This Privacy Policy explains how VapeO2 LLC (“VapeO2,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit vapeo2.com (the “Site”), shop in our retail stores, use our delivery service, or otherwise interact with us (collectively, the “Services”).
By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.
1. Age restriction — 21+ only
The Services are intended only for adults 21 years of age or older. We do not sell age-restricted products (including vapor/ENDS products, hemp-derived cannabinoid products such as THCa and CBD, kratom, and related products) to anyone under 21, and we do not knowingly collect personal information from anyone under 21.
We verify age at checkout and again at the point of delivery or in-store pickup. As required by federal and state law governing the sale of vapor and tobacco products (including the PACT Act), we collect and retain age- and identity-verification information for these transactions. See Section 9 (Data Retention).
If you are under 21, do not use the Services or attempt to purchase any product. If we learn that we have collected information from a person under 21 — including any child under 13 protected by the Children’s Online Privacy Protection Act (COPPA) — we will delete it. If you believe a minor has provided us with personal information, contact us at [email protected].
2. Information we collect
We collect the following categories of personal information:
Information you provide directly
Identifiers — name, billing and delivery address, email address, phone number, and account login credentials.
Age and identity verification — date of birth, and government-issued ID information used to confirm you are 21 or older. Depending on the transaction, this may include the ID number, photo of the ID, and/or a verification result returned by our age-verification provider.
Order and commercial information — products purchased or considered, order history, delivery details, store-credit (“VapeO2 Coins”) and loyalty balances, and customer-service communications.
Payment information — payment card or other payment details. Card data is collected and processed by our payment processor; we do not store full card numbers on our systems. See Section 7.
Communications — messages, reviews, survey responses, and any other content you send us.
Information collected automatically
Device and usage data — IP address, browser type, device identifiers, operating system, referring pages, pages viewed, links clicked, and timestamps.
Cookies and similar technologies — see Section 6.
Approximate or precise location — including delivery location and, where you enable it, device location used to support our same-day delivery service.
Information from third parties
Our age-verification provider, payment processor, delivery/logistics provider, and analytics and advertising partners may provide us with information such as verification results, transaction confirmations, fraud signals, and aggregated usage data.
We do not intentionally collect special categories of data beyond what is necessary to verify age and complete a purchase of the products we sell.
3. How we use your information
We use personal information to:
verify that you are 21 or older and comply with vapor/tobacco and other age-restriction laws;
process, fulfill, and deliver your orders, including same-day delivery;
create and manage your account and store-credit/loyalty balances;
process payments and prevent fraud;
provide customer support and respond to your requests;
send marketing communications by email or text where permitted and where you have consented, and let you opt out at any time (Sections 13–14);
operate, maintain, secure, and improve the Site and Services;
understand how customers use the Services through analytics;
comply with legal obligations, including recordkeeping and reporting required by the PACT Act and applicable tax and tobacco laws; and
enforce our terms and protect our rights, customers, and business.
4. Legal bases / purposes
We process personal information to perform our contract with you (fulfilling orders), to comply with legal obligations (age verification, tax and PACT Act recordkeeping), with your consent (marketing texts and emails, certain cookies), and for our legitimate business interests (security, fraud prevention, analytics, and improving the Services), consistent with applicable law.
5. Data management and protection
We use the information described above only for the purposes for which it was collected or for compatible purposes. We will not use age-verification data for advertising, and we will not sell it. We restrict access to identity-verification records to personnel and providers who need it to verify age, prevent fraud, or meet legal requirements.
6. Cookies and tracking technologies
We and our partners use cookies, pixels, tags, and similar technologies to operate the Site, remember your preferences, measure performance, and—where applicable—support advertising.
We use:
Strictly necessary cookies — required for the Site, cart, checkout, login, and security.
Analytics cookies — to understand traffic and usage (Google Analytics).
You can control cookies through your browser settings and, where offered, our cookie banner control. Disabling some cookies may affect Site functionality. We honor browser-based opt-out signals (including the Global Privacy Control) where required by law — see Section 11.
Product reviews, comments, and embedded content. If you post a product review or comment, the content and your display name are published publicly, and we collect your IP address and browser user-agent string to help detect spam. Reviews and comments may be screened by an automated spam-detection service. If you use the email address associated with the Gravatar service, an anonymized hash of that email may be sent to Gravatar to display your profile picture next to your review; see Automattic’s privacy policy at https://automattic.com/privacy/. Pages may also include embedded content from other sites (such as videos); that content behaves as if you visited the other site directly and may set its own cookies and tracking.
7. How we share and disclose information
We share personal information only as described below. We do not sell your personal information for money.
Service providers / processors. We share information with vendors that perform services for us under contract, including:
Website hosting and infrastructure (our hosting and CDN/security providers);
Age and identity verification (our verification provider);
Order fulfillment and delivery (our delivery and logistics provider);
Email and SMS messaging platforms;
Analytics providers; and
Customer support and fraud-prevention tools.
These providers are permitted to use the information only to provide services to us.
Advertising partners. We do not share personal information for cross-context behavioral or targeted advertising.
Legal and safety. We may disclose information to comply with the law, respond to lawful requests and legal process (including PACT Act and tax reporting to state authorities), enforce our terms, prevent fraud, or protect the rights, safety, and property of VapeO2, our customers, or others.
Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.
We do not disclose age- or identity-verification documents except to our verification provider, to prevent fraud, or as required by law.
8. Analytics, advertising, and your choices
We use analytics to understand how the Services are used.
You can limit advertising-related tracking by:
using our cookie controls
enabling the Global Privacy Control (GPC) in a supported browser, which we treat as a valid opt-out of sale/sharing for advertising where required;
adjusting your device and browser settings; and
using industry opt-out tools such as the Digital Advertising Alliance (optout.aboutads.info) and Network Advertising Initiative (optout.networkadvertising.org).
9. Data retention
We keep personal information only as long as needed for the purposes described in this Policy, after which we delete or de-identify it. Retention periods depend on the type of data and our legal obligations.
In particular, federal and state laws governing the sale of vapor/ENDS and tobacco products—including the PACT Act—require us to verify age and to retain transaction and age-verification records, and to report certain sales information to state tax administrators. We retain those records for as long as required by applicable law. We also retain order, payment, and tax records as required for accounting, warranty, dispute, and legal-compliance purposes.
10. Data security
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and use of PCI-compliant payment processing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we experience a data breach affecting your personal information, we will notify you and the appropriate authorities as required by applicable breach-notification laws.
11. Your privacy rights
Depending on where you live, you may have some or all of the following rights regarding your personal information:
Right to know / access — the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we disclose it to.
Right to delete — request deletion of personal information we hold, subject to legal exceptions (for example, records we must keep under the PACT Act or tax law).
Right to correct — request correction of inaccurate personal information.
Right to data portability — obtain a copy of certain information in a portable format.
Right to opt out of “sale” or “sharing” — opt out of the sale of personal information (we do not sell for money) and of sharing/processing for targeted (cross-context behavioral) advertising.
Right to opt out of certain profiling — where applicable under your state’s law.
Right to non-discrimination — we will not deny you services, charge a different price, or provide a different quality of service for exercising your rights.
How to exercise your rights. Submit a request by emailing [email protected]or calling (215) 278-2891. We will verify your identity before responding, typically by confirming information associated with your account or order. For account holders, we may use our website platform’s built-in personal-data export and erasure tools to help fulfill access and deletion requests. We will respond within the timeframe required by applicable law (generally 45 days, extendable where permitted).
Authorized agents. You may use an authorized agent to submit a request on your behalf where permitted by law; we may require proof of authorization and verification of your identity.
Appeals. If we deny your request and your state grants a right to appeal, you may appeal by contacting us at [email protected]with the subject line “Privacy Appeal.” If we deny your appeal, your state’s attorney general may provide a mechanism to submit a complaint.
Opt-out signals. We recognize the Global Privacy Control (GPC) as a valid opt-out of sale/sharing where required by law.
12. Notice for California residents
This section provides additional detail for California residents under the California Consumer Privacy Act, as amended (CCPA/CPRA), to the extent it applies to us.
Categories of personal information we collect: identifiers; customer records (name, contact, payment information); commercial information (purchases); internet/network activity; geolocation; and age/identity-verification information. See Section 2 for detail.
Sources, purposes, and disclosures: described in Sections 2, 3, and 7.
Sensitive personal information: to the extent any data we collect (such as government-ID information used solely for age verification) is treated as “sensitive,” we use it only for the permitted purpose of verifying age and completing your transaction, and not to infer characteristics about you.
“Sale” / “sharing”: We do not sell personal information for money.
Your rights: the rights to know, delete, correct, opt out, and non-discrimination, as described in Section 11.
To exercise California rights, use the contact methods in Section 11.
Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) may exercise the equivalent rights available under their state’s law using the same methods.
13. Text message (SMS) program
If you opt in to receive text messages from VapeO2, you consent to receive recurring automated marketing and/or transactional texts at the number you provide. Consent is not a condition of any purchase. Message and data rates may apply. Message frequency varies.
Reply STOP to unsubscribe at any time.
Reply HELP for help, or contact us at [email protected] / (215) 278-2891.
Carriers are not liable for delayed or undelivered messages.
We obtain your express consent before sending marketing texts, as required by the Telephone Consumer Protection Act (TCPA) and applicable state law. We do not share mobile opt-in data or consent with third parties for their own marketing.
14. Email marketing
We send marketing emails only where permitted. Every marketing email includes an unsubscribe link, and we honor opt-out requests promptly, consistent with the CAN-SPAM Act. You will continue to receive transactional emails (such as order and delivery confirmations) even if you opt out of marketing.
15. Third-party links and services
The Site may contain links to third-party websites and services (for example, payment pages or social media). We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing information.
16. Out-of-state and international users
We operate in the United States, and the Services are intended for U.S. residents who are 21 or older. Delivery services are limited only to the area within 10 miles from VapeO2 Fishtown store (411 E Girard Ave, Philadelphia, PA 19125). If you access the Services from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your location.
17. Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice as required by law. Your continued use of the Services after an update means you accept the revised Policy.
18. Contact us
VapeO2 LLC Attn: Privacy 411 E Girard Ave, Philadelphia, PA 19125 Email: [email protected]Phone: (215) 278-2891.
If you have questions about this Policy or how we handle your information, contact us using the details above.
