Privacy Policy

1. Information We Collect

To comply with NY OCM regulations and operate our retail and delivery service, we collect the following information from customers:

• Name — legal first and last name, as required for age-verification and order fulfillment.
• Phone number — required for SMS order confirmations, delivery dispatch notifications, and customer support.
• Email address — used for order receipts, payment verification, and optional marketing communications (opt-in only).
• Delivery address — required for same-day cannabis delivery; we do not store addresses for pickup-only customers beyond the transactional receipt window.
• Government-issued photo ID — photo of a valid 21+ government-issued ID (driver license, passport, or state ID) is required per NY OCM compliance at the point of purchase. ID photos submitted online for verification are processed through our Dutchie integration; see the Third-Party Sharing section below.
• Payment-proof evidence — screenshots of Venmo, Zelle, or bank transfers submitted to silkroadpays@gmail.com for payment verification when customer pays via non-Dutchie-Pay methods.
• Order history — products purchased, quantities, prices, and dates, stored for tax and regulatory audit purposes.
• Technical and usage data — IP address, browser type, device type, pages visited, referrer, and session cookies used by our website analytics and shopping cart.

We do not knowingly collect information from minors under 21. Our service is restricted to adults age 21 and older, and all IDs are age-verified at both the online intake point and the physical hand-off point per NY OCM regulations.

2. How We Store Your Information

Customer order and account data is stored across three systems: (a) our WordPress-based order management system using a custom post type (sr_order), hosted on our secured GoDaddy Managed WordPress infrastructure; (b) Dutchie's licensed cannabis commerce platform (dispensary ID 65b96d33c80f4c0009411c40), which is SOC 2 Type II compliant and encrypts customer data at rest and in transit; (c) Leaflogix, our OCM-required traceability and inventory-management platform, which retains transaction-level records as part of NY state seed-to-sale compliance.

All three systems use industry-standard encryption (TLS 1.2+ in transit, AES-256 at rest) and enforce role-based access for employees who need to view customer data for order fulfillment or compliance purposes.

3. Data Retention

In accordance with NY Office of Cannabis Management regulations (9 NYCRR Part 118), adult-use cannabis retailers in New York State are required to maintain transaction-level records — including customer identification (age-verification records), product sold, quantity, date, and price — for a minimum of seven (7) years. We retain this compliance-mandated data for the full seven-year window per state law.

Non-compliance customer data (email addresses for marketing, cart-abandonment data, website analytics) is retained for shorter periods: email marketing lists for the duration of your opt-in plus 30 days after unsubscribe; cart-abandonment data for 14 days; website analytics for 26 months per Google Analytics defaults. You may request deletion of non-compliance data at any time (see Section 7 below).

4. How We Use Your Information

We use the information we collect only for:

• Order fulfillment (processing, picking, packing, delivering, and receipting your cannabis order).
• Age-verification and ID-compliance audits as required by NY OCM.
• Payment verification, including matching Venmo/Zelle screenshots against purchase records.
• Customer service (responding to your questions, refunds, order adjustments).
• Regulatory audit response (OCM audit requests, subpoenas, compliance reviews).
• Email marketing, only if you have opted in — you may opt out at any time.
• Improving our website and service via aggregated, non-personally-identifiable analytics.

We do not sell your personal information to data brokers, marketing aggregators, or any third party. Ever.

5. Third-Party Sharing

We share necessary customer data with the following service providers for legitimate operational purposes only:

• Dutchie — our NY OCM-integrated commerce platform, for order processing, checkout, payment, and age-verification. Dutchie is SOC 2 Type II compliant. Orders placed through our site route to Dutchie via retailer ID bb93d3ec-f997-41ff-9ebe-44a1171f0556 and surface at admin.dutchie.com under dispensary 65b96d33c80f4c0009411c40.
• Leaflogix — our NY OCM-required seed-to-sale traceability system. Transaction data is shared with Leaflogix as part of state-mandated compliance reporting.
• Twilio (when activated) — SMS delivery for order confirmations and driver-dispatch notifications. Phone numbers are shared only for the duration of the message delivery window.
• Google Analytics — anonymized website usage data only. No personally identifiable information is shared with Google.

We do not share customer data with Stripe, Square, or any major credit-card payment processor at this time — credit-card acceptance requires manual ID-match verification via silkroadpays@gmail.com and is not routed through an automated payment processor.

6. Cookies and Similar Technologies

Our website uses cookies for: (a) session management (keeping you logged in and your cart state across pages); (b) anonymous analytics (Google Analytics measurement of page performance); (c) third-party-embedded commerce widgets from Dutchie during checkout flow. You may disable cookies in your browser settings, but doing so may break the cart and checkout experience. We do not use cross-site tracking cookies or advertising retargeting pixels at this time.

7. Your Rights — CCPA and NY SHIELD Act

Under the California Consumer Privacy Act (CCPA) and the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act, you have the right to:

• Access the personal information we have collected about you.
• Delete non-compliance-mandated personal information (see Section 3 on retention; transaction records required by NY OCM cannot be deleted until the seven-year retention window closes).
• Correct inaccurate personal information we hold about you.
• Opt out of email marketing at any time, immediately, with one click.
• Know what categories of personal information we have collected, for what purposes, and with whom we have shared it.
• Non-discrimination — we will not charge you a different price or provide a different quality of service for exercising any of these rights.

To exercise any of these rights, email sohan23@gmail.com with the subject line "PRIVACY REQUEST — [your full name]." We will respond within 30 days as required by both CCPA and NY SHIELD, and may require proof of identity before acting on the request.

8. Data Breach Notification

In the event of a data breach involving your personal information, Silk Road NYC will notify affected customers within 72 hours of confirmed breach discovery, consistent with NY SHIELD Act notification requirements. Notification will include the scope of the breach, the specific information affected, steps we are taking to address the breach, and recommended steps for affected customers to protect themselves.

9. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we do, we will update the "Last updated" date at the top of the page and, for material changes, notify customers via email if they have opted in to marketing communications. We encourage you to review this policy periodically.

10. Contact for Privacy Questions or Deletion Requests

All privacy-related inquiries, deletion requests, data-access requests, and breach reports should be directed to:

Sohan Bashar, Owner & Operator
Silk Road NYC Cannabis Dispensary (NYSE3AU-RETAIL INC)
166-30 Jamaica Ave, Queens, NY 11432
Email: sohan23@gmail.com
Phone: (347) 233-3879
Hours: Sun-Wed 10am-9pm · Thu-Sat 10am-10pm