Privacy policy
Effective Date: July 18, 2026
Last Updated: July 18, 2026
Grassroots California ("Grassroots California," "we," "us," or "our") respects your privacy and is committed to protecting it through this Privacy Policy. This policy explains what personal information we collect, how we use it, how we share it, and the choices and rights available to you when you visit grassrootsca.com or grassrootscustoms.com (each, the "Site") or make a purchase from us.
By using the Site, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Site.
1. Information We Collect
Information you provide directly:
- Name, address, email address, and phone number
- Billing and payment details (processed securely through our payment processor; we do not store full payment card numbers)
- Account credentials, if you create an account
- Order history and purchase details
- Communications you send us, including customer service inquiries, product reviews, and wholesale or custom inquiry submissions
- Loyalty and rewards program activity (Smile.io)
Information collected automatically:
- IP address, device type, browser type, and operating system
- Pages viewed, time spent on pages, links clicked, and referring/exit pages
- Approximate geographic location (derived from IP address)
- Cookie and pixel data (see Section 3, "Cookies & Tracking Technologies")
Information from third parties:
- Information from our ecommerce platform (Shopify), email/SMS marketing platforms (Klaviyo, Attentive), mobile app and push notification provider (Tapcart), advertising partners (such as Meta and Google), reviews platform (Stamped), loyalty platform (Smile.io), returns and customer service platform (Redo), and CRM (Nutshell)
2. How We Use Your Information
We use the information we collect to:
- Process and fulfill orders, including payment, shipping, and customer service
- Communicate with you about your orders, account, or inquiries
- Send marketing communications via email, SMS, and push notification, where you have opted in or as otherwise permitted by law
- Personalize your shopping experience and show you relevant products and drops
- Operate, maintain, and improve the Site
- Administer our rewards and loyalty program
- Process wholesale and custom merchandise inquiries submitted through Grassroots Customs
- Detect, prevent, and address fraud, security, or technical issues
- Comply with legal obligations
We do not use your information for automated decision-making that produces legal or similarly significant effects concerning you.
3. Cookies & Tracking Technologies
We and our third-party partners use cookies, pixels, tags, local storage, and similar technologies ("Tracking Technologies") to operate the Site, remember your preferences, analyze traffic, and deliver advertising.
| Category | Purpose | Examples |
|---|---|---|
| Strictly Necessary | Required for core site function (cart, checkout, security, login) | Shopify session cookies |
| Analytics | Understand site traffic and usage patterns | Google Analytics, Microsoft Clarity |
| Marketing/Advertising | Deliver and measure targeted ads | Meta Pixel, Google Ads tag |
| Email & SMS | Track engagement with marketing messages and sync customer activity | Klaviyo, Attentive |
| Push Notifications | Deliver and measure app-based push messages | Tapcart |
| Functional | Enable features like loyalty tracking, reviews, and CRM form capture | Smile.io, Stamped, Nutshell |
Non-essential Tracking Technologies (analytics, marketing/advertising, and functional categories above) will not activate until you provide consent through our cookie banner, where required by law.
Managing your cookie preferences: You can control cookies through your browser settings at any time. Note that blocking certain cookies may affect Site functionality.
Global Privacy Control (GPC): If your browser sends a Global Privacy Control signal, we will treat it as a valid request to opt out of the sale/sharing of your personal information, without requiring further action from you.
4. How We Share Your Information
We share personal information with the following categories of recipients:
- Service providers: Our ecommerce platform (Shopify), email/SMS marketing platforms (Klaviyo, Attentive), push notification provider (Tapcart), payment processors, shipping and fulfillment partners, returns and customer service tools (Redo), reviews platform (Stamped), loyalty platform (Smile.io), and CRM (Nutshell), who process information on our behalf.
- Advertising and analytics partners: Meta, Google, and similar platforms, for the purposes described in Section 3, where you have consented.
- Legal and safety purposes: When required to comply with law, respond to legal process, or protect the rights, property, or safety of Grassroots California, our customers, or others.
- Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
We do not sell your personal information for money. Depending on your state's definition of "sale" or "sharing" (which may include disclosures for targeted advertising), some of the sharing described above may qualify as a "sale" or "share" under applicable law. You can opt out below.
5. Your Privacy Rights
For California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we have collected, used, disclosed, and sold/shared about you
- Delete personal information we have collected from you, subject to certain exceptions
- Correct inaccurate personal information
- Opt out of the sale or sharing of your personal information
- Limit the use of sensitive personal information
- Non-discrimination for exercising any of these rights
To opt out of the sale/sharing of your personal information, visit our [Do Not Sell or Share My Personal Information] page.
To submit a privacy request (access, deletion, or correction), email us at customerservice@grassrootscalifornia.com with the subject line "Privacy Request." We will verify your identity before processing your request and will respond within the timeframe required by law.
You may also designate an authorized agent to make a request on your behalf, subject to our ability to verify that authorization.
For European (GDPR) and UK Visitors
If you are located in the EEA, UK, or Switzerland, you have the right to:
- Access, correct, or delete your personal data
- Restrict or object to our processing of your data
- Data portability
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local data protection authority
We rely on the following legal bases to process your data: your consent, performance of a contract with you, our legitimate interests (such as improving our Site and preventing fraud), and compliance with legal obligations.
To exercise these rights, email customerservice@grassrootscalifornia.com.
For Other US State Residents
If you reside in a state with a comprehensive privacy law (including but not limited to Colorado, Connecticut, Virginia, and others), you may have similar rights to those described above. Contact us at customerservice@grassrootscalifornia.com to exercise these rights, and we will honor applicable state requirements.
6. SMS & Email Marketing
If you opt in to receive SMS or email marketing from us, you agree to receive recurring automated marketing messages at the number/email provided. Consent is not a condition of purchase.
To unsubscribe from email, click "unsubscribe" at the bottom of any marketing email. To unsubscribe from SMS, reply "STOP" to any text message. Message and data rates may apply.
7. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this policy, including to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type:
- Order and transaction records: 7 years, to comply with tax and accounting recordkeeping requirements
- Marketing contact data: until you unsubscribe or request deletion, or after 24 months of inactivity, whichever comes first
- Site analytics data: 26 months
8. Data Security
We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information, including encryption of payment data through our PCI-DSS compliant payment processor. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
9. Children's Privacy
The Site is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at customerservice@grassrootscalifornia.com so we can delete it.
10. International Data Transfers
If you are accessing the Site from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Material changes will be communicated as required by law.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:
Grassroots California 2550 West 2nd Avenue, Unit 104 Denver, CO 80219 Phone: 303-830-4200 Email: customerservice@grassrootscalifornia.com
Quick Reference: Opt-Out Link Do Not Sell or Share My Personal Information: https://grassrootscalifornia.com/pages/do-not-sell-my-data
