Privacy Policy

On Deck Delivery – ondeckdelivery.com
Last updated: October 11, 2026

1. Overview

This Privacy Policy explains how On Deck Delivery LLC, doing business as On Deck Delivery (“On Deck Delivery,” “On Deck,” “we,” or “us”) collects, uses, shares, and protects information about you when you use ondeckdelivery.com and any related online services (the “Services”).

This policy is especially focused on California users, since we operate a cannabis delivery business based in La Habra, California and are subject to California privacy laws like the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

By using the Services, you agree to the practices described here.

2. What this policy covers

This policy applies to:

• Visitors to our website and menu pages.
• People who create an account or place orders.
• People who sign up for SMS or email marketing, loyalty programs, or promotions.
• People who contact us using forms, SMS, or other digital channels we control.

It does not apply to websites, platforms, or services we do not control, even if we link to them.

3. Notice at collection and categories of information

California law requires us to tell you, at or before the time we collect personal information, what categories of information we collect and why we use them.

Here are the main categories of personal information we collect and examples of what is in each category:

• Identifiers: name, alias, phone number, email address, delivery address, account username, IP address, and device identifiers.
• Customer records information: date of birth, age, a full photo of your government-issued ID (which shows your name, photo, date of birth, ID number, address, and the other details printed on the card), and, for medicinal customers, a photo of your medical marijuana identification card or physician’s recommendation.
• Commercial information: order history, products viewed, products added to cart, delivery notes, payment type (for example, cash or debit), loyalty points, discounts used, and refund or complaint history.
• Internet / network activity: pages you visit, links you click, time spent on pages, browser type, device type, and general location based on IP.
• Geolocation data: approximate location inferred from your IP address or delivery address.
• Audio or electronic information: records of communications with us, such as emails or messages, and limited call notes if you contact customer support.
• Inferences: categories or segments we create about you based on your purchase history or engagement with promotions (for example, “prefers vape products” or “high-frequency buyer”).

Some of this information, such as ID data and certain health-related notes for medical patients, may be considered “sensitive personal information” under California law.

ID and medical card photos. California law requires us to verify the age and identity of every cannabis customer. At checkout we ask you to upload a photo of your government-issued ID and, if you are ordering as a medicinal customer, your medical card or recommendation. These images are stored in a private, access-controlled Cloudflare R2 storage bucket. They are never publicly accessible and can only be viewed through our own sign-in-protected systems.

Each image is reviewed by our staff. Our customer system also runs an automated verification check that sends the image to an AI image-analysis service (OpenAI) to read the date of birth and expiration date and flag images that do not appear to be a valid ID. The automated check assists our staff; it does not replace them, and your driver checks your physical ID again at the door.

We keep ID and medical card images until one year after the ID or medical card expires, and then delete them. If you upload a newer ID, we keep the newer one on the same basis. Order, sales and delivery records are kept for seven years, as California cannabis regulations require for licensed businesses’ records.

We collect this information to operate our business, deliver your orders, meet legal and licensing requirements, keep the Services secure, and run marketing and loyalty programs.

4. How we collect information

We collect information in three main ways.

You provide information directly when you:

• Create an account.
• Place an order.
• Enter a delivery address.
• Upload or show ID or medical documentation when required.
• Join SMS or email marketing or loyalty programs.
• Contact us through the Contact page, forms, SMS, or other channels.
• Respond to surveys or promotions.

When you use the Services, we and our partners automatically collect some information using cookies, pixels, and similar technologies. This includes:

• IP address, browser type, device type, and operating system.
• Pages you view, links you click, and time spent on the site.
• General location information based on IP.
• Device identifiers and session IDs.

If you accept analytics cookies, we use Google Analytics to understand traffic, usage patterns, and performance, and to improve the site. Google Analytics does not load until you choose “Accept” in our cookie banner. See Section 6 for details.

We receive information about you from:

• Our point-of-sale and ecommerce platform (Meadow), which handles our menu, inventory, and orders.
• Our email and SMS service providers, which help us send order confirmations and marketing communications.
• Payment processors, which send us payment status information (we do not receive full card numbers).
• Our automated ID verification check when we verify age or eligibility.
• Our delivery dispatch platform (Onfleet), which provides delivery status, driver location while your order is out for delivery, and proof-of-delivery details.
• Marketing and referral partners that tell us which campaigns or links brought you to us.

We combine this information with what we collect directly to keep our records accurate and to offer relevant products and deals.

5. How we use information

We use the information we collect for these purposes:

• Processing orders and coordinating delivery.
• Verifying age and identity where required.
• Running your account, including login, preferences, and order history.
• Providing customer support and handling issues, complaints, and questions.
• Managing loyalty points, credits, and promotions.
• Meeting California cannabis regulations, including age verification, record-keeping, and reporting obligations.
• Handling tax and accounting requirements.
• Responding to law enforcement and regulatory requests where legally required.

Using our ecommerce and CRM systems, we:

• Track your product preferences and purchase history.
• Recommend products, categories, and deals that match your interests.
• Build segments for marketing and loyalty (for example, heavy edible buyers, frequent vape buyers).
• Adjust messaging and offers so they are more relevant.

If you opt in, or where allowed by law, we use your info to:

• Send marketing SMS and emails about deals, new products, events, and loyalty offers.
• Run referral programs and limited-time promotions.
• Use SMS and email platforms that comply with TCPA and CTIA rules, including clear consent, opt-out instructions, and rate disclosures.

You can opt out of marketing at any time as described in Section 11.

We use information to:

• Analyze how people use the Services, which pages perform well, and where users drop off.
• Measure the success of marketing campaigns, loyalty programs, and promotions.
• Test new features and improve site speed, usability, and reliability.
• Monitor for fraud, abuse, and security threats.

6. Cookies and tracking technologies

We use cookies and similar browser storage to run the site and, only if you allow it, to measure how the site is used. On your first visit, a cookie banner lets you “Accept” or decline analytics cookies. You can change your choice at any time on our Your Privacy Choices page.

Strictly necessary (always on):

• Age confirmation cookie (age_verified): remembers that you confirmed you are old enough to view the site.
• Cart cookie (ondeck_cart_id): keeps track of your cart for up to 7 days.
• Sign-in cookies (ondeck_customer, ondeck_crm_session): keep you signed in and protect your account and checkout.
• Consent cookie: remembers whether you accepted or declined analytics cookies so we do not ask on every visit.
• Chat and preference storage (browser localStorage): our support chat saves a conversation ID so you can pick up where you left off, and we remember if you dismissed the notification prompt. This data stays in your browser.

Analytics (only after you choose “Accept”):

• Google Analytics 4 (_ga and _ga_* cookies): measures visits, pages viewed, and shopping events such as adding to cart and completing a purchase. These cookies can last up to 2 years. Google Analytics does not load unless you accept analytics cookies.
• Sentry session replay: we use Sentry to catch site errors. Only if you accept analytics, Sentry may also record a small sample of sessions (a replay of page interactions) to help us fix bugs.

Global Privacy Control: if your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information and do not load analytics for that browser.

Most browsers also let you block or delete cookies in their settings. If you block the strictly necessary cookies, the age check, cart, sign-in, and checkout will not work.

7. How we share information

We do not sell your personal information for money. However, if you accept analytics cookies, our use of Google Analytics may be treated as a “sale” or “sharing” under California privacy law because it involves sharing identifiers and usage data with a third party. You can opt out at any time (see Section 11).

We share personal information in these ways:

We share information with third-party companies that help us run the business, including:

• Meadow – point of sale, menu, inventory, and order processing.
• Our customer system (crm.ondeckdelivery.com) – customer accounts, ID review, loyalty, support chat, and messaging. We operate this system ourselves.
• OpenAI – automated image check of uploaded IDs and medical cards (see Section 3).
• Onfleet – delivery dispatch, routing, and driver tracking.
• Cloudflare – content delivery, security, and private storage of ID images (Cloudflare R2).
• Google – Google Maps and Places for address autocomplete and maps, and Google Analytics 4 (only if you accept analytics cookies).
• Sentry – error monitoring (session replay only with your consent).
• Plunk and Amazon Simple Email Service (SES) – order, sign-in, and marketing emails.
• Telnyx – text messages (order updates, sign-in codes, and marketing texts you opt into).
• Web push services – browser notifications about your order, only if you turn them on, delivered through your browser maker’s push service.
• Payment processors that handle payments and refunds.
• Hosting providers that run our servers in the United States.

These companies can only use your information to provide services to us and must protect it.

When we run joint promotions or loyalty benefits with brands or partners, we may share limited information needed to run that program. For example, we might share that you are eligible for a certain offer or redeemed a reward.

We may share information if we believe it is reasonably necessary to:

• Comply with a law, regulation, legal process, or government request.
• Protect the rights, property, or safety of On Deck Delivery, our customers, or others.
• Detect, prevent, or address fraud, security, or technical issues.
• Enforce our Terms of Service or other agreements.

If we are involved in a merger, acquisition, reorganization, or sale of some or all of our assets, your information may be transferred as part of that transaction as allowed by law.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

8. How long we keep information

We keep personal information only as long as reasonably needed to:

• Provide the Services and deliver your orders.
• Maintain business and accounting records.
• Meet cannabis licensing, tax, and other legal requirements.
• Resolve disputes and enforce our rights.

Images of your government ID or medical card are kept until one year after the ID or card expires, and then deleted.

We may keep some information in backups or archives for a period after it is no longer actively used, as allowed or required by law.

When information is no longer needed, we will delete it or de-identify it, where feasible.

9. Security

We use reasonable physical, technical, and administrative measures to protect personal information from unauthorized access, loss, or misuse. These can include encryption, access controls, and staff training.

No system is perfectly secure. We cannot guarantee absolute security of your information, but we do work to reduce risk and respond to incidents if they occur.

10. Children and minors

The Services are intended only for:

• Adults 21 and older for adult-use cannabis.
• Adults 18 and older with required medical documentation where medical cannabis is allowed.

We do not knowingly collect personal information from anyone who does not meet these age limits. If we learn that we have collected information from someone who is not eligible, we will delete it and may close the related account.

Do not provide personal information about anyone under 16.

11. Your choices and privacy rights

If you have an account, you may be able to:

• Review and update certain account information.
• Change some communication preferences.
• To stop marketing texts, reply STOP to any message. For help, reply HELP or contact us through the Contact page.
• To stop marketing emails, click “unsubscribe” at the bottom of any marketing email.

We may still send non-marketing messages about orders, your account, or important updates to our policies.

You can accept or decline analytics cookies in our cookie banner or on the Your Privacy Choices page, and you can set your browser to refuse cookies or alert you when cookies are used.

Blocking or deleting cookies may affect how the Services work.

If you are a California resident, you have rights under CCPA/CPRA, subject to certain limits.

These rights include:

• Right to know: You can request that we tell you what categories of personal information we collect, use, disclose, sell, or share, and the sources and purposes.
• Right to access: You can request a copy of personal information we hold about you.
• Right to delete: You can ask us to delete personal information we collected from you, subject to legal and operational exceptions (for example, we may need to keep certain records for licensing or tax reasons).
• Right to correct: You can ask us to correct inaccurate personal information.
• Right to opt out of sale or sharing: You can ask us not to “sell” or “share” your personal information for cross-context behavioral advertising, to the extent our use of analytics or ads is considered a sale or sharing.
• Right to limit use of sensitive personal information: You can request that we limit how we use and disclose certain sensitive personal information, except where we must use it for core services or legal reasons.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your California privacy rights, contact us by either method:

• Email privacy@ondeckdelivery.com.
• Call (562) 670-5987.

In your request:

• Tell us which privacy rights you want to exercise (for example, “access,” “delete,” or “opt out of sale/sharing”).
• Give us enough information to identify you and verify that you are the account holder or consumer.

We may ask for additional information to verify your identity before completing your request. You can also appoint an authorized agent to make requests on your behalf, subject to verification and documentation.

We aim to respond to privacy requests within the time periods required by California law.

Opting out of sale or sharing: use the “Your Privacy Choices” link in the footer of every page, which goes to ondeckdelivery.com/your-privacy-choices. We also honor Global Privacy Control (GPC) browser signals as an opt-out of sale and sharing.

OnDeck Rewards: notice of financial incentive

Summary. OnDeck Rewards gives you points on your purchases that you can spend on discounted products. You earn 1 point for every $1 spent on a delivered order, as reported by our point of sale, plus a 100-point welcome bonus with your first delivered order. Points can be spent on one reward item per order (for example, a qualifying 1g pre-roll for $1 at 150 points). Points do not expire.

Personal information involved. To run the program we use your name, email address, phone number, account ID, order history (items, amounts and dates) and points balance. We use this information to award and redeem points and, if you have agreed to marketing messages, to tell you about rewards you can use.

How to join. You join by creating an On Deck account and placing a delivered order. Joining is optional; you can order without an account.

How to leave. You can leave the program at any time by emailing [email protected] or calling (562) 670-5987. When you leave, you stop earning points and any unused points are cancelled. Leaving does not affect your ability to order from us.

Value of your data and how we calculated it. We estimate in good faith that the personal information used in the program is worth about the same as the benefits the program gives you: up to about 10 cents for every $1 you spend on delivered orders. We calculated this from the program’s own terms, by comparing the most a reward can save you (the menu price of the reward item, up to its cap, minus the $1 you pay) with the spending needed to earn it. The discount the program offers is reasonably related to that value.

12. International use

Our Services are intended for use in California, in areas where we are allowed to deliver cannabis. If you access the Services from outside California, you do so at your own risk and are responsible for following local laws.

Your information will be processed in the United States and may be subject to U.S. laws.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

When we update it:

• We will change the “Last updated” date at the top of this page.
• We may provide additional notice on the site if the changes are significant.

If you continue to use the Services after we post an updated Privacy Policy, you accept the new version.

14. SMS Terms & Conditions

On Deck Delivery offers SMS messaging for order updates and optional marketing communications. Text messages are sent through our SMS provider, Telnyx.

Programs and message types:

• Order Updates (transactional): Order confirmations, delivery status, driver notifications, and account verification codes. These are sent automatically when you place an order or sign in.
• Marketing Messages (opt-in only): Recurring automated promotional texts, such as deals, new product announcements, early access, and loyalty rewards. You must actively opt in by checking a box to receive these.

Message frequency: Order update messages are sent as needed based on your orders. Marketing message frequency varies.

Message and data rates: Standard message and data rates from your carrier may apply.

How to opt out:

• Reply STOP to any message to opt out of that message type.
• Reply HELP for help.
• Call (562) 670-5987 or email orders@ondeckdelivery.com.

Consent: By providing your phone number at checkout, you consent to receive transactional SMS messages related to your orders. Marketing texts require a separate opt-in by checking a box at checkout or in your account; by opting in, you agree to receive recurring automated marketing text messages at the number you provide. Consent is not a condition of purchase.

No sharing of mobile information: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except for the vendors that help us send messages.

Carriers: Major US carriers are supported. Carriers are not responsible for delayed or undelivered messages.

Privacy: Your phone number and SMS consent records are stored securely. We do not sell your phone number. See the full privacy policy above for details on how we handle your information.

Contact: On Deck Delivery LLC, 1000 South Leslie Street, La Habra, CA 90631. Phone: (562) 670-5987. Email: orders@ondeckdelivery.com

15. Contact

If you have questions or want to make a privacy-related request, contact On Deck Delivery LLC:

• Email: privacy@ondeckdelivery.com
• Phone: (562) 670-5987
• Mail: 1000 South Leslie Street, La Habra, CA 90631