Privacy Policy

• Information you provide: name, shipping and billing address, email, phone, and order details.
• Payment information: processed by our payment processor. We do not store full card numbers.
• Automatically collected: device, browser, IP address, and usage data collected through analytics tools.

• To process and ship orders, and provide customer service.
• To comply with legal, regulatory, and payment-network requirements.
• To send transactional messages and, if you opt in, marketing communications.

We share data with service providers who help us operate the store — including payment processing, shipping, and analytics — and where required by law or by payment-network rules.

1. Purpose and Data Minimization. To comply with legal and regulatory obligations governing the sale of age-restricted goods, we verify the age of our users prior to completing transactions. We adhere to principles of data minimization; we do not seek to discover your broader identity beyond confirming that you meet the minimum legal age requirement.

2. Third-Party Service Provider. We utilize Didit (operated by Didit Protocol), an external, secure identity infrastructure provider, to conduct age estimation and identity document validation on our behalf. When you perform an age check, you interact directly with Didit’s secure infrastructure.

3. Categories of Data Processed. Depending on the verification method required to achieve regulatory-grade certainty, Didit may process:

• Selfie / Facial Geometry Data: To perform AI-powered facial age estimation or liveness detection against fraud and deepfakes.
• Identification Documents: Official government-issued ID cards, driver's licenses, or passports, which Didit validates to confirm you meet the minimum legal age. Our backend may receive Didit's verification result in order to confirm adult status, then persists only that status — not the personal details shown on your document.

4. Data Ownership, Retention, and Zero-Storage Commitments. Our Platform Storage: Our store does not collect or store your raw facial photos, biometric data, or copies of your government-issued identification. Our backend may receive Didit’s verification result in order to confirm adult status, then persists a signed evidence record of that status only — not document images or the personal details shown on your document. Didit Processing & Deletion: Biometric identifiers and liveness video sessions are processed transiently in memory and are deleted immediately upon completion of the validation check. Didit retains document logs only for the minimum duration specified by our compliance settings, or destroys them immediately post-verification following zero-retention architecture standards.

5. Biometric Disclosures & Consent. By initiating the age verification check, you provide explicit, voluntary consent for Didit to capture, analyze, and process your facial geometry strictly for the purposes of age assurance and liveness detection. You may opt out of this process; however, choosing not to verify your age means we cannot process your transaction.

6. Security Standards. Didit maintains top-tier industry safety certifications, including SOC 2 Type II, ISO 27001, and ISO 27018 cloud privacy attestations, ensuring your data is encrypted both in transit and at rest.

You may request access to, correction of, or deletion of your personal information, and you may opt out of marketing communications at any time. Contact us using the details on our Contact Us page.

We retain personal information for as long as needed to fulfil orders and to meet legal, regulatory, and compliance obligations, and we use reasonable safeguards to protect it.

This site is not intended for anyone under 21, and we do not knowingly collect personal information from minors.

We may update this policy from time to time. The date at the top of this page reflects the most recent update. Questions? See our Contact Us page.