Effective date: August 23, 2026
Meli LBC, Inc., doing business as Pistil Whip (“Pistil Whip,” “we,” “us,” or “our”), operates pistilwhip.com. This policy explains what personal information the site collects, why we collect it, who processes it on our behalf, how long we keep it, and the rights California residents have over it.
Pistil Whip is a licensed California cannabis brand. Our license numbers are C11-0001434-LIC and DCC-10004573. This site is intended only for adults 21 and older, and you must confirm your age before entering.
This policy covers the website only. It does not cover the licensed retailers who sell our products, the Weedmaps menu that runs inside our site, or any other company’s website that we link to. Those are governed by their own privacy policies.
1. The short version
- The only information you actively send us is what you type into the contact form: your name, your email address, a topic chosen from a fixed list, and your message.
- Our hosting and delivery providers automatically receive routine technical data, including your IP address and browser type, in their server logs.
- If you use the “Use my location” button on the Find It page, your location is calculated inside your own browser to sort the retailer list. It is never sent to us and never stored.
- Your 21+ confirmation is saved in your own browser, on your own device. It is not transmitted to us.
- We use one privacy-preserving analytics tool that counts page views. It sets no cookies, assigns you no identifier, and cannot follow you to any other website.
- We do not sell or share personal information, we run no advertising trackers, no session recording, and no marketing pixels.
2. Information we collect
2.1 Information you give us
The contact form. When you submit the form at pistilwhip.com/contact, we receive:
| Field | Required | Notes |
|---|---|---|
| Name | Yes | Free text, capped at 100 characters |
| Email address | Yes | Used as the reply address |
| Topic | No | Chosen from a fixed list. Free text is not accepted |
| Message | Yes | Free text, capped at 5,000 characters |
The form also carries a small number of hidden values that exist only to filter out automated submissions. They record nothing about you personally, they are not used for any other purpose, and they are discarded once the submission has been checked.
Please do not send us health information, government identification numbers, financial account details, or other sensitive information through the form. We do not ask for any of it and we have no use for it.
Email you send us directly. If you email an address listed on the site, we receive whatever you choose to put in that message.
2.2 Information collected automatically
Like every website, ours is delivered by servers that log routine request data. Our hosting provider and our image content delivery network receive and log:
- your IP address,
- your browser type, version, and operating system,
- the pages and files you requested and when,
- the referring page, if your browser sends one.
This data sits in our providers’ logs. We use it to keep the site available, diagnose problems, and stop abuse of the contact form. We do not combine it with your contact-form submission to build a profile of you, and we do not attempt to identify you from it.
Separately, our cookieless analytics tool records that a page was viewed and which site referred you, without assigning you an identifier. Section 3 describes exactly what it does and does not do.
Our contact form is protected by a rate limit that counts requests per IP address. That counting happens inside our hosting provider’s network security layer.
2.3 Location information
The Find It page has a “Use my location” button. It does nothing unless you press it, and pressing it triggers your browser’s own permission prompt, which you can decline.
If you allow it, your device gives your coordinates to the page. The page uses them to calculate the distance to each retailer and reorder the list. That calculation runs entirely in your browser. Your coordinates are not sent to our servers, not sent to our map provider, not written to any log, and not stored anywhere. Closing or reloading the page discards them.
If you type a city or ZIP code into the retailer search and nothing matches, the page sends that typed text (and only that text) to Mapbox’s geocoding service so it can find nearby shops. Your typed search term reaches Mapbox. Your device location does not.
Separately, our providers can infer your approximate location, usually at the city or regional level, from your IP address. That is a normal property of how the internet routes traffic and is not something we request or retain.
2.4 Information we do not collect
We do not collect or process: Social Security numbers, driver’s license or passport numbers, payment card or financial account information, precise geolocation retained by us, biometric information, health information, information about your purchases (no sales happen on this site), account credentials, race, religion, union membership, sexual orientation, immigration status, or the contents of your private communications with anyone other than us.
3. Cookies, local storage, and tracking
We set no cookies of our own. There is no Google Analytics, no Meta pixel, no advertising tag, no session replay, no heatmapping, and no cross-site tracking on this site.
We do use one analytics tool: Vercel Web Analytics. It counts how many people visit each page and which site referred them, so we can tell whether anyone is finding us. It is deliberately the least invasive option we could find:
- It sets no cookies and writes nothing to your browser’s storage.
- It assigns you no persistent identifier. It does not build a profile, and it cannot recognize you as the same person on a later visit.
- It is first-party. The script and the data it sends are served from this site’s own domain, and the data is not shared with an advertising network or joined with data from any other site.
- It records the page you viewed, the referring site, and coarse technical details such as country, browser, and device type. It does not record your IP address in the data we can see, and it does not track your movements across other websites.
We use it only to understand traffic in aggregate. We do not use it for advertising, targeting, or profiling, and we cannot use it to identify you.
We use browser storage in exactly one place. When you confirm you are 21 or older, the site saves a single value in your browser’s local storage so the age screen does not reappear on every page. That value lives on your device, is readable only by this site, is never transmitted to us, and disappears when you clear your browser’s site data.
Third-party features embedded in our pages may set their own cookies or storage:
- The Weedmaps menu on the Find It page is loaded and rendered by Weedmaps. It runs its own age gate and may set its own cookies or storage and collect its own usage data, under Weedmaps’ privacy policy rather than ours.
- The retailer map uses Mapbox GL JS. Mapbox collects standard map usage telemetry, such as map load and interaction events, and stores an anonymous identifier in your browser for that purpose, under Mapbox’s privacy policy.
Do Not Track. Some browsers can send a Do Not Track signal. There is still no common industry standard for how sites should respond to it, so we do not respond to it. This makes little practical difference here, because we do not track you across other websites in the first place. Third parties embedded in our pages, such as Weedmaps, may collect information about your online activity over time and across different sites, and we do not control that.
Global Privacy Control. We do not sell or share personal information, so there is nothing for an opt-out preference signal to switch off. If that ever changes, we will honor the Global Privacy Control signal as a valid opt-out request and will say so here.
4. Why we use your information
We use the information described above only for these purposes:
- To answer you. Replying to a product question, a wholesale or white-label inquiry, a “where can I buy this” question, or feedback.
- To run the site. Serving pages and images, keeping the site up, and fixing what breaks.
- To protect the site. Detecting and blocking spam, automated abuse, and attacks on the contact form.
- To understand traffic. Counting page views and referring sites in aggregate, so we can tell which pages people actually reach and whether the site is working. This never involves identifying you.
- To meet legal obligations. Including California cannabis advertising rules, which require us to restrict this site to adults 21 and older, to display our license numbers, and to keep certain business records.
We do not use your information for advertising, for profiling, for automated decision-making, or to build a marketing list. If you send us a wholesale inquiry, we reply to it. We do not add you to a newsletter, and there is no newsletter to add you to. If that changes, we will update this policy first and will ask for your consent separately.
5. Who processes information for us
We keep our own systems deliberately small and rely on established providers. Each one processes data only to deliver its service to us, under a contract that limits what it may do with that data.
| Provider | What it does for us | What it handles |
|---|---|---|
| Vercel | Hosts and delivers the site, runs the contact form endpoint, applies the rate limit, and provides the cookieless page-view analytics described in section 3 | Technical request data, including IP address, in server and security logs; aggregate page-view counts with no persistent identifier |
| Cloudinary | Delivers all photography and graphics | Technical request data for image files |
| Resend | Delivers your contact-form submission to us as an email | Your name, email address, topic, and message, in transit and in send logs |
| Google Workspace | Hosts the inbox that receives your message | Your submitted message, stored as email |
| Mapbox | Renders the retailer map and resolves city or ZIP searches | Technical request data, map usage telemetry, and any city or ZIP text you type into the retailer search |
We are not a party to what happens inside third-party features you choose to use, such as the Weedmaps menu, an Instagram link, or a Google Maps directions link. Those are covered in the next section.
6. Third-party features and links
Parts of this site are provided by other companies and operate under their privacy policies, not ours:
- Weedmaps. The live menu on the Find It page is a Weedmaps embed. Browsing it, and anything you do inside it, is governed by Weedmaps’ privacy policy and terms.
- Google Maps. Each retailer listing has a “Directions” link. Following it takes you to Google Maps with that retailer’s address, under Google’s privacy policy.
- Instagram. Our social link takes you to Instagram, under Meta’s privacy policy.
We do not control these companies, we do not receive the personal information they collect, and we recommend reading their policies before using those features.
7. Disclosure of personal information
We do not sell personal information, and we have not sold personal information in the preceding twelve months. We do not receive money or anything else of value in exchange for it.
We do not share personal information for cross-context behavioral advertising, and have not done so in the preceding twelve months. We do not run targeted advertising and we do not participate in advertising networks.
We do not disclose personal information to third parties for their own direct marketing.
We disclose personal information only:
- to the service providers listed in section 5, for the business purposes described there;
- to our professional advisers, such as lawyers and accountants, when they need it to advise us;
- if we are required to by law, subpoena, court order, or a lawful government request, or when we reasonably need to in order to protect our rights, safety, or property, or that of others;
- to an acquirer, in the event of a merger, acquisition, financing, or sale of assets. Any such successor would remain bound by this policy for information collected before the transfer, and we would post notice of the change here.
In the preceding twelve months, the categories of personal information we disclosed for a business purpose are: identifiers (name, email address, IP address) and internet or other electronic network activity information. The recipients were the service providers listed in section 5.
8. How long we keep information
| What | How long | Why |
|---|---|---|
| Contact-form messages in our inbox | 24 months from the date received, then deleted | Long enough to handle a reply, a follow-up conversation, and an ongoing wholesale relationship, and to defend against a dispute |
| Email delivery logs at Resend | The period set by that provider, then purged on its schedule | We do not control this and do not extend it |
| Hosting and security logs at Vercel and Cloudinary | The period set by each provider, typically short and measured in days, then rotated | Operational and security necessity only |
| Your 21+ confirmation | Until you clear your browser’s site data | It never leaves your device |
| Your location from “Use my location” | Not retained. Discarded when the page closes | It never leaves your device |
We do not keep contact-form submissions in any database, spreadsheet, or customer relationship system. The email inbox is the only copy we hold, and deleting the message deletes the record.
9. How we protect information
- The whole site is served over HTTPS, with strict transport security enforced, so traffic between your browser and our providers is encrypted.
- The contact form is validated on the server, not just in your browser, and is rate limited by IP address to stop automated abuse.
- Submitted names, email addresses, and message contents are never written to our application logs. We log only whether a submission succeeded or failed.
- We hold no customer database, no passwords, and no payment information, so there is nothing of that kind to breach.
- Access to the inbox that receives your messages is limited to the staff who need it to reply, and is protected by multi-factor authentication.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We reduce that risk mainly by collecting very little in the first place.
10. Your California privacy rights
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights below. We honor these requests regardless of whether we are strictly required to.
Right to know. You may ask us to tell you the categories of personal information we have collected about you, the categories of sources, our business purpose for collecting it, the categories of third parties to whom we disclosed it, and the specific pieces of personal information we hold about you.
Right to delete. You may ask us to delete the personal information we collected from you. We will do so unless we need to keep it to complete a transaction you asked for, detect security incidents, comply with a legal obligation, or for another purpose the law permits, in which case we will tell you which exception applies.
Right to correct. You may ask us to correct inaccurate personal information we hold about you.
Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of and no “Do Not Sell or Share My Personal Information” link on this site. If we ever begin selling or sharing, we will add that link and update this policy before doing so.
Right to limit the use of sensitive personal information. We do not collect or use sensitive personal information as the law defines it. Precise geolocation, which is the only category this site touches, never leaves your device and is never received by us.
Right to non-discrimination. We will not deny you goods or services, charge you a different price, or give you a lower quality of service because you exercised any of these rights.
How to make a request
Email info@pistilwhip.com with the subject line “California Privacy Request” and tell us which right you are exercising. This site operates exclusively online and we have no other channel through which we collect your information, so email is the method we provide.
To protect you, we have to verify that the request really comes from you. Because the only information we hold is what you sent through the contact form or by email, we verify by matching your request against that record. We will ask you to make the request from the same email address you used to contact us, and to confirm details of the message you sent. If we cannot verify you to a reasonable degree of certainty, we will tell you why and will not disclose personal information.
An authorized agent may submit a request on your behalf. We will ask the agent for written permission signed by you, and we may still ask you to verify your own identity with us directly.
We will confirm receipt within 10 business days and respond substantively within 45 calendar days. If we need more time, we will tell you within that first 45 days and may take up to 45 additional days. There is no charge for a request unless it is manifestly unfounded or excessive, in which case we will explain the reason before doing anything.
If you need this policy or a response in an alternative accessible format, email info@pistilwhip.com and we will provide one.
If you believe we have not handled your request properly, you may contact us first, and you may also file a complaint with the California Privacy Protection Agency or the California Attorney General.
Shine the Light
California Civil Code section 1798.83 lets California residents ask a business, once a year and free of charge, for a list of the personal information it disclosed to third parties for those third parties’ own direct marketing purposes during the prior calendar year. We do not disclose personal information to third parties for their direct marketing purposes. As permitted by that section, we designate an email address rather than a postal address for these requests. To request confirmation, email info@pistilwhip.com with “Shine the Light Request” in the subject line.
If you live outside California
This is a California brand, our products are sold only at licensed California retailers, and the site is aimed at California residents. If you visit from elsewhere and your state gives you similar privacy rights, email info@pistilwhip.com and we will handle your request the same way we handle a California one. We do not intend this site for visitors outside the United States and we do not offer goods or services to them.
11. Age restriction and minors
Cannabis is for adults. This site, its content, and our products are intended only for adults 21 and older. We require age confirmation before entry, and the site is not directed to anyone under 21.
We do not knowingly collect personal information from anyone under 21, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 (we do not sell or share personal information at all). If we learn that we have received information from someone under 21, we will delete it. A parent or guardian who believes a minor has sent us information should email info@pistilwhip.com and we will delete it promptly.
Keep our products out of the reach of children and pets.
12. Changes to this policy
If we change this policy, we will post the updated version here and change the effective date at the top. If the change is significant, such as adopting analytics that identify you, adding a mailing list, or selling merchandise, we will make that clear on the page rather than relying on the date alone. Your continued use of the site after an update means you accept the current policy.
13. How to reach us
Questions about privacy, or a request under section 10:
Meli LBC, Inc., doing business as Pistil Whip info@pistilwhip.com
We operate this site entirely online and handle privacy requests by email. If you need to reach us by post instead, email us and we will give you an address for that purpose.
Licenses: C11-0001434-LIC, DCC-10004573.
For use only by adults 21 and older. Keep out of reach of children and pets. Do not operate a vehicle or machinery under the influence of cannabis.