GLOBAL PRIVACY AND DATA PROTECTION POLICY

 

Effective Date: October 5, 2026 Data Controller: CaliClear LLC ([https://caliclearllc.com](https://caliclearllc.com)) Data Protection Officer / Privacy Contact: sales@caliclearllc.com

1. Introduction, Purpose, and Scope of Application

This Global Privacy and Data Protection Policy (hereinafter referred to as the “Policy”) establishes the comprehensive legal framework governing the acquisition, processing, cryptographic storage, and eventual dissemination or destruction of personal data by CaliClear LLC. Given the highly regulated, age-restricted nature of our commercial operations involving THC vaporization technologies and botanical distillates, the safeguarding of consumer data is managed with enterprise-grade security architectures and uncompromising compliance protocols.

This Policy is meticulously engineered to comply with modern, global data protection legislation, including but not limited to the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), and, where applicable, the European Union’s General Data Protection Regulation (GDPR) and the United Kingdom General Data Protection Regulation (UK GDPR).

By accessing the domain [https://caliclearllc.com](https://caliclearllc.com), interacting with our digital interfaces, or consummating a transaction, you explicitly acknowledge, understand, and provide informed consent to the data practices articulated within this exhaustive document. If you do not consent to these data processing modalities, you must immediately sever all connections to our digital infrastructure.

2. Taxonomy of Personal Data Acquired

To facilitate secure, legally compliant, and highly optimized e-commerce transactions, CaliClear LLC systematically captures, categorizes, and processes several distinct typologies of Personally Identifiable Information (PII) and non-personally identifiable telemetry data. This collection occurs through direct user input, automated tracking technologies, and vetted third-party aggregators.

2.1 Identity and Contact Data:

  • Full legal name, including aliases or designated recipient names for shipping purposes.

  • Verified billing address and primary physical delivery coordinates.

  • Active, monitored email address for order routing and legal notifications.

  • Primary mobile telephone number for SMS-based delivery updates and multifactor authentication (MFA).

2.2 Financial and Transactional Data:

  • Encrypted payment token identifiers and partial payment card nomenclature (Last 4 digits only). Note: CaliClear LLC utilizes Payment Card Industry Data Security Standard (PCI-DSS) Level 1 compliant third-party payment gateways. We do not process, store, or transmit full Primary Account Numbers (PANs) or CVV codes on our proprietary servers.

  • Comprehensive ledger of purchased goods, localized tax payments, and historical transaction volumes.

  • Chargeback history and fraud-risk profiling scores.

2.3 Compliance and Strict Age-Verification Data (Crucial Requirement): Due to stringent federal and state statutes regarding the distribution of psychoactive botanical extracts and inhalation hardware, CaliClear LLC is legally mandated to employ rigorous Know Your Customer (KYC) and age-gating protocols.

  • Date of birth, government-issued identification numbers (e.g., Driver’s License, Passport), and high-resolution optical scans of physical identification documents.

  • This data is transmitted directly via end-to-end encrypted API to authorized third-party identity verification clearinghouses (e.g., AgeChecker.Net, Veratad). We do not permanently store optical scans of your federal or state ID cards on our consumer-facing web servers.

2.4 Technical, Telemetry, and Network Data:

  • Dynamic and static Internet Protocol (IP) addresses, Media Access Control (MAC) addresses, and Internet Service Provider (ISP) routing logs.

  • Browser typologies, plugin architectures, operating system specifications, and localized time zone parameters.

  • Geographically localized data derived from IP coordinates to enforce jurisdictional shipping embargoes on restricted THC isomers.

2.5 Behavioral, Usage, and Interaction Data:

  • Session durations, precise page interaction metrics (scrolling depth, hyperlink actuation, mouse-over heatmaps).

  • Uniform Resource Locator (URL) referral tracking (identifying the domain you navigated from prior to accessing our Site).

  • Cart abandonment analytics, search query nomenclature inputted into our internal search engine, and user pathing through our site architecture.

3. Lawful Basis and Processing Modalities

In alignment with global privacy standards, CaliClear LLC processes your data strictly upon the following lawful bases:

  • Contractual Necessity: Processing is required to fulfill a legally binding contract with you, specifically managing financial transactions, logistics, hardware warranties, and delivery of products.

  • Statutory and Legal Compliance: Processing is mandated by prevailing law, including adherence to the Prevent All Cigarette Trafficking (PACT) Act, localized state cannabinoid restrictions, age-verification mandates, and federal/state tax reporting obligations.

  • Legitimate Business Interests: Processing is vital for our operational security, including deploying automated algorithmic fraud-detection to analyze high-risk transactions, preventing chargeback anomalies, mitigating identity spoofing, and optimizing the digital infrastructure of [https://caliclearllc.com](https://caliclearllc.com).

  • Explicit Consent: Processing for direct marketing, promotional literature, and advanced behavioral profiling is strictly predicated upon your affirmative, opt-in consent, which may be revoked instantaneously at any time.

4. Cryptographic Storage and Data Retention Architectures

CaliClear LLC approaches data security with the same clinical rigor applied to our biochemical refinement.

  • Encryption Standards: All data in transit between your localized terminal and our servers is secured via Transport Layer Security (TLS 1.3) protocols utilizing AES-256 bit cryptographic cyphers. Data at rest within our databases is equally encrypted and sequestered behind enterprise-grade firewalls.

  • Intrusion Detection: Our network infrastructure is monitored 24/7/365 by automated Intrusion Detection Systems (IDS) and undergoes continuous vulnerability scanning and penetration testing by independent cybersecurity auditors.

  • Retention Lifecycle: We adhere to the principle of data minimization. Your personal data is retained only for the duration strictly necessary to fulfill the purposes outlined in this Policy. However, transaction records, age-verification logs, and tax data are retained for a minimum of seven (7) years to comply with federal auditing requirements, after which they are mathematically obfuscated or permanently purged via cryptographic wiping protocols.

5. Third-Party Disclosures and Sub-Processors

CaliClear LLC categorically prohibits the unauthorized monetization, wholesale brokering, or leasing of your personal data to external marketing agencies. Disclosure of PII is heavily restricted and executed solely under binding Non-Disclosure Agreements (NDAs) with the following essential sub-processors:

  • Regulated Logistics Partners: United States Postal Service (USPS) or localized private couriers requiring your exact nomenclature and coordinates to execute the mandatory Adult Signature Required (ASR) delivery.

  • Identity Verification Networks: Third-party clearinghouses utilized exclusively for cross-referencing your submitted identity against public records to guarantee legal age compliance.

  • Regulatory and Law Enforcement Authorities: CaliClear LLC will unequivocally surrender requested digital, financial, and physical records to federal, state, or local law enforcement agencies, or public health authorities, when compelled by a valid subpoena, court order, or formal regulatory audit.

  • IT Infrastructure Providers: Encrypted data backups and cloud hosting environments (e.g., AWS, Google Cloud) that facilitate the foundational architecture of the Site.

6. Comprehensive Cookie Policy and Automated Telemetry

The CaliClear LLC domain deploys a sophisticated array of functional, analytical, and marketing cookies, as well as web beacons and tracking pixels.

  • Strictly Necessary (Session) Cookies: Imperative for maintaining cart state, authentication tokens, and bypassing the 21+ age gate during a singular browsing instance. The Site cannot function legally or mechanically without these.

  • Performance and Analytical Cookies: Deployed to aggregate macro-level telemetry data (e.g., Google Analytics) to monitor server load, page load velocities, and user friction points.

  • Preference and Persistent Cookies: Utilized to recognize returning IP addresses, store localized jurisdictional preferences, and expedite subsequent checkout procedures.

  • Consent Management: Upon your initial entry to the Site, a centralized Cookie Consent Banner allows you to granularly permit or deny non-essential tracking mechanisms. Furthermore, we recognize and respect browser-level Global Privacy Control (GPC) signals and Do Not Track (DNT) requests.

7. Global Data Subject Rights and Sovereign Control

Subject to verified identification and prevailing legal exemptions (particularly those governing the retention of records for the sale of age-restricted controlled substances), consumers possess the following sovereign rights regarding their data dossier:

  1. The Right to Access/Know: You may request a comprehensive, machine-readable digital dossier detailing the specific pieces of PII we have collected, the sources of that data, and the specific third parties with whom it has been shared.

  2. The Right to Erasure (Right to be Forgotten): You may mandate the permanent deletion of your PII from our active databases. Note: Due to the regulated nature of our products, transactional data and age-verification proof cannot be deleted until statutory retention periods expire.

  3. The Right to Rectification: You may formally amend inaccurate, incomplete, or obsolete data profiles within our system.

  4. The Right to Restrict Processing: You may temporarily halt the processing of your data if you are actively contesting its accuracy or the lawfulness of our processing basis.

  5. The Right to Data Portability: You may request your data be transferred directly to another data controller in a structured, commonly used format.

  6. The Right to Non-Discrimination: CaliClear LLC guarantees that no punitive pricing, service degradation, or account retaliation will occur as a consequence of exercising any of the aforementioned privacy rights.

Execution of Rights: To execute a Data Subject Access Request (DSAR) or invoke any privacy right, you must submit a formal, verifiable inquiry to our Data Protection Officer at sales@caliclearllc.com utilizing the subject line: “URGENT: Formal Privacy Rights/DSAR Inquiry.” We are legally obligated to respond to verified requests within forty-five (45) calendar days.

8. Data Breach Notification Protocols

In the highly unlikely event of a catastrophic security breach compromising unencrypted PII, CaliClear LLC has developed a rapid-response incident protocol. We will notify affected users, the appropriate state Attorneys General, and localized data protection authorities via email and public site declarations within seventy-two (72) hours of confirming the scope and severity of the breach, in accordance with applicable global data breach notification statutes.

9. Revisions to this Policy

As e-commerce infrastructure, data privacy legislation, and cannabinoid regulations continuously evolve, CaliClear LLC reserves the sovereign right to amend, update, or entirely rewrite this Policy at any time, without prior individual notice. All modifications become legally binding immediately upon their publication to this URL. The “Effective Date” at the apex of this document will reflect the most recent revision. Continued use of [https://caliclearllc.com](https://caliclearllc.com) constitutes your legally binding acceptance of all modernized terms.