Privacy Policy
Last updated: October 25, 2026
This policy explains what personal data we collect when you use weedorizers.com, why we use it, who receives it and what your rights are. How we use cookies and similar technologies is explained in our Cookie Policy.
1. Who we are
The controller of your personal data is Growth Mindset Hub s.r.o., Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic, company ID (IČO) 23481188 ("Weedorizers", "we"). We run the online store at weedorizers.com.
Contact for anything about your data: support@weedorizers.com, +386 70 794 119, or by post to the address above.
2. What data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | email address, login session | you, when you create an account or log in |
| Order and delivery data | name, email, phone, delivery address, country, chosen pick-up point, products, amounts, payment method, order history | you, at checkout |
| Payment data | payment status and transaction references. We do not see or store card numbers: card, Apple Pay and Google Pay details are entered on the payment provider's page. For crypto payments: wallet addresses and transaction ids on the public blockchain | you and the payment provider |
| Loyalty and rewards data | store credit ("Stash") balance and history, referral and affiliate codes | our systems |
| Communications | newsletter subscription and language, emails we send you and their delivery status, support emails, support-chat messages | you and our systems |
| Technical and usage data | IP address, browser and device type, pages visited, events in the store (for example "added to cart"), referring campaign and ad-click identifiers | your browser |
| Error and session diagnostics | error reports and, for a small sample of visits, a masked recording (text and form fields hidden) of how the page behaved (Session Replay) | your browser |
| Age confirmation | that you confirmed you are 18 or older | you |
We do not knowingly collect data from people under 18.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR art. 6(1)) |
|---|---|
| Creating and running your account | (b) contract |
| Taking, paying for, shipping and supporting your orders, including returns and refunds | (b) contract |
| Keeping invoices and order records | (c) legal obligation (accounting and tax law) |
| Store credit, referral and affiliate programmes | (b) contract (programme terms) |
| Order and account emails (confirmation, shipping, payment instructions) | (b) contract |
| Newsletter and marketing emails | (a) consent, which you can withdraw at any time through the unsubscribe link |
| Push notifications | (a) consent (your browser asks first) |
| Support chat | (b) contract / (f) legitimate interest in answering your questions |
| Advertising measurement with TikTok cookies, and sending purchase data to TikTok and Meta | (a) consent, given through the cookie banner; you can change it at any time under "Cookie settings" |
| Our own store statistics and campaign attribution (first-party, see the Cookie Policy) | (f) legitimate interest in understanding and improving the store |
| Keeping the store secure: rate limiting, fraud and abuse prevention, error monitoring | (f) legitimate interest in a secure, working store |
| Age confirmation | (f) legitimate interest in selling only to adults (a legal obligation in some countries) |
4. Who receives your data
We use the following service providers ("processors"), who process data only on our instructions:
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Supabase | database and login | all data in sections 2 and 3 | EU (Frankfurt) |
| Vercel | website hosting | all requests to the site (incl. IP address) | EU (Frankfurt); global edge cache |
| Sentry (Functional Software) | error monitoring and Session Replay | error reports, IP address, browser data, and for a small sample of visits a masked recording (text and form fields hidden) of how the page behaved | EU (Germany) |
| Resend | sending emails | email address, name, email content | EU (Ireland) |
| Costplus OÜ (formerly NoPayn), Estonia | card, Apple Pay and Google Pay payments | name, email, phone, address, amount, order number, IP address | EU (Estonia) |
| Reown (WalletConnect) | connecting your crypto wallet, only if you choose to pay with crypto | your IP address and wallet address when your browser connects | USA |
| Upstash | rate limiting (abuse protection) | IP address, for minutes | EU (Frankfurt) |
| Vercel AI Gateway with Anthropic (fallback: Google, OpenAI) | the support chat's AI assistant | your chat messages; a pseudonymous id (your customer id, or a salted hash of your IP address) | USA |
| GLS, Packeta | delivery | name, address, phone, email, pick-up point, order value / cash-on-delivery amount | EU |
| Your browser's push service (Google, Mozilla or Apple) | delivering push notifications you subscribed to | a technical subscription address | depends on your browser |
When you consent through the cookie banner, we also share data with these advertising partners, who act as independent controllers or joint controllers for their own purposes:
| Partner | What they receive |
|---|---|
| TikTok (TikTok Technology Ltd., Ireland) | cookie identifiers, page and shopping events, and for purchases: hashed email and phone, order value, product ids, IP address, browser data, ad-click id |
| Meta (Meta Platforms Ireland Ltd.) | for purchases: hashed email, phone, name, city, postcode and country; order value and contents; IP address, browser data |
Without your consent none of the above is sent to TikTok or Meta.
We also share data with authorities when the law requires it, and with professional advisers (accountants, lawyers) under confidentiality.
5. Transfers outside the EU/EEA
Most of our providers process data in the EU. Some providers or their sub-processors are in the USA (in particular the AI chat providers, and possibly parts of Vercel, Sentry, Google, TikTok and Meta). Where data leaves the EU/EEA, we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses.
6. How long we keep data
| Data | How long |
|---|---|
| Order and invoice records | 10 years (Czech accounting and VAT law) |
| Account data | until you delete your account; then your profile is anonymised (see below) |
| Support-chat transcripts | 90 days after the last message |
| Technical logs | 90 days (payment audit records longer, as required) |
| Store statistics | detailed browser data is removed after 90 days; anonymous totals are kept |
| Email delivery records | email content is removed after 18 months; the record that an email was sent is kept |
| Cookie choice | 6 months, then we ask again |
| Newsletter | until you unsubscribe |
Deleting your account removes your login, deletes your support-chat history and anonymises your customer profile (name, email, phone, address). Order records are kept for the period the law requires, without the technical and advertising identifiers (IP address, browser data, ad-click ids), which are deleted once the order is finished. Our own statistics no longer link to you.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its use, to data portability, and to withdraw any consent at any time (this does not affect what was done before). To use these rights, write to support@weedorizers.com.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Czech Úřad pro ochranu osobních údajů (ÚOOÚ, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz).
We do not make decisions about you that are based solely on automated processing and have legal or similarly significant effects.
8. Security
We protect your data with encryption in transit (HTTPS), access controls and providers that meet recognised security standards. Card data never reaches our servers.
9. Changes
We will publish any change to this policy on this page and update the date at the top.
