Hightree ("we," "us," or "our") operates the Hightree marketplace at hightreemarket.com (the "Platform"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit or make a purchase through the Platform. By using the Platform, you consent to the practices described in this policy.
1. Information We Collect
We collect the following categories of personal information:
1.1 Information You Provide
- Account information — name, email address, phone number, date of birth
- Shipping details — delivery address and contact information
- Payment data — processed securely through our third-party payment providers; we do not store full card numbers
- Age verification data — date of birth confirmation as required by law for purchases of hemp-derived products
- Communications — messages you send through our chat system, dispute submissions, and customer support inquiries
- Vendor application data — business name, licensing information, and tax identification (for vendors only)
1.2 Information Collected Automatically
- Device & browser data — IP address, browser type, operating system, screen resolution
- Usage data — pages visited, search queries, referring URLs, time spent on pages, click patterns
- Location data — approximate geographic location derived from your IP address (used for shipping eligibility and regulatory compliance)
- Cookies & similar technologies — see Section 4 below
2. How We Use Your Information
We use the information we collect to:
- Process and fulfill your orders, including shipping and delivery
- Verify your age and identity as required by federal and state law
- Determine shipping eligibility based on your location and applicable state regulations
- Communicate with you about orders, account activity, and Platform updates
- Facilitate dispute resolution between buyers and vendors
- Improve and personalize your experience on the Platform
- Detect and prevent fraud, unauthorized access, and other illegal activities
- Comply with legal obligations, including record-keeping requirements for hemp-derived product sales
- Send promotional communications (only with your consent; you may opt out at any time)
3. We Do Not Sell Your Personal Information
Hightree does not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your data only as described in Section 5 below, and only to the extent necessary to operate the Platform and fulfill your orders. This commitment applies to all users, regardless of jurisdiction.
4. Cookies & Tracking Technologies
We use cookies and similar technologies for the following purposes:
- Essential cookies — required for login sessions, shopping cart functionality, and age verification
- Functional cookies — remember your preferences, locale, and recently viewed products
- Analytics cookies — help us understand how visitors use the Platform so we can improve it (aggregated, non-identifying data)
You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using core Platform features such as checkout.
Do Not Track:Some browsers send a "Do Not Track" (DNT) signal. We currently do not respond to DNT signals, as there is no industry-standard interpretation. However, we do not track users across third-party websites.
5. Sharing with Third Parties
We share your personal information only in the following circumstances:
- Vendors — name, shipping address, and order details necessary to fulfill your order. Vendors are contractually prohibited from using your data for any purpose other than order fulfillment.
- Payment processors — payment card information is transmitted directly to our PCI-compliant payment providers (e.g., Stripe). We never store full card numbers.
- Shipping carriers — name and delivery address to facilitate shipment and, where required, adult signature verification.
- Analytics providers — aggregated, non-personally-identifiable usage data to improve the Platform.
- Law enforcement & regulators — when required by law, subpoena, court order, or to protect the safety of our users, or to comply with regulatory requirements for hemp-derived product sales.
6. Data Retention
We retain your data for the following periods:
- Account information — retained for as long as your account is active, plus 30 days after deletion request
- Transaction records — retained for up to seven (7) years as required for tax and regulatory compliance
- Age verification data — date of birth is retained with your account; any supplementary verification documents are deleted within 30 days of successful verification
- Chat & dispute records — retained for 2 years after resolution for dispute reference purposes
- Usage & analytics data — aggregated and anonymized within 90 days
7. Data Security
We implement industry-standard security measures to protect your personal information, including encryption in transit (TLS/SSL), secure server infrastructure, access controls, and regular security audits. Payment data is handled exclusively by PCI DSS-compliant processors. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security. We encourage you to use strong, unique passwords for your Hightree account and to notify us immediately at support@hightreemarket.com if you suspect unauthorized access.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention requirements)
- Opt out of marketing communications at any time
- Request a portable copy of your data in a machine-readable format
- Withdraw consent for data processing where consent is the legal basis
To exercise these rights, contact us at privacy@hightreemarket.com. We will respond to your request within 30 days (or 45 days for complex requests, with notice).
9. California Residents — CCPA/CPRA Rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Right to Know — you may request that we disclose the categories and specific pieces of personal information we have collected about you
- Right to Delete — you may request deletion of your personal information, subject to certain exceptions (e.g., legal retention requirements for transaction records)
- Right to Correct — you may request correction of inaccurate personal information
- Right to Opt Out of Sale — we do not sell personal information, so this right is already satisfied
- Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights
Additionally, under California Business & Professions Code § 26161.5, we are prohibited from sharing your personal information collected in connection with cannabis transactions except as strictly necessary to complete the transaction or as required by law.
To submit a CCPA/CPRA request, email privacy@hightreemarket.com with the subject line "CCPA Request." We may verify your identity before processing your request.
10. Children's Privacy
The Platform is intended exclusively for users aged 21 and older. We do not knowingly collect personal information from anyone under the age of 21. If we discover that we have inadvertently collected such data, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us immediately at privacy@hightreemarket.com.
11. Third-Party Links
The Platform may contain links to third-party websites (e.g., vendor websites, payment processors, social media). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any external sites you visit.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on the Platform. We encourage you to review this policy periodically.
13. Contact
If you have questions or concerns about this Privacy Policy or our data practices, please contact us:
