Privacy Policy

PuffPoint operates an online ordering and store-owned delivery platform for licensed retailers of age-restricted products. This policy covers our customer ordering experience (web and in-store), the store staff console, and the PuffPoint Driver mobile app. It explains what we collect, why, who we share it with, and your choices.

• Account & contact: name, email, phone number, and password (stored only as a secure hash).
• Order & delivery: delivery address, order contents, delivery instructions, and delivery status history.
• Payment: processed by Stripe. Card details are entered directly with Stripe and are neverstored on PuffPoint’s servers; we retain only a payment reference and amount.
• Age & identity verification: for age-restricted orders we verify age at checkout and, at delivery, via an ID document scan. Verification is performed by our identity providers; where an ID image is captured it is stored encrypted and access-controlled, and deleted per our retention schedule.
• Driver location (Driver app only): precise location during an active delivery, to show live progress to the store and customer. Not collected when there is no active delivery.
• Device & diagnostic: app version, crash and error diagnostics used to keep the service stable.

To take and fulfill orders, operate delivery, verify age and identity as required by law, process payments, send you order and delivery notifications, provide support, and keep the service secure. We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

Only service providers needed to run the platform:

• Stripe — payment processing.
• Identity/age-verification providers — to confirm age and validate ID documents for restricted orders.
• Microsoft Azure — hosting and encrypted storage.
• Twilio / SendGrid — SMS and email order and delivery notifications.
• Sentry — crash and error diagnostics.
• The store you order from receives the information needed to prepare and deliver your order.

PuffPoint is intended solely for adults of legal purchasing age for the products offered. We do not knowingly collect information from anyone under that age, and age is verified before a restricted order is fulfilled.

Compliance records for restricted sales and deliveries (including age/ID verification outcomes) are retained for the period required by applicable law [specify jurisdiction and period]. Other personal data is kept only as long as needed for the purposes above. ID-scan images are deleted when their compliance record is purged.

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, and to opt out of certain processing. You can delete your account from the app, which anonymizes your personal data and removes your ID-scan images, while retaining the transaction records the law requires us to keep. To exercise other rights, contact us at [privacy contact email].

All traffic uses HTTPS. Credentials are hashed; auth tokens on mobile are held in the device secure store. Sensitive images are stored in private, access-controlled storage. No system is perfectly secure, but we work to protect your information using industry-standard measures.

We may update this policy; material changes will be posted here with a new effective date.

[Legal entity name], [business address], [privacy contact email]