Privacy Policy

Learn how hempshop honors Global Privacy Control and lets you manage analytics and email features separately.

Effective date: July 28, 2026

This Privacy Policy explains how Bold Ubiquitous Digital LTD., doing business as hempshop (“hempshop,” “we,” “us” or “our”), collects, uses and discloses personal information when you visit hempshop.io, create an account, place an order, subscribe to email or contact us.

1. Personal information we collect

Depending on how you interact with us, we may collect:

  • Contact and account information, such as your name, email address, telephone number, billing and shipping addresses, account username and account settings.
  • Order and commercial information, such as items viewed or purchased, cart activity, orders, discounts, transaction totals, shipment status, returns, refunds and customer-service history.
  • Payment-related information, such as billing details, payment method, transaction status, a payment token and masked account details. Our payment provider processes the full payment credential as described below.
  • Device and online activity information, such as IP address, browser and device type, operating system, referring page, pages viewed, interactions, timestamps, cookie or similar identifiers and approximate location inferred from IP address.
  • Communications and submitted content, such as messages, return requests, photographs, reviews and other information you choose to send us.
  • Marketing and preference information, such as email subscription status, consent records, unsubscribe or suppression status, email engagement and preferences inferred from site or purchase activity.
  • Security and eligibility information, such as fraud indicators, login and security logs, and age or eligibility confirmation when requested.

Please do not send sensitive information that we have not requested.

2. How we collect information

We collect information:

  • directly from you when you browse, create an account, order, subscribe, submit content or contact us;
  • automatically through cookies, pixels, tags, logs and similar technologies; and
  • from service providers and partners involved in payments, analytics, marketing, fraud prevention, fulfillment, delivery and customer support.

3. How we use personal information

We may use personal information to:

  • operate the site, cart, checkout and customer accounts;
  • process payments and fulfill, deliver, support, cancel, return or refund orders;
  • send transactional messages about accounts, orders, payments, shipments, returns and support;
  • provide optional marketing email when you have subscribed or another lawful basis permits it;
  • remember preferences and measure site, campaign and store performance;
  • understand how customers find and use the store and improve our products, content and operations;
  • detect, investigate and prevent fraud, abuse, security incidents and other harmful activity;
  • enforce our terms and protect customers, hempshop and others; and
  • comply with legal, tax, accounting, reporting and regulatory obligations.

4. How we disclose personal information

We may disclose relevant personal information to:

  • Storefront, hosting and security providers that support WordPress, WooCommerce, hosting, backups, content delivery, logging and site protection.
  • Payment and fraud providers that authorize and process transactions, manage payment tokens, reduce fraud and address disputes.
  • Warehouse, fulfillment and delivery providers that pack, ship, track and deliver orders or handle returns.
  • Analytics and reporting providers that help us measure traffic, referrals, ecommerce activity and store performance.
  • Email and customer-communication providers that manage subscriptions, transactional or marketing messages, delivery status and suppression records.
  • Professional advisers and authorities when reasonably necessary for accounting, insurance, legal compliance, security, dispute resolution or protection of rights.
  • A successor or transaction participant in connection with a merger, financing, reorganization, sale of assets or similar business transaction, subject to appropriate safeguards.

Our principal commerce, communication and measurement services currently include WordPress/WooCommerce, Authorize.Net, Klaviyo, Google Tag Manager, Google Analytics and Metorik. Google Tag Manager and Google Analytics load only after a visitor allows analytics, and Klaviyo’s onsite features load only after a visitor allows email features. When allowed, those Klaviyo features may measure product views, additions to cart and checkout starts so that requested email signup, browse and cart-recovery features can operate. Metorik processes order and store information for reporting and syncing. Its browser source attribution and cart tracking are enabled unless a visitor selects Use essential only or uses Global Privacy Control. Cart tracking may associate an email address with cart contents after a logged-in customer shops or a guest provides an email address. Providers may change as our operations change, and their handling of information is also governed by their own terms and privacy notices.

We do not sell customer lists or full payment-card information for money. Analytics or marketing technologies may allow providers to collect online identifiers and activity over time. Depending on the law that applies, some of these disclosures may be treated as a “sale,” “sharing” or targeted advertising even when no money changes hands.

5. Payment information

Authorize.Net processes payment-card information for orders. Payment details may be transmitted directly to the payment provider. We may receive and retain a transaction identifier, authorization result, token and masked payment details, such as card type and last four digits, to complete orders, support refunds and address disputes.

Do not send full card numbers or security codes by email. The payment provider’s handling of payment information is governed by its own privacy and security practices.

6. Cookies and online tracking

We and our providers use cookies, tags and similar technologies for:

  • essential functions such as security, login, cart and checkout;
  • preferences and site functionality;
  • analytics, attribution and ecommerce measurement; and
  • email signup, campaign measurement and related marketing functions.

Essential store technologies are available by default. Optional analytics and email features are off unless you allow them, and you may choose either category separately. If analytics is allowed, the retained Conversios Google Tag Manager container and Google Analytics may receive online identifiers, device information, page and ecommerce activity for measurement; advertising storage and personalization remain denied. The former legacy Google Tag Manager container remains retired. If email features are allowed, Klaviyo may provide the email signup form and measure product views, additions to cart and checkout starts for related email campaign, browse and cart-recovery features. If a shopper enters an email address at checkout after allowing email features, Klaviyo may associate that address with the checkout event. Metorik source attribution and cart tracking are enabled by default for store reporting and cart recovery. Metorik may set source-attribution cookies, including mtk_src_trk, for up to six months and may receive source, cart and customer-email data as described below.

You can review or change your selection at any time through the Your Privacy Choices control at the bottom of every page. Selecting Use essential only prevents future optional requests and removes known optional analytics, email and attribution cookies from this site. If an optional vendor has already loaded on the current page, the page reloads to complete the change. You can also use browser controls to block or delete cookies. Blocking essential cookies may prevent the cart, checkout, account or other site features from working correctly.

We honor a supported browser-based opt-out preference signal, including Global Privacy Control, as an opt-out of sale or sharing for that browser or device. The signal overrides a prior browser-level choice to allow optional technologies, prevents optional analytics, email features, and Metorik browser attribution and cart tracking from loading, and removes known optional cookies. We do not display a popup merely because the signal is present and do not treat the signal’s later absence as consent. The site does not currently respond to the older Do Not Track signal because it does not communicate the same standardized opt-out request.

7. Email choices

Transactional email about an account or order is part of providing the service. Marketing email is optional. You can unsubscribe from marketing using the link in any marketing message or by contacting [email protected]. We may retain the minimum information needed to record and honor an unsubscribe, bounce, complaint or suppression request.

We do not currently offer SMS or browser-push marketing subscriptions.

8. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including completing transactions, maintaining business and tax records, providing support, preventing fraud, resolving disputes, enforcing agreements and complying with law.

Retention varies by the type of information, the relationship, legal or accounting requirements, security needs and the settings of the providers we use. When information is no longer reasonably needed, we take steps to delete, deidentify or securely dispose of it, subject to technical and legal limitations.

9. Security

We use administrative, technical and physical safeguards designed to protect personal information, taking into account the nature of the information and our operations. No website, transmission or storage system can be guaranteed completely secure. Use a unique password and notify us if you believe your account or payment information has been used without authorization.

10. Your choices and privacy requests

You may update certain account information through your account and may manage marketing email as described above.

Depending on where you live and subject to applicable exceptions, you may have rights to request access to, correction of, deletion of or a portable copy of certain personal information, or to object to or opt out of certain processing, sales, sharing or targeted advertising. You may also have a right to appeal a denied request and to receive equal service without unlawful discrimination for exercising a privacy right.

To make a privacy request, email [email protected] with the subject Privacy Request or use our contact page. Describe the request and provide the email address associated with your account or orders. We may need to verify your identity and authority before acting. Authorized agents may be required to provide proof of authorization. We will respond as required by the law that applies.

11. California privacy disclosures

If the California Consumer Privacy Act applies to our activities, California residents may have the rights described in this section, subject to applicable exceptions. During the preceding 12 months, we collected the categories of personal information described in Section 1, including identifiers, commercial information and internet or other electronic-network activity. We used and disclosed those categories for the business and commercial purposes described in Sections 3 and 4.

We do not sell customer lists or payment-card information for money. Online identifiers and activity may previously have been disclosed to analytics or email-technology providers in circumstances that could be considered a sale or sharing under California law. Our current controls keep optional analytics and email browser disclosures off unless the visitor allows them, let visitors turn off Metorik browser attribution and cart tracking, honor Global Privacy Control, and provide a direct Your Privacy Choices opt-out mechanism. We do not knowingly sell or share the personal information of consumers under 16, and the store is intended for adults 21 and older.

California residents may request to know, access, correct or delete covered personal information, request information about categories of collection and disclosure, obtain a portable copy where required, opt out of sale or sharing, and receive equal service without unlawful discrimination. Use Your Privacy Choices for an immediate browser-level opt-out. For other requests, use the methods in Section 10. An opt-out request does not require account creation or identity verification when we can honor it without additional information.

12. Children

The site is intended for adults 21 and older. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact [email protected] so we can review and take appropriate action.

13. Processing locations

hempshop is based in the United States. We and our providers may process information in the United States and other locations where they operate. Privacy laws in those locations may differ from the laws where you live.

14. Changes to this policy

We may update this policy when our practices, providers or applicable requirements change. We will post the updated version here and revise the effective date. When appropriate, we may provide additional notice by email or on the site.

15. Contact

For privacy questions or requests, contact:

[email protected]

Bold Ubiquitous Digital LTD.
100 Pine Street, Suite 1250
San Francisco, CA 94111
United States