This Privacy Policy explains how Border Buds ("Border Buds," "we," "us," or "our") collects, uses, shares, and retains information about you.

It applies to both of the following, which we refer to together as our "Services":

• Our website at https://borderbudsmi.com, including the online ordering menu embedded in it; and
• The Border Buds mobile application for iOS and Android (the "App").

Where a practice applies only to the App or only to the website, we say so.

The App is a branded application built and operated for us by Dutchie (Courier Plus, Inc.), the platform that also runs our point-of-sale system, online ordering menu, loyalty program, marketing, and payments. When you use the App, Dutchie collects and processes information on our behalf and under our instructions.

We remain responsible for your information and for responding to your privacy requests. Contact us using the details at the end of this policy. You can also review Dutchie's privacy policy to understand how the platform handles data.

Our Services are intended only for adults 21 years of age or older. We do not knowingly collect information from anyone under 21, and we do not direct our Services to children. If we learn that we have collected information from someone under 21, we will delete it. See "Children's privacy" below.

Information you give us

• Account information: your name, email address, phone number, date of birth, and a password. If you use Sign in with Apple or Google Sign-In instead, we receive an account identifier along with your name and email address.
• Age and identity verification: your date of birth and government-issued identification, such as a driver's license or state ID, which is verified as required by Michigan law. If you present a medical cannabis card, we collect the information on it, which may include health information.
• Order and delivery information: items ordered, order history, preferred store, and any billing or delivery address you provide.
• Loyalty and referral information: your rewards balance, redemptions, and — if you use refer-a-friend — the fact that you referred or were referred by someone.
• Communications: messages you send us through the App, our contact form, or by email, and reviews you post.
• Job applications: if you apply through our careers page, the information on that form and any resume you upload.
• Marketing sign-ups: your email address and phone number if you opt in, and a record of that consent.

Information collected automatically

• Device information: device name and model, operating system and version, app version, browser type, and language and region settings.
• Device identifiers: identifiers assigned to your device or app installation, and push notification tokens used to deliver notifications.
• Advertising identifiers: on iOS, the Apple Advertising Identifier (IDFA), and on Android, the Google Advertising ID. These are collected only if the App asks for tracking permission and you allow it. If you decline, they are not collected. See "App permissions" below.
• Location information: your approximate location derived from your IP address or postal code, and — if you grant location permission in the App — your device location, used to show nearby stores and to support delivery.
• Usage and diagnostic information: pages and screens viewed, products browsed, searches, features used, the time and duration of your activity, and crash and error logs.
• Log and cookie information: IP address, browser type and settings, referring page, and cookie and pixel identifiers, including pixels in our marketing emails that record whether you opened a message or clicked a link.

Information from other sources

We receive purchase history, loyalty balances, and customer records from Dutchie, our point-of-sale and e-commerce provider, including purchases you make in store. We also receive account information from Apple or Google if you choose to sign in with them.

The App may ask for the permissions below. You can grant or revoke any of them at any time in your device settings, and the App remains usable without them, though some features will not work.

• Location: to show nearby stores and product availability and to support delivery orders.
• Notifications: to send order status updates, back-in-stock alerts, cart reminders, and — if you opt in — deals and promotions.
• Camera: to scan a barcode or QR code at the register when you pay in store.
• Tracking: on iOS, the App must ask your permission before accessing the IDFA for advertising purposes. If you decline, it is not accessed. On Android, you can reset or delete your advertising ID in your device settings.

• Create and maintain your account and verify your age.
• Process, fulfill, and communicate about your orders and pickups.
• Operate our loyalty and rewards program, apply discounts, and run refer-a-friend.
• Process payments and, where you use Pay by Bank, complete the transaction through our payment provider.
• Send transactional messages, including order status, verification codes, and account notices.
• Send marketing messages where you have opted in, and personalize the products, reorder suggestions, and offers you see.
• Provide customer support and respond to your questions.
• Measure and improve the Services and diagnose errors and crashes.
• Detect and prevent fraud, abuse of promotions and referrals, and security incidents.
• Comply with Michigan cannabis regulations, tax and recordkeeping requirements, and other legal obligations.

The App relies on the third-party services below for analytics, push notifications, payments, and loyalty. Each receives only the information needed to perform its function and handles it under its own privacy policy.

• App platform, e-commerce, and loyalty: Dutchie (Courier Plus, Inc.) — Builds and operates the app, processes your orders, and runs our loyalty and rewards program. Dutchie maintains a single customer profile that keeps your rewards and purchase history consistent whether you shop in the app, online, or in store. Privacy policy
• Analytics: Dutchie analytics and Google Analytics — Measure how the app and our online menu are used so we can improve them. This includes screens viewed, products browsed, and features used. Privacy policy
• Push notifications: Apple Push Notification service and Google Firebase Cloud Messaging — Deliver notifications to your device. Notification content is composed in Dutchie and covers order updates, back-in-stock alerts, cart reminders, and promotions you have opted into. Privacy policy
• Payments: Dutchie Pay (Pay by Bank) and Dutchie's payment processors — Process in-app and scan-to-pay bank payments. Your bank credentials and account numbers are collected directly by the payment provider, not by us. Privacy policy
• Sign-in: Sign in with Apple and Google Sign-In — Optional sign-in methods. If you use one, we receive an account identifier along with your name and email address. Privacy policy
• App distribution: Apple App Store and Google Play — Distribute the app and report aggregate install and crash statistics to us. Privacy policy

Website services

• Dutchie — Powers the embedded ordering menu on our website. Privacy policy
• Google Analytics and Google Tag Manager — Website traffic measurement and tag management. Privacy policy
• StackAdapt — Advertising measurement on our website. Used on the website only, not in the app. Privacy policy
• Amazon Web Services — Hosting, file storage including uploaded resumes, and delivery of transactional email. Privacy policy

We do not collect or store your full payment card or bank account numbers. Payments are handled at the store or through Dutchie Pay and Dutchie's payment processors. If you link a bank account to use Pay by Bank, your banking credentials and account details are collected directly by the payment provider through its own secure flow. We receive only the order total, the payment method type, and whether the payment succeeded.

• Our dispensary staff, so they can prepare, verify, and hand off your order.
• Regulators and law enforcement, where required by the Michigan Cannabis Regulatory Agency, by law, subpoena, or court order, or to protect the rights and safety of our customers, staff, or the public.
• In a business transfer, such as a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this policy or notify you of any change.

We do not sell your personal information for money. Some analytics and advertising practices described above may be considered "sharing" or "targeted advertising" under certain state privacy laws. You can opt out at any time — see Do Not Share My Information.

We keep personal information only as long as needed for the purposes described above, or longer where the law requires it. Our retention periods are:

• Account information: kept while your account is active. When you ask us to delete your account, we submit the deletion to Dutchie and your account profile, saved preferences, marketing contact details, and push notification tokens are deleted within 30 days.
• Inactive accounts: deleted after 24 consecutive months with no purchase or sign-in. We will email you before an account is deleted for inactivity.
• Purchase and transaction records: retained by us and by Dutchie for the period required by Michigan cannabis and tax recordkeeping rules, which is generally at least five years. These records are kept even if you delete your account, because we are legally required to keep them.
• Age and identity verification records: retained for the period required by Michigan cannabis regulations.
• Referral and promotion records: retained after account deletion in a form that no longer identifies you, to prevent repeat abuse of sign-up promotions.
• Analytics data: up to 14 months.
• Crash and error logs: up to 90 days.
• Marketing contact lists: until you unsubscribe. After you unsubscribe we keep a minimal record of your email address or phone number so that we do not contact you again.
• Contact form submissions: up to 24 months.
• Job applications and resumes: up to 12 months after the application, unless you are hired or a longer period is required by employment law.

Where information cannot be immediately deleted because it sits in encrypted backups, we isolate it from further use until deletion is possible.

• Delete your account: submit a deletion request on our App Policy page, or email us at customerservice@borderbudsmi.com. If your version of the App offers account deletion in its account settings, you can use that instead.
• Push notifications: adjust your notification preferences in the App, or turn off notifications for the App in your device settings.
• Marketing email and SMS: use the unsubscribe link in any email, reply STOP to any text message, or email us. You will still receive transactional messages about your orders.
• Location and camera: revoke either permission at any time in your device settings.
• Advertising identifiers: on iOS, go to Settings > Privacy & Security > Tracking to turn off tracking for the App. On Android, go to Settings > Privacy > Ads to delete or reset your advertising ID.
• Website analytics: block cookies in your browser or install the Google Analytics opt-out add-on.

Depending on where you live, you may have the right to request access to the personal information we hold about you, a copy of it, correction of inaccurate information, deletion of your information, and to opt out of targeted advertising or the sharing of your information. You also have the right not to be discriminated against for exercising these rights.

To make a request, email customerservice@borderbudsmi.com or write to us at the address below. We will verify your request using the email address or phone number associated with your account, and we will respond within the time required by applicable law (generally 45 days). We may be unable to delete information we are legally required to retain, such as cannabis transaction and identity verification records.

We and Dutchie use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, tokenization of payment information, and access controls limiting which staff can view customer data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our Services are not directed to children, and we do not knowingly collect personal information from anyone under 21. If you believe a person under 21 has provided us with personal information, contact us at customerservice@borderbudsmi.com and we will delete it.

We operate in the United States, and our service providers store and process information in the United States. If you use our Services from outside the United States, you understand that your information will be transferred to and processed in the United States.

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If we make a material change to how we handle your information, we will provide additional notice, such as an in-app message or an email. Your continued use of the Services after an update means you accept the revised policy.

If you have questions about this policy, about how we handle your information, or if you want to exercise a privacy right, contact us:

• Email: customerservice@borderbudsmi.com
• Phone: (269) 546-0008
• Mail: Border Buds, 19382 M-239, New Buffalo, Michigan 49117

We are the business responsible for your information. If you have already contacted Dutchie about data collected through our App, Dutchie will direct you back to us.