On Root Privacy Policy

Effective Date: September 12, 2024

Thank you for using On Root, an e-commerce platform and on-demand delivery service for cannabis products. This Privacy Policy applies to your use of On Root, and any websites, mobile applications, services, programs, or features (the "On Root Platform") owned or operated by On Root, LLC (collectively, "On Root," "we," "our," or "us"). On Root values your privacy, and taking proper care of your information is our top priority. Our goal is to help you understand what information we collect about you (also known as "User Data") and describe how we use that information to provide you and all of our users with safe and secure access to legal cannabis, industrial hemp-derived CBD, and other products and accessories.

This Privacy Policy is part of, and is governed by, the terms and conditions outlined in our Terms of Service, including any agreements incorporated by reference within the Terms of Service (the "On Root Terms"). Any terms not defined in this Privacy Policy will have the meaning given to them in our Terms of Service. If you feel uncomfortable with any part of this Privacy Policy or our Terms of Service, you should stop using or accessing the On Root Platform and terminate your Account.

Information We Collect

Please note not all accounts or features are available in all locations, so some of the examples below may not apply to you.

Information You Provide To Us

We collect information about you when:

• You provide it to us directly,
• We request it from you, or
• You permit us to get it from a third-party source.

Below are some examples of the types of information we collect.

Registration and Identity Verification

When you sign up for any On Root account, you give us your name, email address, phone number, date of birth, and, if necessary, a copy of your government-issued ID (i.e., your driver's license, state ID card, or passport). To receive a delivery or shipment, you must provide a valid delivery address — (i.e., your home address).

Demographic Information

We also collect demographic information from you when you register, take our surveys, and use the On Root Platform. Demographic information may include age, gender, location, how you heard about On Root, spending habits, consumption preferences, and other preferences or habits.

Communications

If you contact us directly, we may collect information from you that helps us provide a satisfying experience and answers any questions you have while using On Root. For example, when you communicate with a member of our customer service team, we may ask you for your name, email address, delivery address, phone number, or proof of charge to identify your account, confirm your identity, or assist with your issue. If you send us an email, we will collect the contents of that email and any other information you choose to provide with your email. That correspondence will be archived if you communicate with us via live chat. If you communicate with us via social media, we collect that communication and associate that information with your user account to the extent the information can be linked. Customer service communications over the phone may be recorded for quality control purposes and may be summarized within our customer support systems.

Payment Information

Payment information may be collected in connection with a transaction facilitated by On Root. Payment information flows through Aeropay, who processes the payments for On Root and the Retailers. The collection of your personal financial information by Aeropay shall be subject to Aeropay's relevant terms of service and privacy policy. In addition, we may retain a limited amount of information about your transaction for identification and convenience.

Voluntary User Surveys

From time to time, we may invite you to fill out voluntary user surveys or to participate in focus groups to provide feedback on various topics, which may include, without limitation:

• Your experiences with On Root and/or our partners,
• Your experience with the On Root Platform,Available products,
• New services,
• Your preferences related to cannabis, and
• Your sentiments on public policy or other cannabis industry topics.

These surveys are often conducted by On Root or third-party market research firms, who collect such data on our behalf to analyze industry preferences and trends. On Root does not share your survey information individually and does not share this data for direct marketing to its users.

Information We Collect When You Use On Root

Like most online services, On Root automatically collects technical information about you or the device used to access the On Root Platform. We collect information from your browser, computer, mobile device, or other device used to access the On Root Platform as necessary to administer and operate the On Root Platform. We also use data analytics to improve the On Root Platform and the user experience. Below, we provide examples of the types of data we may collect about you.

Location Information

We collect your location information when you provide us with a delivery address or we may use geolocation-based services to verify your location. Knowing your location may be necessary to allow you full access to our mobile applications or certain aspects of the On Root Platform. Furthermore, for compliance reasons, some of the On Root Platform may be restricted depending on your location. Collecting your location information is also necessary to connect you to a retailer that services your delivery area, sends you relevant content based on your location, and optimizes or improves our products and services.

Usage Information

We log how you interact with the On Root Platform by automatically recording data sent by your application or browser. This includes, but is not limited to, the products and content you view, your actions on the On Root Platform, how you access our On Root Platform, and the details of any orders you place.

Device Information

We collect information about the device you are using, such as the device's IP address, web browser, operating system, phone carrier, manufacturer, unique identifiers (such as advertising ID, VIN, MAC address, and IDFA), and other related software or hardware information related to your device.

Cookies and Technical Information

We also collect information through the use of "cookies," tracking pixels, and similar technologies. Cookies are small text files created by websites and stored on your device. They provide a way for the On Root Platform to recognize you and keep track of your settings and preferences. We also use cookies and similar technologies to provide you with a secure experience and to understand, among other things, how you navigate the On Root Platform, learn what content is popular, recognize repeat users, and save your account information. The On Root Platform is not configured to read or respond to "do not track" settings or signals in your browser settings.

There are also cookies or other tracking technologies set by third-party services that we have engaged. We use Google Analytics which employs cookies stored on your computer to facilitate an analysis of your use of the On Root Platform. Google's use of cookies and other tracking technologies is described further in its privacy policy.

Call and Text Information

We work with third-party partners to facilitate phone calls and text messages, including communications between you and your driver. We collect information about such communications, including the date and time of the call or SMS message, the parties' phone numbers, and the content of any SMS messages. This helps us provide and optimize our services and the On Root Platform.

User Feedback

We want to make sure you have a consistently positive experience with the On Root Platform, and we are always looking to improve our products and services. Accordingly, we collect and retain information about any ratings, reviews, and feedback you provide about our service, the On Root Platform, the products on our site, Retailers, and Delivery Service Providers.

Information Collected from Third Parties

Retailers and Delivery Service Providers

When you place an order through the On Root Platform, we may collect information about you from the Retailers or Delivery Service Providers based on your interactions with them. For instance, when your delivery driver reaches the delivery address you provided, they will check your government-issued ID and ask for your signature before completing the transaction. In certain jurisdictions, when required by local law or regulation, your delivery driver will also scan the barcode on the back of your government-issued ID to confirm that the information displayed on the ID is accurate. You may also communicate with your driver via text or phone call in order to complete the delivery. You should review the privacy policies of the Retailer or Delivery Service Provider to determine how they handle the information they collect from you.

Payment Processor

When you place an order through the On Root Platform, we may collect information about you from Aeropay. You should review the Aeropay Privacy Policy to determine how it handles the information it collects from you.

Advertisers

We may receive information about you from our advertisers, such as your interests and preferences to help us provide you with tailored advertisements.

Vendors

We may collect information about you directly from our vendor services or tools if your use of their services led to or related to your use of On Root. We may also collect information from you by using such vendor services or tools as necessary to comply with the law, process payment, and other legitimate business purposes. The information we collect from vendors will be treated in the same manner as the information we collect from you directly.

How We Use The Information We Collect

In addition to the uses described above, we also use the information we collect about you to:

• Provide the On Root Platform to you, including, but not limited to, connecting you with a Retailer and a Delivery Service Provider (or our drivers) to facilitate your legal access to cannabis and cannabis-related products, and facilitation of your transactions and payments;
• Support our Retailers with information necessary for them to maintain their records in accordance with their normal business practices and to comply with applicable law;
• Identify you as a User in our system;
• Comply with applicable local, state and federal laws and regulations;
• Analyze and assess current and potential user markets;
• Improve, optimize and create new products and services;
• Evaluate retailer, brand, and other third-party partnerships;
• Personalize your experience with On Root;
• Provide customer support and assist with your access or use of the On Root Platform;
• Communicate with you, either directly or through one of our partners, including for marketing and promotional purposes;
• Facilitate your communication with the Delivery Service Provider (or our driver) fulfilling your order;
• Engage in marketing activities with you and assess marketing and promotional initiatives;
• Detect, prevent, or mitigate fraud or any other suspicious activities;
• Conduct research and development, such as by conducting voluntary user surveys or obtaining other feedback from you;
• Create aggregated, de-identified and/or anonymized data;
• Support public health and safety efforts;
• Support ongoing efforts in cannabis legalization and social equity justice; and
• Conduct such other activities as otherwise described in this Privacy Policy, the On Root Terms or in any other notices we have or will provide to you.

How We Share Information

We may share your information as described below:

To Facilitate Delivery

We share information with our business partners, including Retailers and Delivery Service Providers, to facilitate deliveries. When you send an order to the Retailer through On Root, the Retailer receives information required to complete your order, such as your first name, delivery address, order details, birthdate, and a picture of your face taken from your government-issued ID. On Root connects you with a Delivery Service Provider (or our driver) who fulfills your order, and the driver receives this information to complete the delivery. When the driver arrives with your order, they will check your ID in person to verify your identity and to authorize the transaction in accordance with applicable law.

Anonymized, De-Identified and/or Aggregated Data

We share aggregated, de-identified, and/or anonymized information with third parties. Aggregated and anonymized means that user information is combined with all personally identifiable information removed so that any individual user cannot be identified. De-identified information means we have removed any identifiers that make a user identifiable, such as their name or address. We may also share anonymized, aggregated, and/or de-identified data with third parties for educational, marketing, consulting, or independent research purposes. This data provides valuable information, including how users interact with On Root, our partners, and available products, and also helps us drive the conversation on consumer habits, preferences, and behavior within the cannabis industry. When we share anonymized, de-identified, and/or aggregated data, we require the third party not to re-identify individuals and to have technical and business safeguards that prevent re-identification and inadvertent release of such information.

Vendor Tools and Services

We may share your information with service providers, business partners, consultants, tools, and services to facilitate On Root operations such as verification, compliance, marketing, communications, statistical analysis, hosting, database management, and a number of other functions. We share your information with these parties so they can perform their respective specific tasks on our behalf.

Government Authority, Law Enforcement, & Safety

We only disclose information about you to a government authority, law enforcement official, public health or safety official, or one of our partners if we believe we are required to by law or to respond to or comply with regulations or legal processes, including, but not limited to, responding to subpoenas or warrants. We may also share your information if we think doing so is necessary to protect On Root's rights, property, or safety, our partners and their employees, our users, the public, or others.

At Your Direction

There may be instances where you direct us to share personal information on your behalf, such as for medical records, for legal or administrative proceedings, or otherwise.

Acquisition or Merger of On Root

If all or a portion of On Root's assets, business, or stock are acquired by or merged with another party, your information may be transferred among those assets. An acquirer of On Root or its assets may continue to use your information as described in this Privacy Policy. We will notify you of any choices you may have regarding your information due to such acquisition or merger.

Onward Transfer

If we share your information as described in this Privacy Policy, we will seek assurances from the recipients of your information that they will safeguard your information in a manner consistent with this policy. Such assurances, where appropriate, may include contractual relationships with confidentiality clauses and non-disclosure agreements that provide the same level of commitment to safeguarding your information as provided in this Privacy Policy.

Your Choices

We provide you with the choices below regarding your personal information:

Email Subscriptions

You can always unsubscribe from On Root promotional emails by clicking the link provided at the bottom of the email. We will still send you transactional emails and receipts generated from your use of On Root as these are not promotional communications.

Text Messages

You can opt out of receiving promotional text messages by texting the word STOP from the mobile device receiving the messages to the phone number you received the message from. Promotional texts are SMS messages sent to you containing offers, promo codes, or deal reminders. Standard messaging rates from your cell phone carrier will apply.

Push Notifications

If you are using the On Root mobile application(s), you can opt out of receiving promotional push notifications through your device settings. Please note that opting out of receiving transactional push notifications, such as receiving a notification that your order has arrived, may impact your use of On Root.

Location Information

You can prevent your device from sharing geolocation information at any time through your device settings. Please note that the use of geolocation information may be necessary to access some of our services.

Editing Account Information

You can review and edit certain account information at any time by logging into your account and navigating to your "Account Settings."

Deleting Your Account

We will store your information as long as your account is open. If you wish to terminate, delete, suspend, or otherwise disable your Account or use of the On Root Platform, please go to your Account Settings and click on "Delete My Account." When we delete user accounts, we must maintain certain information as long as necessary to comply with legal obligations, to prevent fraudulent activity, to enforce agreements, or as otherwise deemed necessary at our discretion to support business efforts. Upon your request for deletion, the information that can be deleted will be removed from your Account in a reasonable amount of time or as otherwise required by applicable law.

Reminders

Changes to the Policy

We may update this Privacy Policy periodically. If we make any material changes, we will update you on the On Root Platform, by email, or by other communication. We encourage you to stay up to date about our privacy practices by reviewing this Privacy Policy periodically. Continued use of On Root following notices of changes to the Privacy Policy indicates your acknowledgment of such changes and agreement to be bound by the terms and conditions of such changes.

In addition, we may provide you with "just-in-time" disclosures or additional information about the data collection, use and sharing practices of specific parts of the On Root Platform. These notices may provide more information about our privacy practices, or provide you with additional choices about how we process your personal information.

Age Restrictions

On Root is intended for access and use by individuals who are of legal age for the services offered based on the applicable regulations of their state or other government entities ("Qualifying Age"). We do not knowingly collect personal information from or about anyone who is not of Qualifying Age. If you are not of Qualifying Age, you should not attempt to access or use On Root, or send any information to us. If we discover that we have collected personal information from an individual who is not of Qualifying Age, we will take steps to remove that information.

Account Activity

You are responsible for maintaining the secrecy of your unique password and account information, and for controlling access to emails or physical mail between you and On Root at all times. When you direct On Root to share your information with third parties, please note that your privacy and security may also be affected by changes in such third party services. We are not responsible for the functionality, privacy, or security measures of any such other organization or third party.

Contact Us

If you have questions or comments about this Privacy Policy, your information, our use and sharing practices, or your choices, please contact us at support@onrootnow.com.