Date of Last Revision: March 16, 2026

Plant Base (“Plant Base,” “our,” “us,” or “we”) takes protecting your privacy seriously and wants to help you better understand how we collect, use, protect, and share your Personal Data. This Privacy Policy is designed to help you understand your privacy choices when you visit our websites or use any of our products and services. This Privacy Policy does not apply to any third party, including through any application or content (including advertising), that may link to or be accessible from or through our websites.

We encourage you to read this Privacy Policy carefully and take the time to understand our privacy practices. By accessing our websites and/or using our products or services, you are bound by all terms and conditions in this Privacy Policy. If you do not wish to be bound, you may not access our websites and/or use our products or services.

Definitions

Information Types

“Browser Information” means data or information provided by a browser, including IP address, referring website, pages visited, and network connection information.

“Contact Information” means basic personal and business information, such as first and last name, company name, email address, postal address, phone number, and may include social media account information.

“Device Information” means information about your device, such as device ID, model, manufacturer, operating system version, browser type, and geographical region, collected from devices used to access our websites or products.

“Usage Information” means information collected when you interact with Plant Base websites or products, including functionalities accessed, pages visited, order flows, on-site search activity, and other interaction data.

“Controller” means an entity that determines the purposes and means of processing Personal Data.

“Cookie” means a small file placed on your device that often contains an anonymous unique identifier accessible by the website that placed it there.

“Personal Data” or “Personal Information” means information that (i) relates to an identified or identifiable natural person, or (ii) identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer.

“Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, storage, retrieval, use, disclosure, transmission, alteration, and deletion.

“Processor” means the entity that processes Personal Data on behalf of a Controller.

“Products” means all Plant Base content, products, services, materials, and features located on or accessible through our websites or otherwise made available by Plant Base.

“Third-Party Products” means any third-party information, website, product, service, or materials referenced in, accessible through, or provided in connection with our websites or Products.

“Visitor” means a natural person or entity that visits or interacts with our websites.

“Websites” means the Plant Base website located at [INSERT PRIMARY DOMAIN] and any affiliated Plant Base websites, microsites, apps, or digital properties that link to this Privacy Policy.

How Do We Collect Information and What Information Do We Collect?

When Visitors visit our Websites or engage in communications with us online or offline, we may collect Browser Information, Contact Information, Device Information, Personal Information, and Usage Information.

We may collect the following categories of information from you or your device(s):

• identifiers, such as Browser Information and Device Information;
• commercial information, such as Contact Information, transaction history, rewards participation, and Usage Information;
• internet or network activity information, such as browsing behavior, search activity, and device interaction data;
• geolocation data, such as approximate location derived from Browser Information or Device Information;
• other Personal Information, including government-issued identification information and, where applicable, medical cannabis customer identification;
• information derived from other categories, such as preferences, interests, affinities, and profile information used to personalize your experience; and
• site search and on-site queries. When you use our on-site search function, we collect the text of your query. The full page URL of the results page, which may contain your search term in the query string, may be sent to our analytics service provider, such as Google Analytics, to help us measure search performance and improve relevance. See “Cookies” and “How Do We Share the Information We Collect?” for more details and available controls.

In accordance with applicable laws and regulations governing cannabis businesses, we may collect, process, and store personal data including purchase history, identification verification information, and, where applicable, medical cannabis customer data. These requirements differ by jurisdiction, and your state may provide rights in addition to those described in this Policy. If you are a medical cannabis customer, additional protections may apply to your personal data.

How Do We Use the Information We Collect?

We use the information we collect, in our role as data Controller, to:

• provide our Products and services;
• process and fulfill orders, reservations, and delivery requests where lawful;
• confirm identities and eligibility;
• communicate with you, including required communications regarding updates to our Products, services, or policies;
• administer loyalty or rewards programs, including earning, redeeming, and tracking points, tiers, status, and member benefits;
• send promotional communications, where permitted by law and your preferences;
• support advertising and marketing activities;
• send receipts, invoices, or other transaction-related communications;
• resolve incidents or problems reported by you related to the use of our Websites and Products;
• report to state and local regulatory agencies where required;
• comply with legal and regulatory obligations;
• perform analytics to understand how Visitors use our Websites, including how site search is used, so we can troubleshoot, prevent abuse, improve content, and improve navigation;
• support business transactions concerning the sale, merger, financing, restructuring, or transfer of some or all of our business or assets; and
• use your information in other cases where you have given express consent or where otherwise permitted by law.

Medical Cannabis Customer Data

Certain state laws require cannabis businesses to collect and retain data from medical cannabis customers, including identification numbers, certification details, and purchase records. Plant Base follows industry-standard and commercially reasonable practices for securing this information and complies with state-specific cannabis regulations governing medical cannabis data.

How Do We Share the Information We Collect?

Plant Base works with select third-party service providers to support our business operations, including payment processing, marketing, analytics, compliance reporting, order processing, and inventory tracking. We share personal data with these partners only when reasonably necessary to deliver services, operate our business, or comply with law, and we require such partners to adhere to confidentiality, privacy, and security obligations as appropriate.

We may share personal information with:

Point-of-Sale and Compliance Tracking

• third-party service providers supporting order processing, inventory management, point-of-sale operations, and compliance with regulatory requirements; and
• state and local regulatory agencies for mandatory reporting on sales, purchases, and medical cannabis customer data, where required by law.

Marketing and Customer Engagement

• authorized marketing platforms for email and SMS campaigns, where you have provided the required consent;
• analytics and tracking providers for website performance analysis, campaign optimization, and customer experience improvement;
• digital advertising partners for paid search, display advertising, and performance measurement, subject to applicable law and your privacy choices; and
• Google Analytics or similar analytics providers acting as our service providers/processors to help us measure and improve website performance, including how visitors use our site search function.

Advertising and Campaign Measurement

When we run paid advertising campaigns, we may enable conversion or campaign measurement tools so advertising platforms can report ad effectiveness. Depending on settings and your choices, these tools may receive page information and pseudonymous identifiers, such as cookie IDs. See “Ad Networks,” “Cookies,” and “California Notice at Collection” for more detail and available opt-out options.

Event, Sweepstakes, and Giveaway Management

• platforms facilitating event invitations, RSVPs, sweepstakes, contests, giveaways, and promotions; and
• survey and feedback tools used to gather customer insights and improve our services.

Additional Service Providers and Future Platforms

We may use additional analytics, operational, communications, or advertising platforms as needed to support Plant Base’s business functions. Any such platforms will be required to adhere to applicable privacy and security standards.

Your Privacy Choices

We do not sell your personal data for money.

You may opt out of certain marketing-related uses or disclosures of your personal data by contacting us at [INSERT PRIVACY EMAIL] with the subject line “Marketing Opt-Out,” by using unsubscribe links, or by following other opt-out methods described in this Policy. You cannot opt out of data sharing required by law for compliance, licensing, tax, security, fraud prevention, or regulatory purposes.

Third parties may have their own privacy policies, and we encourage you to review them before interacting with their services.

How Do We Store the Information We Collect?

Plant Base retains personal information for the period required by applicable cannabis regulations or for as long as necessary to fulfill business, legal, accounting, tax, security, or operational obligations. For example:

• medical cannabis customer records may be retained as required by state law, which in some jurisdictions may extend up to seven (7) years or longer;
• purchase and transaction history may be retained as required by state tax, licensing, and regulatory authorities;
• marketing and promotional data may be retained only as long as reasonably necessary to provide services or until you opt out, subject to legal retention requirements; and
• event-level analytics data associated with cookies and identifiers may be retained according to the settings in our analytics platforms, such as Google Analytics.

If you wish to request deletion of your personal data, you may contact us at [INSERT PRIVACY EMAIL] with the subject line “Data Deletion Request.” In some cases, we may be required to retain certain information for legal, regulatory, fraud prevention, security, or compliance purposes.

Promotional Offers from Plant Base

Plant Base may offer promotional communications via email, SMS/text messages, push notifications, or similar channels. We intend to comply with the Telephone Consumer Protection Act (TCPA), CAN-SPAM, and applicable state marketing laws.

Opt-In Requirements

By signing up for SMS, email, or push notifications, you consent to receive marketing messages from Plant Base and its affiliated locations or brands, where applicable. For SMS marketing, we may require express written consent where required by law.

Opt-Out Instructions

You may opt out of marketing communications at any time:

• Email: click the unsubscribe link in the marketing email.
• SMS/Text Messages: reply STOP to unsubscribe.
• Push Notifications: manage your preferences in your device settings or app settings, if applicable.

Opting out of marketing communications will not affect transactional, order-related, account-related, security-related, or legally required communications.

Ad Networks

If Plant Base uses interest-based advertising or targeted advertising through third-party advertising networks, those networks may collect information about your interactions with our Websites and other sites and use that information to deliver targeted ads to you.

You may be able to opt out of some types of targeted advertising through industry opt-out tools, browser settings, device settings, or rights available under applicable privacy laws. If and when our use of advertising technologies constitutes “sharing” for cross-context behavioral advertising under applicable law, we will provide any required opt-out rights.

Data Subject Rights

Depending on your state of residence, you may have certain rights regarding your personal information under applicable privacy laws, including:

• Access and Correction: You may request a copy of your personal data and ask us to correct inaccurate information.
• Deletion: You may request deletion of your personal data, subject to legal and regulatory retention obligations.
• Data Portability: You may request a copy of certain data in a structured, commonly used, and machine-readable format.
• Opt-Out Rights: You may opt out of the sale of personal data, sharing for cross-context behavioral advertising, or processing for targeted advertising, where applicable.
• Limit the Use of Sensitive Data: Some jurisdictions allow you to request restrictions on the use of sensitive personal information, such as precise geolocation or medical information.

How to Submit a Request

To exercise your rights, contact us at:

Email: [INSERT PRIVACY EMAIL]
Subject Line: “Data Subject Request”
Mail: [INSERT PLANT BASE LEGAL/PRIVACY MAILING ADDRESS]

If you submit a deletion, correction, access, portability, or other privacy request, we may need to verify your identity before processing the request. Verification may include confirming details such as your name, address, date of birth, recent transactions, or information associated with your account.

Limitations on Data Deletion

Plant Base may be required to retain certain information to comply with cannabis regulations, tax laws, contractual obligations, fraud prevention needs, security requirements, and other legal obligations. If we cannot verify your identity or your request conflicts with legal requirements, we may deny or limit your request as permitted by law.

California Notice at Collection

If you are a California resident, Plant Base may collect personal information as defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).

Categories of personal information we may collect include:

• identifiers, such as IP address, cookie identifiers, account identifiers, and government-issued identification information where required;
• internet or electronic network activity information, such as browsing activity, page views, and on-site search queries;
• device information;
• approximate geolocation information;
• commercial information, such as purchase history and loyalty activity;
• sensitive personal information, such as certain identification data and medical cannabis information where applicable.

We may collect and use this information for purposes including providing and securing the Websites, processing transactions, identity verification, legal compliance, analytics, improving user experience, measuring marketing effectiveness, and fraud prevention.

Recipients may include service providers, processors, compliance vendors, analytics providers, and, where applicable, advertising or campaign measurement partners.

We do not sell personal information for monetary consideration. We do not “share” personal information for cross-context behavioral advertising except as described in this Policy or as otherwise disclosed and subject to applicable opt-out rights.

California residents may have the following rights, subject to exceptions:

• Right to Know
• Right to Access
• Right to Delete
• Right to Correct
• Right to Opt Out of Sale or Sharing
• Right to Limit Use and Disclosure of Sensitive Personal Information
• Right to Non-Discrimination for exercising privacy rights

To exercise these rights, contact us at:

Email: [INSERT PRIVACY EMAIL]
Subject Line: “California Privacy Request”
Mail: [INSERT PLANT BASE LEGAL/PRIVACY MAILING ADDRESS]

We may request additional information to verify your identity before processing your request.

Rights of Users from the European Economic Area and the United Kingdom

If you are a resident of the United Kingdom, European Union, or European Economic Area, you may have rights under applicable data protection laws, including the GDPR and UK GDPR, to the extent those laws apply.

Information you provide may be transferred to and processed in countries outside your country of residence, including the United States, where data protection laws may differ. Where required, Plant Base will take steps reasonably designed to provide appropriate safeguards for such transfers.

If you are located in the EEA or UK and wish to exercise any applicable rights, please contact us using the contact details below.

Credit Card Information

Plant Base may not directly store full payment card information if payment processing is handled by third-party payment processors that comply with applicable payment card security standards, including PCI DSS. To the extent Plant Base uses third-party processors, those providers will collect and process payment card information on our behalf or on their own behalf as payment service providers, subject to their own privacy and security obligations.

Cookies

Plant Base and its third-party service providers may use cookies, web beacons, pixels, SDKs, and similar tracking technologies to enhance user experience, analyze website traffic, remember preferences, support security, and assist with marketing efforts.

Types of Cookies We May Use

• Essential Cookies – Necessary for website functionality, security, checkout, and account access.
• Functional Cookies – Help improve user experience, such as remembering preferences.
• Analytics Cookies – Help us understand how users interact with our websites.
• Advertising Cookies – May be used for advertising, retargeting, and campaign measurement where applicable.

We may use Google Analytics 4 or similar analytics tools to understand website usage. Such tools may receive page information, including page URLs that may contain search terms in the query string, and pseudonymous identifiers such as cookie IDs.

Managing Cookies and Tracking Preferences

You can control or disable cookies through your browser or device settings. The method varies by browser and platform. You may also be able to opt out of Google Analytics through Google’s browser add-on or similar tools.

If you use a mobile app, app tracking or mobile SDK permissions may also be managed through your device settings.

By continuing to use our Websites, you consent to our use of cookies and similar technologies as described in this Policy, except where applicable law requires a different consent mechanism.

If you have questions, contact [INSERT PRIVACY EMAIL].

Do Not Track

Do Not Track is a browser setting that requests websites not track a user’s browsing activity. At this time, our Websites do not respond to browser-based “Do Not Track” settings or signals unless required by applicable law. We may continue to collect information about your activity as described in this Policy.

Protecting Your Personal Information

Plant Base implements commercially reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. However, no system is completely secure, and we cannot guarantee absolute security.

In the event of a data breach involving personal information, Plant Base will comply with applicable federal and state breach notification laws.

For questions about data security, contact [INSERT PRIVACY EMAIL].

Transfer of Data

Your Personal Information may be transferred to, stored in, or processed on computers or servers located outside your state, province, or country, where privacy laws may differ. We will take steps reasonably designed to ensure your Personal Information is treated securely and in accordance with this Privacy Policy and applicable law.

Updates

We may update this Privacy Policy from time to time in response to changing legal, technical, business, or operational developments. When we update this Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes and as required by law.

You can determine when this Privacy Policy was last revised by checking the “Date of Last Revision” at the top of this page.

Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, you can contact us using the following methods:

Email: [INSERT PRIVACY EMAIL]
Mail: [INSERT PLANT BASE MAILING ADDRESS]
Phone: [INSERT PRIVACY OR CUSTOMER SUPPORT PHONE]

If submitting a privacy-related request, please include your full name, contact information, and the nature of your request so we can process it efficiently.