Privacy Policy

1. INTRODUCTION

THE VAULT, operated by Oasis Cannabis Co., a New Mexico limited liability company, including its parents, subsidiaries, and affiliates (collectively, "Oasis," "Company," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you access or use our website, mobile application, and related services (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree to this Privacy Policy, you must immediately cease all use of the Services.

This Privacy Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined in this Privacy Policy have the meanings given to them in our Terms of Service.

2. INFORMATION WE COLLECT

We collect information in several ways: directly from you, automatically when you use our Services, and from third-party sources.

2.1 Information You Provide to Us

Account Registration Information

When you create an account, we collect:

• Full name
• Email address
• Phone number
• Date of birth
• Password or authentication credentials
• Preferred Oasis Cannabis dispensary location

Verification Information

To verify your age and identity, we may collect:

• Date of birth
• Government-issued identification information
• Photographs of identification documents

Transaction Information

When you participate in Drops or redeem Claim Passes, we collect:

• Offer history and amounts
• Drop participation history
• Claim Pass redemption records
• Preferred pickup locations
• Transaction timestamps

Communications

When you contact us or communicate through the Services, we collect:

• Email correspondence
• SMS message history
• Customer support inquiries and responses
• Feedback and survey responses

Referral Information

When you participate in our referral program, we collect:

• Referral codes used and generated
• Information about referred users (with their consent)

Consent Records

When you provide consent for communications, we collect:

• SMS consent status and timestamp
• IP address at time of consent
• Browser and device information at time of consent
• Version of consent language agreed to

2.2 Information Collected Automatically

When you access or use the Services, we automatically collect certain information, including:

Device and Browser Information

• IP address
• Device type, model, and manufacturer
• Operating system and version
• Browser type and version
• Unique device identifiers
• Mobile advertising identifiers

Usage Information

• Pages and features accessed
• Time spent on pages
• Click patterns and navigation paths
• Search queries within the Services
• Referring and exit pages
• Date and time of access

Location Information

• Approximate location based on IP address
• Precise geolocation (only with your explicit consent)
• Preferred store location selections

Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to collect information. See Section 7 (Cookies and Tracking Technologies) for more details.

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

Service Providers

• Identity verification services
• Fraud prevention services
• Analytics providers

Social Media Platforms

If you interact with us on social media, we may receive information from those platforms in accordance with their privacy policies.

Publicly Available Sources

We may collect information from publicly available sources to verify information you provide or to supplement our records.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

3.1 Providing and Improving the Services

• Creating and managing your account
• Processing your participation in Drops
• Generating and delivering Claim Passes
• Facilitating product pickup at dispensary locations
• Processing credits and referral rewards
• Providing customer support
• Responding to your inquiries and requests
• Improving and optimizing the Services
• Developing new features and functionality

3.2 Communications

• Sending transactional messages (account verification, Claim Pass delivery, offer updates)
• Sending promotional messages and marketing communications (with your consent)
• Sending Drop alerts and notifications
• Sending outbid alerts and reminders
• Providing important service announcements
• Responding to your communications

3.3 Verification and Security

• Verifying your age (21+)
• Verifying your identity
• Detecting, investigating, and preventing fraud and abuse
• Protecting the security and integrity of the Services
• Enforcing our Terms of Service
• Managing the trust tier and abuse prevention system

3.4 Legal and Compliance

• Complying with applicable laws, regulations, and legal processes
• Responding to lawful requests from law enforcement and government agencies
• Protecting our legal rights and interests
• Resolving disputes

3.5 Analytics and Research

• Analyzing usage patterns and trends
• Measuring the effectiveness of the Services
• Conducting research and analysis to improve user experience
• Generating aggregated and anonymized statistics

3.6 Business Operations

• Administering contests, promotions, and referral programs
• Managing our business relationships
• Conducting audits and internal investigations
• Planning and executing business strategies

4. SMS AND TEXT MESSAGING

4.1 SMS Communications

By providing your phone number and opting in to SMS communications, you expressly consent to receive recurring automated text messages from THE VAULT and Oasis Cannabis Co. at the phone number you provided.

4.2 Types of Messages

We may send the following types of SMS messages:

Transactional Messages

• Account verification codes
• Claim Pass delivery and reminders
• Offer confirmations and outbid alerts
• Claim Pass expiration warnings
• Account security notifications

Promotional Messages

• Drop announcements and alerts
• Special offers and promotions
• New feature announcements
• Event notifications

4.3 Message Frequency

Message frequency varies based on your activity, preferences, and platform events. You may receive multiple messages per day during active Drop periods.

4.4 Message and Data Rates

Standard message and data rates from your wireless carrier may apply. You are solely responsible for any charges from your wireless carrier. Check with your carrier for details about your messaging plan.

4.5 Opting Out

You may opt out of SMS communications at any time by:

• Replying STOP to any message from THE VAULT
• Contacting us at help@oasiscannabisnm.com

After opting out, you will receive a single confirmation message. You will no longer receive promotional SMS messages, but you may continue to receive transactional messages related to your account security and active Claim Passes until they expire or are redeemed.

4.6 Opting Back In

You may opt back in to SMS communications at any time by:

• Replying START to any previous message thread
• Texting VAULT to (505) 448-0563
• Updating your preferences in your account settings

4.7 SMS Help

For assistance with SMS messages, reply HELP to any message or contact us at help@oasiscannabisnm.com.

4.8 Carrier Disclaimer

Wireless carriers are not liable for delayed or undelivered messages. Message delivery is subject to effective transmission from your wireless carrier and is outside of our control.

4.9 Supported Carriers

Our SMS program is supported by major U.S. wireless carriers. Coverage is not available in all areas.

5. HOW WE SHARE YOUR INFORMATION

We may share your information in the following circumstances:

5.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Cloud hosting and infrastructure providers
• SMS and communication service providers
• Email service providers
• Payment processors
• Identity verification services
• Fraud prevention and security services
• Analytics and data analysis providers
• Customer support platforms

Our service providers are contractually obligated to use your information only for the purposes of providing services to us and to maintain appropriate security measures.

5.2 Oasis Cannabis Dispensary Locations

We share information with Oasis Cannabis dispensary locations to facilitate Claim Pass redemption and product pickup. This includes:

• Your name and account information
• Claim Pass details
• Pickup preferences

5.3 Legal Compliance and Protection

We may disclose your information when we believe in good faith that disclosure is necessary to:

• Comply with applicable laws, regulations, or legal processes
• Respond to lawful requests from law enforcement or government agencies
• Protect the rights, property, or safety of Oasis Cannabis Co., our users, or others
• Enforce our Terms of Service
• Investigate suspected fraud, abuse, or violations of our policies
• Cooperate with regulatory authorities

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or other business transaction, your information may be transferred to the acquiring entity or successor. We will notify you of any such change in ownership or control of your personal information.

5.5 Affiliates

We may share information with our parent companies, subsidiaries, and affiliates for purposes consistent with this Privacy Policy.

5.6 With Your Consent

We may share your information with third parties when you have given us your explicit consent to do so.

5.7 Aggregated and Anonymized Data

We may share aggregated or anonymized information that cannot reasonably be used to identify you. This information is not subject to the restrictions in this Privacy Policy.

5.8 No Sale of Personal Information

We do not sell your personal information to third parties for monetary consideration. We do not share your personal information with third parties for their direct marketing purposes without your consent.

6. DATA RETENTION

6.1 Retention Periods

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including:

Account Information

We retain your account information for as long as your account is active and for a reasonable period thereafter to allow you to reactivate your account, comply with legal obligations, resolve disputes, and enforce our agreements. Generally, we retain account information for seven (7) years after account closure.

Transaction Information

We retain transaction information, including offer history, Claim Pass records, and redemption records, for seven (7) years to comply with tax and regulatory requirements and for audit purposes.

Communications

We retain communication records, including SMS consent records, for seven (7) years or as required by applicable law.

Usage Data

We retain usage data and analytics information for up to three (3) years in identifiable form. After this period, the data may be retained in aggregated or anonymized form.

Legal Hold

We may retain information for longer periods when required for legal proceedings, regulatory investigations, or as otherwise required by law.

6.2 Deletion

When information is no longer needed for the purposes described in this Privacy Policy, we will delete or anonymize it in accordance with our data retention policies. Some information may persist in backup systems for a limited period before being permanently deleted.

7. COOKIES AND TRACKING TECHNOLOGIES

7.1 What Are Cookies?

Cookies are small text files that are placed on your device when you visit a website. They are widely used to make websites work more efficiently and to provide information to website operators.

7.2 Types of Cookies We Use

Essential Cookies

These cookies are necessary for the Services to function properly. They enable core functionality such as account authentication, security, and accessibility. You cannot opt out of essential cookies.

Functional Cookies

These cookies enable enhanced functionality and personalization, such as remembering your preferences and settings.

Analytics Cookies

These cookies help us understand how users interact with the Services by collecting information about pages visited, time spent on pages, and other usage data. We use this information to improve the Services.

Advertising Cookies

These cookies may be used to deliver relevant advertisements and to measure the effectiveness of advertising campaigns. We may use these cookies to show you personalized content based on your interests.

7.3 Other Tracking Technologies

Web Beacons (Pixels)

We use web beacons (also known as pixels or clear GIFs) in our emails and on our website to track whether emails are opened and links are clicked, and to collect information about how users interact with the Services.

Local Storage

We use local storage technologies (such as HTML5 localStorage) to store information locally on your device.

Session Storage

We use session storage to store information temporarily during your browsing session.

7.4 Third-Party Cookies

Some cookies are placed by third-party service providers who perform services on our behalf. These third parties may use cookies to collect information about your online activities over time and across different websites.

7.5 Managing Cookies

Most web browsers are set to accept cookies by default. You can usually modify your browser settings to decline cookies if you prefer. However, if you choose to decline cookies, some features of the Services may not function properly.

Browser Settings

You can manage cookies through your browser settings. The following links provide information on how to manage cookies in popular browsers:

• Chrome: chrome://settings/cookies
• Firefox: about:preferences#privacy
• Safari: Preferences > Privacy
• Edge: edge://settings/privacy

Do Not Track

Some browsers offer a "Do Not Track" (DNT) feature. Our Services do not currently respond to DNT signals. However, you can manage tracking through your cookie preferences as described above.

8. DATA SECURITY

8.1 Security Measures

We implement appropriate technical, administrative, and physical security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Access controls and authentication requirements
• Regular security assessments and testing
• Employee training on data protection
• Incident response procedures

8.2 No Guarantee of Security

Despite our efforts, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information. You acknowledge and accept this risk when using the Services.

8.3 Your Responsibility

You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account. Please notify us immediately if you suspect any unauthorized access to or use of your account.

8.4 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law. Notification may be made by email, SMS, postal mail, or through a notice on our website.

9. YOUR PRIVACY RIGHTS

Depending on your location, you may have certain rights regarding your personal information. We are committed to honoring these rights to the extent required by applicable law.

9.1 Access

You have the right to request access to the personal information we hold about you. You can access much of your information directly through your account settings.

9.2 Correction

You have the right to request correction of inaccurate or incomplete personal information. You can update much of your information directly through your account settings.

9.3 Deletion

You have the right to request deletion of your personal information, subject to certain exceptions. We may retain certain information as required by law or for legitimate business purposes.

9.4 Data Portability

You have the right to request a copy of your personal information in a structured, commonly used, and machine-readable format.

9.5 Opt-Out of Marketing

You have the right to opt out of receiving marketing communications from us. You can do so by:

• Clicking the "unsubscribe" link in marketing emails
• Replying STOP to SMS messages
• Updating your communication preferences in your account settings
• Contacting us at help@oasiscannabisnm.com

9.6 Opt-Out of Sale/Sharing

We do not sell your personal information. If we engage in any activity that constitutes a "sale" or "sharing" under applicable law in the future, we will provide you with the ability to opt out.

9.7 Non-Discrimination

We will not discriminate against you for exercising your privacy rights. However, some features of the Services may not be available if you choose not to provide certain information.

9.8 How to Exercise Your Rights

To exercise your privacy rights, please contact us at:

Email: help@oasiscannabisnm.com

We may need to verify your identity before processing your request. We will respond to your request within the timeframe required by applicable law.

9.9 Authorized Agents

You may designate an authorized agent to make requests on your behalf. We may require verification of the agent's authorization and your identity before processing such requests.

9.10 Appeals

If we deny your request, you may have the right to appeal our decision. To appeal, please contact us at help@oasiscannabisnm.com with the subject line "Privacy Rights Appeal."

10. STATE-SPECIFIC PRIVACY RIGHTS

10.1 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

Right to Know

You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which the information is collected, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share the information.

Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions.

Right to Correct

You have the right to request correction of inaccurate personal information.

Right to Opt-Out of Sale/Sharing

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.

Right to Limit Use of Sensitive Personal Information

If we collect sensitive personal information beyond what is necessary to provide the Services, you have the right to limit our use and disclosure of such information.

Non-Discrimination

You have the right not to be discriminated against for exercising your CCPA/CPRA rights.

Shine the Light

California Civil Code Section 1798.83 permits California residents to request information regarding the disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

10.2 Virginia Residents

If you are a Virginia resident, you may have additional rights under the Virginia Consumer Data Protection Act (VCDPA), including the right to access, correct, delete, and obtain a copy of your personal data, and the right to opt out of the processing of personal data for targeted advertising, sale, or profiling.

10.3 Colorado Residents

If you are a Colorado resident, you may have additional rights under the Colorado Privacy Act (CPA), including the right to access, correct, delete, and obtain a copy of your personal data, and the right to opt out of the processing of personal data for targeted advertising, sale, or profiling.

10.4 Connecticut Residents

If you are a Connecticut resident, you may have additional rights under the Connecticut Data Privacy Act (CTDPA), including the right to access, correct, delete, and obtain a copy of your personal data, and the right to opt out of the processing of personal data for targeted advertising, sale, or profiling.

10.5 Other States

If you are a resident of another state with applicable privacy laws, you may have additional rights. Please contact us at help@oasiscannabisnm.com for more information.

11. CHILDREN'S PRIVACY

11.1 Age Restriction

The Services are intended only for individuals who are twenty-one (21) years of age or older. We do not knowingly collect, use, or disclose personal information from anyone under twenty-one (21) years of age.

11.2 COPPA Compliance

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under thirteen (13) years of age. The Services are not directed to children under thirteen (13).

11.3 Discovery of Minor's Information

If we learn that we have collected personal information from anyone under twenty-one (21) years of age, we will promptly delete that information. If you believe we have collected information from someone under twenty-one (21), please contact us immediately at help@oasiscannabisnm.com.

12. INTERNATIONAL USERS

12.1 United States Only

The Services are intended for use only in the United States, specifically in the State of New Mexico. We do not intentionally collect personal information from individuals outside the United States.

12.2 Data Transfer

If you access the Services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where our servers are located. By using the Services, you consent to such transfer, storage, and processing.

12.3 No Services Outside New Mexico

Due to the nature of cannabis regulation, we do not provide Services outside the State of New Mexico. If you are located outside New Mexico, you should not use the Services.

13. THIRD-PARTY LINKS AND SERVICES

13.1 Third-Party Websites

The Services may contain links to third-party websites, applications, or services that are not owned or controlled by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access.

13.2 Third-Party Integrations

The Services may integrate with third-party services, such as social media platforms or analytics providers. Your interactions with these third-party services are governed by their respective privacy policies.

13.3 No Responsibility

We are not responsible for the privacy practices, security, or content of any third-party websites or services. Your use of third-party services is at your own risk.

14. CANNABIS-SPECIFIC PRIVACY CONSIDERATIONS

14.1 Sensitive Nature of Information

We understand that information related to cannabis purchases may be considered sensitive. We are committed to protecting this information and limiting its disclosure to the minimum necessary to provide the Services.

14.2 Legal Protections

Cannabis remains illegal under federal law. While we implement strong security measures, we cannot guarantee that your information will not be subject to lawful requests from law enforcement or government agencies.

14.3 No Medical Records

We do not collect or maintain medical records. If you are a medical cannabis patient, any medical information is maintained separately by the applicable state program and dispensary, not by THE VAULT.

14.4 Transaction Privacy

We do not share individual transaction information with third parties for marketing purposes. Your Drop history and Claim Pass information are kept confidential except as necessary to provide the Services or as required by law.

15. CHANGES TO THIS PRIVACY POLICY

15.1 Modifications

We reserve the right to modify this Privacy Policy at any time in our sole discretion. We will notify you of material changes by:

• Posting the updated Privacy Policy on our website
• Updating the "Last Updated" date at the top of this Privacy Policy
• Sending you an email or SMS notification (for significant changes)
• Displaying a notice within the Services

15.2 Acceptance of Changes

Your continued use of the Services after the posting of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree to the revised Privacy Policy, you must discontinue your use of the Services.

15.3 Review

We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices.

16. CONTACT US

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us at:

We will respond to your inquiry as soon as reasonably practicable.

17. ADDITIONAL INFORMATION

17.1 Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of New Mexico, without regard to its conflict of law provisions.

17.2 Entire Agreement

This Privacy Policy, together with our Terms of Service, constitutes the entire agreement between you and the Company regarding your use of the Services and supersedes all prior agreements and understandings.

17.3 Severability

If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions will remain in full force and effect.

17.4 No Waiver

Our failure to enforce any provision of this Privacy Policy shall not constitute a waiver of that provision or any other provision.