Last updated: September 3, 2026. Prepared as a template for owner review; not legal advice.
1. Who is responsible
[OWNER: legal business name], [OWNER: business address], [OWNER: privacy contact email] is responsible for the personal data processed on vaperan.com.
2. What we collect and why
| Data | When | Why |
|---|---|---|
| Name, shipping and billing address, email, phone | When you order or create an account | To process, age-verify, ship and support your order; legal record keeping under the PACT Act |
| Date of birth and, where required, ID verification result | At checkout | Age verification required by federal and state law. We keep the result, not a copy of your ID, unless the verification provider requires it |
| Payment data | At checkout | Processed directly by our payment provider; we receive only a token, the last four digits and the outcome |
| Order history | Ongoing | Customer service, returns and warranty, tax and PACT Act reporting |
| Contact form content | When you write to us | To answer you |
| Product reviews | If you leave one | Displayed on the product page with the name you choose |
| Newsletter email | If you subscribe | To send our newsletter; you can unsubscribe in any email |
| Technical data (IP address, browser, pages viewed) | Automatically | Security, fraud prevention, caching and site performance |
3. Cookies
We use cookies that are necessary for the cart, checkout, login, wishlist, compare and age-gate functions. [OWNER: state whether analytics or marketing cookies are used, e.g. “We use Google Analytics” or “We do not use analytics or advertising cookies”]. You can block cookies in your browser, but the cart and checkout will not work without the necessary ones.
4. Who receives your data
- Our web host ([OWNER: hosting provider, e.g. Hostinger]) that stores the website and its database.
- Our payment provider ([OWNER: processor name]) to take payment.
- Our age-verification provider ([OWNER: provider name, if any]).
- Our shipping carrier, which receives your name, address and phone number to deliver and collect the adult signature.
- Our email service for order confirmations and, if subscribed, newsletters ([OWNER: email service, if any]).
- State tax authorities and the federal government where the PACT Act requires monthly delivery reports.
We do not sell personal data.
5. Legal reporting
The PACT Act requires remote sellers of vapor products to register with the ATF and state tax administrators and to file monthly reports listing the name and address of each delivery recipient, the brand and quantity shipped. We keep these records for the period the law requires.
6. How long we keep data
Order and age-verification records: as long as required by tax and PACT Act rules ([OWNER: retention period, typically at least 4 years]). Account data: until you delete your account. Contact messages: [OWNER: e.g. 24 months]. Newsletter data: until you unsubscribe.
7. Your rights
Depending on where you live (for example under the California Consumer Privacy Act), you can ask what personal data we hold about you, ask us to correct or delete it, and opt out of any sale or sharing (we do neither). Write to [OWNER: privacy contact email] or use the contact form. We will verify your identity before acting and respond within the time the law sets.
8. Security
The site is served over HTTPS, admin access is restricted, and payment data never touches our servers. No system is completely secure; if a breach affects your data we will notify you as the law requires.
9. Children
This website is for adults 21 and over. We do not knowingly collect data from anyone under 21 and delete such data when we become aware of it.
10. Changes and contact
We may update this policy; the date above shows the current version. Contact [OWNER: privacy contact email] with any question.