Privacy policy
Last updated: April 20, 2026
This policy describes how Honest Botanicals ("we", "us", "our") collects, uses, discloses, and protects personal information under Canadian federal and provincial privacy law. It applies to all personal information we hold about you, whether you visit our site, place an order, contact support, or sign up for our newsletter.
The laws that apply to us
In Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs the collection, use, and disclosure of personal information by private-sector organizations. Residents of Quebec are additionally protected by An Act respecting the protection of personal information in the private sector (commonly called "Law 25"), which in 2023 and 2024 introduced enhanced notification, governance, and individual-rights requirements. Alberta and British Columbia have their own Personal Information Protection Acts that apply to residents of those provinces. We apply the most protective standard that covers you.
The categories of personal information we collect
- Identity and contact information: full name, email address, phone number, shipping address, billing address.
- Age verification information: date of birth or an attestation of legal age, captured at the point of purchase in accordance with the Cannabis Act. We record the attestation and the time it was given; we do not retain scans of identity documents.
- Order and account information: order history, product preferences, communications with our support team, and account credentials if you create an account.
- Payment information: we do not store full credit card numbers or full bank account details. Our payment processor handles card data under PCI DSS. We store the payment method summary (card brand, last four digits, expiry) and the transaction identifier for recordkeeping.
- Delivery information: tracking numbers, signature records at delivery (required by the Cannabis Act for any legal cannabis shipment), delivery failures.
- Technical and usage information: device and browser type, IP address, pages viewed, referrer, approximate location derived from IP. We use a privacy-respecting analytics platform and we do not cross-link this data to identified individuals beyond what is required for security and fraud prevention.
How we use your personal information
- To verify that you are of legal age to purchase cannabis products in your province (a Cannabis Act requirement, not optional).
- To process, package, and ship your order, and to provide tracking and delivery confirmation.
- To handle returns, refunds, and customer service inquiries.
- To send transactional email messages related to a specific order (confirmation, shipping notice, delivery confirmation). These are not marketing messages and cannot be unsubscribed from while an active order exists.
- To send marketing or informational email newsletters only where you have given explicit, verifiable consent, and only to the extent permitted under the Cannabis Act's promotion rules. You can withdraw consent at any time using the unsubscribe link in every such message, or by emailing us.
- To detect, prevent, and respond to fraud, abuse, and security incidents.
- To comply with legal obligations — including maintaining records required by the Cannabis Act and the Cannabis Regulations, and responding to lawful requests from government authorities.
The legal basis on which we collect
We collect personal information on the following bases, depending on the type of information and the activity:
- Performance of a contract — information required to fulfil the order you placed.
- Legal obligation — information we are required to collect and retain under the Cannabis Act, the Income Tax Act, or provincial law (for example, age verification, delivery signature, excise tax recordkeeping).
- Explicit consent — information that is optional, such as a marketing newsletter subscription. You can withdraw consent at any time; the withdrawal applies going forward.
- Legitimate interest — limited to fraud prevention, security, and the basic operation of the website.
Who we share personal information with
We share personal information only with the service providers who help us operate the business, and only the minimum information those providers need. Those providers include:
- Payment processors — to authorize and settle transactions.
- Shipping carriers (Canada Post, Purolator) — to deliver your order and to obtain the adult-signature confirmation the Cannabis Act requires.
- Email delivery providers — to send transactional and (with your consent) marketing email.
- Hosting and content delivery providers — to serve this website.
- Analytics provider — to understand site usage in aggregate.
- Federally licensed producers whose products you purchase — but only batch and product-quality information, not your identity, unless a product recall or quality issue requires direct contact.
We do not sell, rent, trade, or otherwise commercially disclose personal information to third parties. We do not share customer lists with third parties for their own marketing.
Cross-border data transfers
Some of our service providers operate infrastructure outside of Canada (primarily the United States). When we transfer personal information outside of Canada, it is subject to the laws of the jurisdiction where the provider operates, which may be different from Canadian law. Under Quebec Law 25, we assess these transfers for adequate protection before they begin and document the assessment. We contract with each such provider to protect your personal information at a level substantially comparable to what Canadian law requires.
How long we keep personal information
- Order records (including the age verification record and delivery signature): 6 years from the order date, as required for Cannabis Act and tax recordkeeping.
- Account information: for as long as your account is active. If you ask to close your account, we retain the minimum information required for the records above and delete the rest within 30 days.
- Marketing list data: for as long as your consent is active. When you unsubscribe, we retain only the minimum record needed to honour the unsubscribe (essentially: your email address, marked as withdrawn).
- Web analytics data: aggregated and retained in a form that does not identify individuals for up to 26 months.
Your rights
Under Canadian privacy law, you have the following rights in respect of your personal information:
- Access — you can ask us for a copy of the personal information we hold about you.
- Correction — you can ask us to correct inaccuracies.
- Deletion — you can ask us to delete your personal information, subject to the records we are required by law to keep.
- Portability — (Quebec residents) you can ask for your information in a structured, commonly used electronic format.
- Withdrawal of consent — you can withdraw consent to marketing communications at any time.
- Complaint — you can complain to our privacy officer, and if unresolved, to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.
Our privacy officer
Under PIPEDA and Law 25, we appoint a privacy officer accountable for our compliance with this policy and the applicable laws. You can reach our privacy officer at privacy@honestbotanicals.co. We will acknowledge requests within 10 business days and respond substantively within 30 days in most cases (or within the timeframes set by law where shorter).
Security
We protect personal information with technical safeguards (encryption in transit, encryption at rest for payment and authentication data, access logging, multi-factor authentication for employee access), organizational safeguards (role-based access, training, formal vendor reviews), and physical safeguards appropriate to the information we hold. No system is perfectly secure, and we commit to notifying affected individuals and the appropriate regulators if a confidentiality incident creates a real risk of significant harm, in accordance with PIPEDA, Law 25, and provincial law.
Cookies and similar technologies
We use cookies for three purposes: keeping your cart and session working (essential); remembering your age-verification status for this device so you are not asked on every visit (essential); aggregate analytics (optional). When you arrive at our site you are asked to accept or decline the optional category. You can change your choice at any time using the "Cookie preferences" link in the footer, or by clearing cookies in your browser.
Children
Our products are sold only to adults of legal age in the buyer's province (21 in Quebec, 18 in Alberta, 19 elsewhere). We do not knowingly collect personal information from minors. If you believe a minor has provided personal information to us, please contact the privacy officer and we will delete it promptly.
Changes to this policy
We update this policy when our practices change or when the law requires. The "last updated" date at the top reflects the most recent revision. Material changes will be announced on our site for at least 30 days before taking effect.
How to contact us
Privacy officer: privacy@honestbotanicals.co
General inquiries: our contact page
Regulators you may also contact: Office of the Privacy Commissioner of Canada; Commission d'accès à l'information du Québec.