Privacy Policy

1. Introduction

This Privacy Policy explains how Rebelle Dispensary ("Rebelle," "we," "us," or "our"), located in the South End neighborhood of Boston, Massachusetts, collects, uses, discloses, and protects information about visitors to our website (the "Site") and customers who visit our retail location or interact with our loyalty, marketing, or online ordering services (collectively, our "Services").

By using our Site or visiting our store, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our Services.


Because Rebelle operates a licensed cannabis retail establishment, some of our data practices are shaped by Massachusetts Cannabis Control Commission (CCC) regulations and other state and federal law. Where those requirements apply, they are noted below.


2. Information We Collect

2.1 Information You Provide Directly

  • Age and identity verification. As required by Massachusetts law, we verify that all customers are 21 years of age or older (or hold a valid medical marijuana card, where applicable) before completing a sale. This requires scanning or manually reviewing a government-issued photo ID.
  • Contact information. Name, email address, phone number, and mailing address, such as when you join our loyalty/rewards program, sign up for SMS or email marketing, or place an online order for in-store pickup.
  • Order and transaction information. Products purchased, order history, payment method (we do not store full payment card numbers — see Section 6), and pickup preferences.
  • Communications. Information you provide when you contact us via phone, email, contact form, or in person (e.g., customer service inquiries).
  • Medical patient information (if applicable). If you shop as a registered Massachusetts medical marijuana patient, we may collect and verify your patient registration information as required by the CCC and the Massachusetts Department of Public Health.


2.2 Information Collected Automatically

  • Device and usage data. IP address, browser type, device type, operating system, referring/exit pages, and pages viewed, collected via cookies, web beacons, and similar technologies when you use our Site.
  • Analytics data. We may use tools such as Google Analytics to understand how visitors use our Site.
  • Location data. Approximate location derived from your IP address or, with your permission, precise location if you enable location services (e.g., to confirm proximity to our store for pickup).


2.3 Information from Third Parties

  • Age/ID verification vendors used to confirm eligibility to purchase cannabis products.
  • Point-of-sale, e-commerce, and loyalty platform providers that help us process transactions and manage rewards programs.
  • State seed-to-sale tracking system (METRC). Massachusetts law requires licensed cannabis retailers to report certain sales and inventory data to the state's track-and-trace system. This reporting is a regulatory requirement, not a marketing use of your data.


3. How We Use Your Information

We use the information we collect to:

  • Verify age and legal eligibility to purchase cannabis products
  • Process and fulfill in-store and online pickup orders
  • Operate and manage our loyalty/rewards program
  • Send transactional communications (e.g., order confirmations, pickup notifications)
  • Send marketing communications via email or SMS, only where you have opted in, and in compliance with the CAN-SPAM Act and Telephone Consumer Protection Act (TCPA)
  • Improve and personalize our Site and in-store experience
  • Comply with Massachusetts Cannabis Control Commission regulations, including sales reporting and recordkeeping requirements
  • Detect, investigate, and prevent fraud, theft, or diversion of cannabis products
  • Respond to customer service inquiries
  • Comply with applicable law, legal process, or governmental request


We do not sell your personal information to third parties for their own marketing purposes.


4. Age Restriction

Our Services are intended solely for individuals 21 years of age or older (or qualifying medical patients as permitted by Massachusetts law). We do not knowingly collect personal information from anyone under 21. If we learn that we have inadvertently collected such information, we will delete it promptly. Age verification is required both online (if applicable to your ordering flow) and in person at time of purchase.


5. How We Share Your Information

We may share your information with:


  • Service providers who perform functions on our behalf (e.g., point-of-sale systems, e-commerce platforms, loyalty program administrators, SMS/email marketing platforms, ID verification vendors, IT and hosting providers), under contractual obligations to protect your data.
  • Regulatory authorities, including the Massachusetts Cannabis Control Commission, as required for compliance, licensing, and seed-to-sale tracking obligations.
  • Law enforcement or government agencies, when required by law, subpoena, court order, or to protect the safety of our staff, customers, or the public.
  • Business transfer parties, in the event of a merger, acquisition, financing, or sale of assets, where your information may be transferred as part of that transaction.


We do not share your cannabis purchase history with unrelated third parties for advertising purposes.


6. Payment Information

Rebelle uses third-party payment processors to handle transactions. Due to federal banking restrictions on cannabis businesses, payment options may include cash, cashless ATM/debit systems, or state-compliant payment processors. We do not store full credit or debit card numbers on our servers; payment processing is handled by our processor(s) in accordance with applicable payment card industry (PCI) standards.


7. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies to:

  • Remember your preferences and login/session status
  • Understand Site traffic and usage patterns through analytics
  • Support age-gate verification for Site access
  • Support advertising and retargeting, where legally permitted for cannabis-adjacent businesses (e.g., non-product lifestyle or brand advertising)


You can control cookies through your browser settings. Disabling cookies may affect the functionality of our Site, including age verification and online ordering.


8. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction, consistent with Massachusetts data security requirements (M.G.L. c. 93H and 201 CMR 17.00). However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.


9. Data Retention

We retain personal information for as long as necessary to:

  • Fulfill the purposes described in this Policy
  • Comply with Massachusetts Cannabis Control Commission recordkeeping requirements (which may require retention of certain sales and identity-verification records for a specified period)
  • Resolve disputes and enforce our agreements


When information is no longer needed, we take reasonable steps to securely delete or de-identify it, subject to applicable legal retention requirements.


10. Your Choices and Rights

  • Marketing opt-out. You may unsubscribe from marketing emails at any time using the unsubscribe link in any email, or reply "STOP" to opt out of SMS messages. You may still receive transactional messages related to your orders.
  • Loyalty program. You may request to close your loyalty account by contacting us using the information below.
  • Access/correction requests. You may contact us to request access to, correction of, or deletion of certain personal information we hold about you, subject to our regulatory recordkeeping obligations.
  • Massachusetts residents. While Massachusetts does not currently have a comprehensive consumer privacy statute equivalent to the CCPA, we honor reasonable requests regarding your personal information as described above.


To exercise any of these choices, contact us using the information in Section 14.


11. Third-Party Links

Our Site may contain links to third-party websites, including delivery or menu platforms , social media, or payment providers. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies separately.


12. Children's Privacy

Our Services are not directed to individuals under 21 years of age, and we do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us so we can delete it.


13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last Updated" date at the top of this page will reflect the most recent revision. We encourage you to review this page periodically.


14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us here.