Your data,
on the level.

We collect the minimum information needed to run a clothing shop, send drop alerts, answer support questions, and let people find our cannabis at retail. We don’t sell your personal information, we don’t share it with parties that aren’t directly helping us run the business, and you can ask us what we have on you at any time.

Mr. Exotixx is the data controller. The site runs on a Shopify-backed headless stack, so checkout and payment data also pass through Shopify’s systems under their own privacy terms.

The categories we collect:

• Account & order info: name, email, phone (optional), shipping and billing address, the items you bought.
• Payment info: handled by our payment processor (Shopify Payments / Stripe). We don’t see or store your full card number — we only receive a token and the last four digits for receipts.
• Marketing preferences: drop-alert subscription status, open/click signals on our emails (only if you’ve subscribed).
• Site usage: page views, device/browser type, referring URL, approximate location from IP, cookie identifiers.
• Communications: contact-form submissions, customer-service emails and call notes.

• Process orders, ship them, and handle returns.
• Send drop alerts and account / order emails you’ve signed up for.
• Answer support questions and follow up on contact-form submissions.
• Improve the site — what pages people land on, where checkout drops, what doesn’t work on mobile.
• Detect fraud, enforce our Terms of Drop, and meet legal obligations (tax, age verification, recordkeeping).

We don’t use your information to make automated decisions that significantly affect you.

The categories of cookies on the site:

• Essential: cart, checkout, login, security tokens. Can’t be turned off without breaking the site.
• Analytics: aggregate page-view stats so we can see what’s working. We use a privacy-respectful analytics setup with IP truncation where supported.
• Marketing: only set if you’ve actively subscribed to drop alerts. Email-engagement tracking (opens / clicks) is governed by our email vendor.

You can control cookies through your browser settings. Disabling essential cookies will break checkout.

We share information only with the vendors that help us run the business, and only the data they need:

• Shopify — storefront, checkout, order management, payment processing.
• Shipping carriers — USPS, UPS, FedEx, etc. for delivery.
• Email platform — to send drop alerts and order notifications.
• Analytics provider — aggregated, privacy-respectful measurement.
• Hosting / infrastructure — Vercel for the storefront, and vendors that store our database and email backups.
• Legal & safety — when required by court order, lawful request, or to investigate fraud or abuse.

We do not sell or rent your personal information. We don’t share it with third parties for their independent advertising.

• Account info: while your account is active, plus up to 7 years afterward for tax, accounting, and dispute records.
• Order history: 7 years to satisfy California tax and recordkeeping requirements.
• Marketing preferences: until you unsubscribe or ask us to delete.
• Aggregate analytics: retained at the aggregate level — individual identifiers are not stored long-term.

The site runs on HTTPS end-to-end. Payments are handled by PCI-DSS-compliant processors. Internal access to customer data is limited to the people who need it, and credentials are rotated. We follow industry-standard practices, but no system is 100% secure — if we ever experience a material breach affecting your data, we’ll notify you as required by California law.

If you’re a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know what personal information we collect, use, and share.
• Right to delete personal information we’ve collected, with some legal exceptions (tax records, fraud investigation, etc.).
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We don’t sell — but if you want to opt out anyway you can.
• Right to limit use of sensitive personal information.
• Right to non-discrimination — we won’t penalize you for exercising any of these rights.

To exercise any of these, contact us via the methods in section 13. We may ask you to verify your identity before fulfilling the request, and we’ll respond within 45 days.

If you’re in the European Economic Area or the United Kingdom, you have the rights to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. The lawful bases we rely on are:

• Contract performance — to fulfill orders and provide customer service.
• Legitimate interest — to operate, secure, and improve the site, balanced against your rights.
• Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation — for tax, accounting, fraud prevention, and other compliance requirements.

If you’re unhappy with how we handle your data you can lodge a complaint with your local data protection authority.

The site is intended for adults. You must be at least 18 to make a purchase and 21 or older to engage with cannabis content. We don’t knowingly collect personal information from children. If you believe a minor has submitted information, contact us and we’ll delete it.

The dispensary locator on this site is informational. Search queries you type into the locator are processed in your browser — we don’t store your search terms tied to your identity. We do not share any cannabis-related interest data with third-party advertising networks.

Cannabis purchases happen at licensed dispensaries, not on this site. Each dispensary handles its own customer data under its own policies and California cannabis regulations.

We’ll update this policy as the business and the law change. The “Last Updated” date at the top of the page reflects the most recent revision. Material changes will be announced on the site and, if you’re on the email list, by email.

Privacy questions, rights requests, or breach concerns:
Mr. Exotixx · California
Contact: /contact