Privacy Policy

This Privacy Policy explains how GrassPass, LLC (“GrassPass,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the GrassPass website and mobile application (together, the “Service”). It is incorporated into our Terms of Service. By using the Service you agree to the practices described here; if you do not agree, please do not use the Service.

GrassPass is a platform that helps adult consumers discover deals offered by participating cannabis brands and licensed cannabis businesses (“Brand Partners”). Consumers use the Service for free. Brand Partners pay to list and to purchase featured placement. GrassPass does not sell cannabis, and this Policy does not cover the privacy practices of any Brand Partner or retail location; see Section 12.

1. Information We Collect

From consumers, directly:

• Account information: name, email address, phone number, password, and date of birth, which we use to confirm that you meet the age requirement in our Terms.
• Location you enter, such as a ZIP code or city, used to show Deals near you.
• Preferences, such as favorite brands or product categories, if you choose to save them.
• Content you submit, such as reviews, ratings, or messages to support.

From consumers, automatically:

• Device and usage data, including device type, operating system, app version, IP address, browser type, pages and Deals viewed, and actions taken in the Service.
• Location data: approximate location derived from your IP address and, only with your separate opt-in permission, precise geolocation from your device, used to show Deals near you. Precise geolocation is sensitive information under state privacy law. We collect it only with your consent, and you can withdraw consent at any time in your device settings or in the app.
• Redemption data: which Deals you view, save, or redeem, and when.
• Cookies and similar technologies, described in Section 4.

From Brand Partners:

• Business contact information for the people who manage the account, license information, Deal content, and billing details. Payment card information is collected and stored by our third-party payment processor, not by GrassPass.

From others:

• From Brand Partners or retail locations, confirmation that a Deal was redeemed, so that we can mark it as used and measure Deal performance. We do not receive your full purchase history or receipt.
• From the vendors described in Section 3 that help us run the Service.
• From a social or single-sign-on provider, if you create your account that way.

2. How We Use Information

We use the information above to:

• operate the Service, including showing you Deals, personalizing results by location, and administering consumer and Brand Partner accounts;
• confirm your eligibility to use the Service, meaning your age and that you are in a jurisdiction where cannabis is legal. We use eligibility data only for that purpose, never for marketing or analytics, and we keep it only as long as needed (see Section 8);
• measure and report the performance of Deals and paid placements, so that Brand Partners can see how their listings performed in aggregate (for example, the number of views and redemptions);
• bill Brand Partners and manage their subscriptions;
• send transactional communications about your account and, if you opt in, marketing communications;
• maintain, secure, and improve the Service, including troubleshooting and analytics;
• detect and prevent fraud, abuse, and violations of our Terms; and
• comply with legal obligations and enforce our agreements.

3. How We Share Information

We share personal information in the following ways. The headings matter, because state privacy laws treat these categories differently and give you different rights for each.

3.1 With service providers. We share information with vendors that work on our behalf and are bound by contract to use it only to provide services to us. These include hosting and infrastructure providers, analytics providers, email, push, and SMS delivery providers, age and identity verification providers, customer support tools, and our payment processor. This is not a sale of your information.

3.2 With Brand Partners in connection with a redemption. When you redeem a Deal, we share with that Brand Partner and the participating location only what is needed to honor and record the redemption, such as the offer code or a confirmation that the offer is valid.

3.3 With Brand Partners for their own marketing or analytics.

We do not share your personal information with Brand Partners for their own marketing or analytics. Brand Partners receive only aggregated statistics about their Deals, such as total views and redemptions, that do not identify you.

3.4 Aggregated and de-identified information. We may create and share aggregated or de-identified information that cannot reasonably be linked to you, such as redemption rates by product category and region. We maintain de-identified data in that form, do not attempt to re-identify it, and require anyone who receives it to do the same.

3.5 For legal and safety reasons, as described in Section 11.

3.6 In a business transfer, if GrassPass is involved in a merger, acquisition, financing, or sale of assets, subject to this Policy or a successor policy of which you will be notified.

3.7 With your consent, for any other purpose we describe to you at the time.

Apart from what Section 3.3 describes, we do not sell your personal information, and we do not sell the phone number you give us for text messaging to anyone.

4. Cookies and Tracking Technologies

We and our service providers use cookies, mobile software development kits, and similar technologies to keep you logged in, remember your preferences, measure how the Service is used, and measure the performance of Deals and paid placements. You can control cookies through your browser settings, and your device’s advertising settings control mobile identifiers. Where the law requires it, we honor recognized opt-out preference signals such as Global Privacy Control, as described in Section 5.

5. Your Privacy Choices

Location. Precise location is collected only after you grant permission in the app, and you can revoke it at any time in your device settings. The Service still works with the ZIP code or city you enter.

Marketing messages. You can opt out of marketing emails using the unsubscribe link in any message, and out of text messages by replying STOP (see Section 6).

Sensitive information. We do not use or disclose sensitive information, including precise geolocation, for any purpose other than providing the Service unless you opt in.

6. Text Messaging Program

If you opt in to receive text messages from GrassPass, such as Deal alerts, you will be asked to consent affirmatively, and we will tell you the type and expected frequency of messages, that message and data rates may apply, and how to opt out. You can opt out at any time by replying STOP and get help by replying HELP. Consent to receive text messages is not a condition of using the Service.

No mobile information collected for the purpose of text messaging will be shared with third parties or affiliates for their own marketing or promotional purposes. This does not apply to information shared with our messaging service provider solely to deliver the texts you requested.

7. Your Privacy Rights

Depending on where you live, you may have rights under state privacy law (for example, the California Consumer Privacy Act and similar laws in other states) to:

• know what personal information we have collected about you and receive a copy;
• correct inaccurate personal information;
• delete personal information we hold about you, subject to legal exceptions;
• opt out of the sale or sharing of personal information and of targeted advertising;
• limit the use of sensitive personal information; and
• not be discriminated against for exercising these rights.

To exercise a right, contact us at privacy@mygrasspass.com, We will verify your request and respond within the time required by law, generally 45 days with one extension. You may authorize an agent to submit a request for you. If we deny a request, you may appeal by contacting us at the same address, and applicable law may give you the right to contact your state attorney general if the appeal is denied.

8. Data Retention

We keep personal information only as long as needed for the purposes in this Policy, to comply with legal obligations, resolve disputes, and enforce our agreements. In particular:

• age and eligibility verification data is kept only as long as needed to confirm your continued eligibility and is deleted on a schedule we set and review with counsel, consistent with applicable age-verification law;
• consumer account and redemption data is kept while your account is active and for a limited period after closure to resolve disputes and meet recordkeeping obligations;
• Brand Partner account and billing records are kept for the term of the relationship and for the period required by tax and accounting law; and
• we delete or de-identify information when it is no longer needed, except where longer retention is required by law.

9. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and vendor oversight. No system is completely secure, and we cannot guarantee the absolute security of information you provide.

10. Children’s Privacy

The Service is not directed to, and we do not knowingly collect personal information from, anyone under the eligibility age stated in our Terms (21, or the applicable minimum for medical use). If we learn that we have collected information from someone who does not meet that requirement, we will delete it. Contact us at the address in Section 15 if you believe a minor has used the Service.

11. Government and Law Enforcement Requests

Cannabis remains illegal under federal law even where it is legal under state law, which means that information connecting a specific person to cannabis interest or activity carries more risk if disclosed than the equivalent data at an ordinary retail app. We take that seriously:

• we do not proactively share user data with law enforcement or other government agencies;
• we require valid legal process, such as a subpoena, court order, or warrant, before disclosing personal information in response to a government request, and we review each request for legal sufficiency;
• where the law permits, we notify the affected user before or after producing information in response to legal process, unless we are prohibited from doing so or believe notice would create a risk to someone’s safety; and
• we disclose only the information the specific request legally requires, not our full records.

12. Brand Partners, Retail Locations, and Third-Party Links

The Service displays content and offers from Brand Partners and may link to their sites or to retail locations. Their privacy practices are governed by their own policies, not this one. Information you give directly to a Brand Partner or a retail location when you redeem a Deal is subject to that business’s policy, and we encourage you to review it.

13. Where We Operate

The Service is intended for use within the United States, in jurisdictions where cannabis is legal, and we do not knowingly direct it to users outside the United States.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new “Last Updated” date, and for material changes, including any decision to begin sharing personal information with Brand Partners under Section 3.3, we will give additional notice such as an in-app notice or email at least 30 days before the change takes effect. Continuing to use the Service after that date means you accept the update.

15. Contact Us

Questions or requests about this Policy can be sent to privacy@mygrasspass.com or to GrassPass, LLC, P.O. Box 7274, Kansas City, Missouri 64113.