Privacy Policy

Last updated: September 29, 2026

This Privacy Policy explains how The Vape Loft Denver, LLC (“The Vape Loft,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you visit thevapeloft.com, contact us, create or use a customer account, place an order, or interact with our store.

1. Information we collect

Depending on how you interact with us, we may collect:

• Contact and identity information, such as your name, email address, phone number, billing address, shipping or delivery address, and account details.

• Order and transaction information, such as products ordered, order history, prices, discounts, taxes, payment status, shipping, pickup or delivery selection, fulfillment status, returns, and customer-service communications.

• In-person age and identity verification: staff visually inspect a government-issued photo ID at age-restricted pickup or delivery and record only whether the check passed or failed. We do not photograph, scan, or retain an ID copy, ID number, or date of birth from this inspection. Ordinary order information, such as your name and delivery address, is retained separately as described in this Policy.

For orders placed using Local Delivery, we separately collect the purchaser’s full date of birth at checkout for age-related order review and compliance recordkeeping. This purchaser-supplied date is stored with the order and may appear in staff order notifications or be accessed by authorized service providers supporting the order. It is not included in customer emails or invoices and is not used for birthday marketing. This is separate from the in-person ID inspection described above; that inspection still records only pass/fail and does not retain an ID image or ID number.

• Payment-related information. Payment information is submitted to third-party payment providers. We receive transaction details needed to process and support the order, such as payment status and a transaction reference.

• Device and usage information, such as IP address, browser and device type, time zone, pages viewed, referring pages, cookies, and similar technology data.

• Information you provide, including messages, reviews, feedback, and information submitted through a contact or privacy-request form.

2. How we use information

We may use personal information to:

• provide, process, verify, and fulfill orders;

• create and manage customer accounts;

• verify age, identity, address, payment, and fulfillment eligibility where required;

• communicate about orders, pickup, shipping, local delivery, returns, account access, and customer support;

• prevent fraud, misuse, and security incidents;

• maintain, analyze, and improve the website and store operations;

• maintain business, tax, transaction, age-verification, delivery, and compliance records; and

• comply with applicable laws, lawful requests, and regulatory obligations.

3. How we disclose information

We may disclose personal information as reasonably necessary to:

• ecommerce and website service providers, including Ecwid, for the storefront, customer accounts, and order records;

• payment processors and financial institutions, including Authorize.Net for hosted card payment processing;

• authorized staff who perform the in-person ID check and handle its pass/fail record;

• shipping carriers, pickup personnel, and local-delivery and dispatch providers, including Shipday, who receive the order, recipient contact, address, and delivery-instruction information needed for fulfillment. Uber receives delivery information for snack deliveries only; it is not used to deliver nicotine orders;

• analytics, security, customer-support, email, and technology providers;

• professional advisers, insurers, auditors, and tax providers;

• regulators, law enforcement, courts, or other parties when required or permitted by law; and

• a buyer, successor, or adviser in connection with a proposed or completed business transaction.

These recipients may process information under their own terms and privacy policies or on our behalf under applicable contractual restrictions.

4. Cookies and similar technologies

We and our service providers may use cookies and similar technologies to operate the site, remember preferences, maintain sessions, measure performance, prevent fraud, and understand how visitors use the store. Browser settings may block or delete some cookies, but doing so may prevent parts of the store from working correctly. Contact us using the privacy-request details below for questions or requests concerning tracking. Browser cookie settings alone may not stop every form of data collection.

5. Advertising, sale, and sharing

We do not sell personal information for money. Some disclosures involving advertising cookies or cross-context behavioral advertising may be considered a “sale” or “sharing” under certain U.S. state privacy laws even when no money is exchanged. To ask about these activities or exercise an applicable opt-out right, email vapeloftdenver@gmail.com with the subject “Privacy Request.”

6. Data retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including order fulfillment, customer support, fraud prevention, dispute resolution, tax and accounting obligations, regulated-product recordkeeping, and enforcement of our agreements. Retention periods vary by data type and legal obligation. This includes the pass/fail verification result associated with an order; it does not mean we keep a copy of the inspected ID. We consider the purpose, applicable minimum recordkeeping periods, unresolved disputes, and security needs when deciding when to delete or de-identify records. We may retain a request record after responding to it when permitted or required by law.

7. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No transmission or storage system can be guaranteed completely secure. Our storefront and hosted checkout pages use HTTPS. Card details entered on the Authorize.Net hosted form are handled by the payment provider; we receive payment status and transaction information needed to support your order. Do not send full payment-card details or copies of identification documents by ordinary email or text messages. Contact us first if you need help with verification.

8. Your privacy choices and rights

You may unsubscribe from optional marketing messages using the instructions in the message. Transactional and account messages may still be sent when needed to provide the service.

Depending on where you live and subject to applicable exceptions, you may have rights to request access to, correction of, or deletion of personal information, to receive a portable copy, or to opt out of certain targeted advertising, sale, sharing, or profiling activities. We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by law and may be asked to provide proof of authority.

To make a privacy request, email vapeloftdenver@gmail.com with the subject line “Privacy Request” or use the privacy-request method provided on the website. We will respond within the time required by applicable law and explain any denial where required. If we decline your request, you may ask us to review that decision by emailing the same address with the subject “Privacy Appeal.” You may also contact your state privacy regulator or attorney general where applicable. We will not discriminate against you for exercising a right provided by applicable law.

9. Children and age-restricted services

The website and age-restricted products are intended only for people who are at least 21 years old. We do not knowingly collect personal information from anyone under 21 for the purpose of selling age-restricted products. If you believe a person under 21 has provided personal information, contact us so we can review the request and take appropriate action.

10. Other websites and services

The website may link to third-party websites or services. Their privacy practices are governed by their own policies, and we are not responsible for unaffiliated services.

11. Changes to this Policy

We may update this Privacy Policy to reflect changes in our services, practices, or legal obligations. The revised version will be posted with an updated date. We will provide additional notice or obtain consent when required by law.

12. Contact us

The Vape Loft Denver, LLC

2738 S Broadway

Englewood, CO 80113

vapeloftdenver@gmail.com

(720) 360-6265