Privacy Policy

We are Flight Attendant LLC, doing business under the Flight Attendant brand ("Flight Attendant," "we," "us," or "our"). We respect your privacy. This Privacy Policy explains what information we collect through flightattendant.shop, how we use and disclose it, the choices available to you, and how to contact us.

1. Scope

This Privacy Policy applies when you:

• Visit flightattendant.shop or any page we operate as part of the website;
• Submit your email address through our "Get the Drop List" form;
• Send us a general, wholesale, privacy, press, support, partnership, or other business inquiry; or
• Otherwise communicate directly with us through a contact method shown on the website.

This Privacy Policy does not apply to independently operated dispensaries, delivery services, social-media platforms, maps, or other third-party services linked from our website. Those parties control their own privacy practices, and their policies apply when you use their services.

Our Terms of Use also govern your use of the website.

2. Intended Audience and Age Affirmation

Our website is intended only for adults who are at least 21 years old and located in California.

When you enter the website, the age gate asks you to affirm that you are at least 21. Before we accept a "Get the Drop List" submission, the form also requires you to affirm that you are at least 21 and a California resident.

These steps are user representations. They are not government-ID checks and do not independently verify your identity, age, residence, or ownership of an email account. If you are under 21, do not use the website or submit information to us.

3. Information We Collect

3.1 Information You Provide Through the Drop-List Form

When you submit the "Get the Drop List" form, we collect:

• Your full name;
• Your email address;
• Your five-digit ZIP code;
• The age range you select;
• Your affirmative representation that you are at least 21 and a California resident; and
• Your marketing consent, consent version, consent timestamp, and information needed to complete security and anti-bot checks.

Our intake process may also create basic submission information, such as the date and time of the request and the website source associated with it.

We may standardize the email address you provide, such as by removing accidental spaces or normalizing capitalization, so we can reduce duplicate contact records and manage the list accurately.

The current form does not require you to confirm the email address through a mandatory confirmation link. A submission therefore does not prove that the mailbox exists or belongs to the person who submitted it.

Submitting the form does not create an account, place an order, reserve a product, establish a verified customer relationship, or guarantee that we will send a message.

3.2 Information You Provide in Communications

When you email or otherwise contact us, we may collect:

• Your email address and any other contact information you choose to provide;
• Your name, company, job title, or telephone number if you include it;
• The contents of your message;
• Information related to a wholesale, retailer, distributor, press, support, partnership, privacy, or other inquiry; and
• Any attachment or material you voluntarily send.

Please do not send sensitive personal information through a general website or ordinary email inquiry unless it is reasonably necessary and we have asked you to provide it through an appropriate channel.

3.3 Website, Device, Log, and Security Information

When you use the website, our hosting and security providers may process basic technical information needed to display and protect it. Depending on the request and provider configuration, this information may include:

• Browser and device type;
• Operating-system information;
• Internet Protocol address or a similar network identifier;
• Date and time of a request;
• Pages or resources requested;
• Referring-page information supplied by your browser;
• Error, diagnostic, and performance information; and
• Security, fraud-prevention, and anti-bot signals.

We use this information to operate the website, troubleshoot problems, protect the form, prevent abuse, and maintain security. We do not publish detailed anti-abuse rules, security thresholds, credentials, or other information that could make those protections easier to defeat.

3.4 Age-Gate Status Stored in Your Browser

After you pass the age gate, the website stores a status entry locally in your browser for approximately 30 days. This helps the website remember that you previously passed the gate so it does not need to appear on every visit.

The stored status reflects your representation only. It does not verify your identity, age, or California residency. You can generally remove it by clearing the website's local storage or site data in your browser. The age gate may appear again after the entry is removed or expires.

3.5 Information We Do Not Collect Through the Current Public Form

The current public form does not collect:

• Payment-card, bank-account, or billing information;
• Shipping or cannabis-delivery addresses;
• Direct cannabis order or purchase information;
• Customer-account passwords;
• Government identification or Social Security numbers;
• Telephone numbers for SMS marketing; or
• Information needed for direct shipping, fulfillment, or delivery.

The website does not provide direct cannabis checkout, payment processing, shipping, fulfillment, or delivery.

4. How We Use Information

We use information collected through the website to:

• Operate, maintain, display, and protect the website;
• Process a voluntary drop-list request;
• Maintain, standardize, and deduplicate contact records;
• Send email about new Flight Attendant batches or California stockists if and when those communications are activated;
• Respond to general, wholesale, retailer, distributor, press, support, partnership, privacy, and other inquiries;
• Route a communication to the appropriate person or business function;
• Prevent spam, fraud, automated submissions, security incidents, and other abuse;
• Troubleshoot and diagnose technical problems;
• Maintain reasonable records of our interactions;
• Enforce our Terms of Use and protect our rights; and
• Comply with applicable legal, regulatory, licensing, and reporting obligations.

We do not use a drop-list submission to create a direct cannabis order or to promise product availability. The current submission flow does not send an automatic welcome email and does not enroll you in SMS messaging.

5. Email Communications and Your Right to Opt Out

If we activate drop-list email communications, each promotional email will provide a clear way to unsubscribe. You may also request removal by emailing privacy@flightattendant.shop from the address you want removed and using the subject line "Unsubscribe."

We will process a valid marketing opt-out request as soon as reasonably practicable and no later than 10 business days after receiving it. We will not charge a fee, require you to create an account, or require information beyond what is reasonably needed to identify the email address and carry out the request.

After you opt out, we may keep a limited suppression record so we can honor your request and avoid adding the address back to promotional lists. Opting out of promotional email does not prevent us from sending a nonmarketing message that is reasonably necessary to respond to an inquiry, document a request, address security, or comply with law.

6. How We Disclose Information

We disclose personal information only for the purposes described below.

6.1 Service Providers

We may provide information to service providers that support our website, security, form processing, contact management, and business communications. They may process information for us subject to applicable contracts, configurations, and legal requirements.

6.2 Legal, Safety, and Compliance Purposes

We may disclose information when reasonably necessary to:

• Comply with applicable law, regulation, legal process, court order, subpoena, or lawful government request;
• Cooperate with a licensing authority or regulator;
• Investigate or address fraud, abuse, security incidents, or unlawful activity;
• Enforce our agreements or protect our rights; or
• Protect the rights, property, health, or safety of our company, website visitors, service providers, or others.

6.3 At Your Direction

We may disclose information when you direct or authorize us to do so, such as when you ask us to route an inquiry or make a business introduction.

6.4 Business Changes

If our business is involved in a merger, acquisition, financing, reorganization, bankruptcy, or transfer of all or part of our operations, information may be reviewed or transferred as part of that process, subject to applicable law and appropriate confidentiality protections.

6.5 No Sale or Cross-Context Behavioral Advertising

We do not sell personal information for money. Based on the website's current configuration, we do not share personal information for cross-context behavioral advertising, and we do not use advertising pixels or retargeting tools on the website.

If these practices change, we will update this Privacy Policy and provide any legally required notice and choice before the new practice begins.

7. Current Service Providers

We currently use the following providers for the roles described below:

Cloudflare

Cloudflare supports website hosting through Cloudflare Pages, website and form security, Turnstile anti-bot verification, and server-side form intake.

HubSpot

HubSpot supports contact and customer-relationship management. When a valid drop-list request is processed, the email address may be added to or updated in our contact-management system. If you choose to allow it in our analytics-cookie notice, HubSpot also provides optional website analytics as described in Section 8.3; that measurement is off unless you allow it.

A contact record does not independently prove that the mailbox exists, that the person who submitted it owns the mailbox, or that an outbound message has been sent.

Google Workspace and Gmail

Google Workspace and Gmail support our business email communications, including messages you voluntarily send to our published contact addresses.

8. Cookies, Local Storage, and Similar Technologies

8.1 Essential Website and Security Technologies

The website and our providers may use cookies, local storage, request information, or similar technical mechanisms when necessary to display, secure, and protect the website and its forms.

8.2 Age-Gate Local Storage

As explained above, the website stores an age-gate pass locally in your browser for approximately 30 days.

8.3 Analytics and Advertising Technologies

After a visitor passes the website's 21+ gate, we use Google Analytics 4 to understand website traffic and how visitors interact with our pages, navigation, product classes, stockist links, and inquiry forms. Google Analytics may use cookies or similar identifiers and may process device and browser information, referring pages, pages viewed, interaction events, and approximate geographic information derived from network information.

We do not send names, email addresses, telephone numbers, licence numbers, ZIP codes, company names, free-text inquiry content, or other form-field values to Google Analytics. Form analytics are limited to non-identifying events such as a form start, success, or error. We disable Google Signals and advertising-personalization features and do not use Google Analytics for targeted advertising, retargeting, or session replay.

Google processes Analytics data on our behalf under its terms. More information about how Google uses information from sites that use its services is available at https://policies.google.com/technologies/partner-sites. You can limit Analytics cookies through your browser settings. Google Analytics user-level and event-level data are configured for the longest standard retention period currently available to us, while aggregated reports may remain available longer.

HubSpot website analytics (opt-in only). If you choose to allow it, we also use HubSpot, a customer-relationship platform operated by HubSpot, Inc., to measure how visitors use the website. HubSpot's website tracking code loads only after you select "Allow" in our analytics-cookie notice, which appears after the 21+ gate. If you select "Decline," or make no choice, the HubSpot tracking code is not loaded and no HubSpot cookies are set. Selecting "Yes, I'm 21+" at the age gate is not consent to HubSpot analytics.

When allowed, HubSpot sets first-party cookies (for example hubspotutk, __hstc, __hssc, and __hssrc) that assign a random identifier to your browser and record page views and the same non-identifying interaction events we describe for Google Analytics above (for example which product class you viewed or whether you started a form). We do not send HubSpot your name, email address, telephone number, licence details, ZIP code, company name, form-field values, free-text content, or precise location, and we do not use HubSpot for advertising pixels, retargeting, or session replay. If you later submit our drop-list or wholesale form, HubSpot may associate your earlier anonymous page views on this website with the contact record that form creates, so that we can understand which pages led to inquiries.

We use HubSpot analytics to measure website performance and to understand which content leads to inquiries. HubSpot's hubspotutk and __hstc cookies persist for up to 13 months; __hssc and __hssrc last for the browser session. Associated analytics data is retained under our HubSpot data-retention settings and deleted on request. You can decline in the analytics-cookie notice, and you can withdraw consent at any time by selecting "Tracking preferences" in the website footer, which removes the HubSpot cookies from your browser and stops all further HubSpot measurement on that device. Withdrawal does not delete data HubSpot has already received; to request deletion, contact us using the details in Section 15. HubSpot's privacy practices are described at https://legal.hubspot.com/privacy-policy.

We will review and update this Privacy Policy before activating advertising pixels, targeted advertising, session replay, or materially different tracking technology.

8.4 Do Not Track and Privacy-Preference Signals

Some browsers offer a "Do Not Track" setting or another privacy-preference signal. Because we do not currently sell or share personal information for cross-context behavioral advertising or allow third-party advertising networks to track activity through this website, those signals do not change our current website practices. Browser controls that block or clear cookies may limit Google Analytics collection.

If our practices later involve activity for which California law requires us to recognize an opt-out preference signal, we will honor qualifying signals and update this Privacy Policy and the website's controls before that activity begins.

9. Third-Party Websites and Services

Our website may link to independently operated California dispensaries, delivery services, maps, stockist pages, social-media platforms, and other external services.

Those third parties control their own websites, inventory, transactions, delivery operations, data collection, security, and privacy practices. When you leave flightattendant.shop or communicate directly with a third party, that party's privacy policy and terms apply.

A link does not mean that the third party collects information for us unless we have expressly engaged it as our service provider.

10. Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy. The appropriate period depends on the type of information and why we collected it.

We may retain information as needed to:

• Maintain a requested drop-list contact;
• Respond to and document an inquiry;
• Operate and secure the website;
• Maintain unsubscribe and suppression records;
• Comply with legal, regulatory, licensing, tax, or recordkeeping obligations;
• Resolve disputes; and
• Enforce agreements or protect legal rights.

When information is no longer reasonably needed, we may delete, deidentify, or securely dispose of it, subject to backup cycles, legal holds, and applicable obligations.

11. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include access controls, encrypted transmission, service-provider security features, form-security controls, and limits on who may access business systems.

No website, email system, transmission method, or storage system can be guaranteed to be completely secure. Please use care when deciding what information to send through a website form or ordinary email.

12. California Privacy Choices

We provide the request options below to California residents. We will honor rights required by applicable California law and may honor additional reasonable requests voluntarily.

You may email privacy@flightattendant.shop to request that we:

• Confirm whether we maintain personal information associated with you;
• Provide access to personal information we can reasonably identify as yours;
• Correct inaccurate personal information;
• Delete personal information, subject to applicable exceptions;
• Explain the categories of information we collect, use, and disclose; or
• Stop promotional email communications.

To protect your information, we may ask you to verify control of the relevant email address or provide information reasonably necessary to identify the record. An authorized agent may submit a request for you, but we may ask for proof of authorization and may verify your identity directly when permitted by law.

We may retain information when reasonably necessary to comply with law, protect security, complete a request, maintain an unsubscribe record, establish or defend legal claims, or satisfy another legally permitted purpose.

We will not discriminate against you for making a privacy request or exercising a right provided by applicable law.

Sale and Sharing Opt-Out

We do not currently sell personal information or share it for cross-context behavioral advertising. For that reason, the website does not currently provide a separate "Do Not Sell or Share My Personal Information" link. You may nevertheless contact privacy@flightattendant.shop with any question or concern about these practices.

California Direct-Marketing Disclosure

We do not disclose personal information to third parties for their own direct-marketing purposes. California residents may contact privacy@flightattendant.shop with questions about this statement.

13. Persons Under 21

The website and drop-list form are not intended for anyone under 21. We do not knowingly use the website to solicit personal information from people under 21.

If you believe that a person under 21 submitted personal information through the website, email privacy@flightattendant.shop with enough information for us to identify and review the record.

14. Changes to This Privacy Policy

We may update this Privacy Policy when our website, providers, business practices, or legal obligations change. We will update the "Last Updated" date at the top when we publish a revised version.

We will review and revise this Privacy Policy before launching direct ecommerce, customer accounts, payment collection, SMS messaging, direct fulfillment, out-of-state availability, targeted advertising, advertising pixels, or materially different tracking technology.

15. Contact Us

For privacy questions, requests, or marketing opt-outs, contact us at:

privacy@flightattendant.shop

For general website questions, contact:

hello@flightattendant.shop

Website Operator: Flight Attendant LLC