with the subject line “Do Not Sell or Share My Personal Information.”

We do not knowingly sell or share the personal information of consumers under 21 years of age. We also do not sell or share your cannabis purchase history for advertising purposes (see Section 3). We will not discriminate against you for exercising any of these rights.

18. Dispute Resolution & Governing Law

This Privacy Policy and any dispute arising out of or relating to it or your use of our website and services are governed by the laws of the State of Minnesota, without regard to its conflict-of-laws principles.

Before pursuing any formal claim, you agree to first contact us at Support@DirtyFlamingoCannabis.com so that we may attempt to resolve the matter informally and in good faith. Most concerns can be resolved this way.

To the fullest extent permitted by applicable law, any dispute that cannot be resolved informally will be brought exclusively in the state or federal courts located in Minnesota, and you consent to the personal jurisdiction of those courts. Nothing in this section limits any non-waivable rights you may have under applicable law, including the right to bring a complaint before a relevant regulatory authority.

19. Disclaimers & Limitations

This Privacy Policy describes our general practices. Specific situations may vary. The following apply:

• No Warranty: We make no warranty, express or implied, regarding the absolute security or confidentiality of your personal information. Use of our website and services is at your own risk.
• Third-Party Responsibility: We are not liable for the privacy practices or data handling of third-party service providers, platforms, or websites that you access independently of our services.
• Regulatory Compliance: As a licensed cannabis retailer, we are subject to state and local cannabis regulations that may require disclosure of certain information to regulatory authorities, regardless of your consent.
• Evolving Law: Cannabis law, data privacy law, and industry standards are rapidly evolving. We will update this Privacy Policy as necessary to reflect changes in the law and in our practices.
• Aggregated & Anonymized Data: Anonymized or de-identified data that cannot reasonably be used to identify you is not subject to this Privacy Policy and may be used by us and our service providers without restriction.
• Generalizations: While this policy is designed to be comprehensive, it may not address every conceivable data scenario. Where a situation is not explicitly covered, we will handle your information in a manner consistent with the spirit of this policy and applicable law.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or our services. When we make changes, we will update the “Effective Date” at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after the effective date of any changes constitutes your acceptance of the revised policy. Where changes are material, we will make reasonable efforts to notify you via email or a prominent notice on our website.

21. Contact Us

For privacy-related questions, requests, or concerns, please contact us:

Dirty Flamingo Cannabis Co.
Support@DirtyFlamingoCannabis.com
Maplewood, MN

For questions specifically about the Flowhub ecommerce platform’s data practices, please contact our support team at Support@DirtyFlamingoCannabis.com.