Higher Origins Privacy Policy

Last updated October 23, 2026

Welcome to Higher Origins (higherorigins.com) and its related subdomains, mobile, and software applications ("Site" or "App"). This Privacy Notice ("Notice") explains the information we collect, use, and share when you use our Site, App, and related services ("Services"). This Notice applies only to Services that reference it and may be supplemented by other notices.

Google Account and Gmail Data

Connecting a Google, Gmail, or Google Workspace account is optional. With your authorization, Higher Origins uses your connected mailbox to send email and menu links that you review and submit in the App. The following limits govern Google user data, including data derived from it, even where another part of this Notice or our Terms of Use describes broader data uses, content licenses, sharing, or business transfers.

Information we access and why

• Account identity: We request basic Google account identity and email-address permissions to verify the account you connect and identify the authorized sender. We receive your Google account identifier, email address, and email verification status.
• Sending permission: We request Gmail permission to send email on your behalf. This connection does not request permission to read, search, synchronize, or delete your existing Gmail messages, or import your Google contacts or inbox attachments.
• Authorization and sending records: We receive access and refresh tokens, granted permissions, token expiry information, and submission results, including a message identifier when Google returns one. We use these to maintain your authorized connection, submit your messages, show sending status, enforce mailbox limits, and prevent duplicate or unauthorized submissions.

We also store the drafts, recipient details, subjects, message bodies, menu links, and sending history you create through Higher Origins. Drafts are private to their author. Messages sent under a business become business records visible to its authorized teammates; this does not share the sender's mailbox credentials. Google authentication happens on Google's sign-in pages; Higher Origins does not receive or store your Google password.

Email open and click activity

Emails sent through the App contain a small tracking image and tracked links, except security and account-access links. Loading the image or following a tracked link records a signal associated with that recipient's message. We retain daily signal timestamps, the link reference, and a coarse classification of known automation; this feature does not store visitor IP addresses, cookies, raw request headers, or browser identifiers in its engagement records. Your email provider may load images automatically, security scanners may follow links, and forwarded messages may create activity, so these signals do not prove that a particular person read a message.

Authorized teammates can view activity for their business's sent messages. Engagement records and tracking destinations expire after 90 days; expired tracking links no longer redirect. Tracking provides sending activity within Higher Origins and is not used for advertising. The restrictions on Google user data in this section continue to apply.

Storage, protection, and sharing

We store OAuth access and refresh tokens encrypted on our servers. Connection credentials are associated with the account owner, and access to saved messages and sending records is governed by account and business-workspace permissions.

When you submit a message, we send its content and recipient information to Google for delivery from your connected mailbox. Your chosen recipients receive the message and sender address; Google and the recipients' email providers process it under their own policies. Infrastructure and security providers may process Google user data on our behalf as needed to operate and protect this feature, subject to the limits in this section.

Other transfers of Google user data are limited to protecting security or investigating abuse, complying with applicable law, or a merger, acquisition, or sale of assets after obtaining your explicit prior consent. Our personnel may read Google user data only with your affirmative agreement to access specific data, when necessary for security purposes, or as required by law.

Limited Use of Google data

Higher Origins follows the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring Google user data. We use this data only to provide and support the connected-email features you use.

We do not sell Google user data, share it with advertisers or data brokers, use it for advertising or unrelated marketing, or use it to determine creditworthiness or for lending. We do not use Google user data to train or improve generalized artificial intelligence or machine-learning models.

Disconnecting, retention, and deletion

You can disconnect a mailbox in Account Settings → Email. Disconnecting removes the stored authorization credentials from the active connection and stops messages that have not reached submission. You can also revoke Higher Origins' access from your Google Account's third-party connections.

Disconnecting or revoking access does not automatically delete saved drafts or sending history, recall sent messages, or delete copies held by Google or recipients. We retain saved drafts and sending history as needed to provide the feature and maintain your business records. Limited account and sending records are also retained to enforce mailbox limits, prevent abuse, resolve delivery questions, and meet legal obligations.

To request deletion of Google-related data stored by Higher Origins, including saved drafts and sending records, email [email protected]. We process deletion requests subject to applicable legal requirements and any necessary security or fraud-prevention retention. Deletion by Higher Origins does not remove messages already held by Google or your recipients.

Information We Collect

The type of information we gather depends on how you use our Services and the choices you make. We collect information directly from you, automatically, from third-party sources, and through data inferences to improve our platform through analytics, marketing, and personalization.

Information You Provide Directly

You may give us information by filling out forms, contacting us, or using our Services through various channels (phone, text, email, etc.). Examples include:

• Contact Information: Such as your name, username, email, and phone number.
• Demographic Data: Location and other registration details.
• Content and Files: Photos, documents, reviews, and other shared information.
• Transactions: For transactions, we collect contact details, order info, and payment information (including government-issued IDs, if needed).
• License and Metrc Data: Cannabis license information and data from Metrc API, as required.

Information Collected Automatically

When you use our Services, we automatically collect data, including:

• Usage Data: Pages viewed, actions taken, and referring URLs.
• Identifiers and Device Info: Technical details like IP address, browser type, device identifiers (e.g., MAC address), and device specifications.
• Geolocation Data: Collected based on your device and app settings.
• Engagement Data: Interactions on our platform, such as menu views and product engagement.

Cookies and Similar Technologies

Higher Origins uses session cookies to track user activity, such as menu views and engagement, providing a personalized experience. Cookies are small data files stored on your device to enhance functionality and store preferences. We use both session cookies (temporary) and persistent cookies (longer-lasting) to improve your experience, keep you signed in, protect against fraud, and analyze site performance. Cookies generally contain a unique identifier but may hold other information.

Third-Party Service Providers

We work with specific third-party providers:

• Metrc API: Used for compliance data as required by regulations.
• AWS SES: For Higher Origins system and administrative email communications.
• Google and Microsoft: For sending messages through the email account you choose to connect. The Google Account and Gmail Data section above governs our use of Google user data.
• Braintree: Manages payment processing for subscriptions and transactions.

We do not display ads on our platform and do not share your data with advertisers.

California “Do Not Sell My Info”

The California Consumer Privacy Act (CCPA) requires us to disclose and allow opt-outs of data "sales" to third parties. Under the CCPA, “sale” can mean simply sharing data (e.g., IP addresses, cookies, or mobile IDs) with third parties in some cases. Higher Origins does not “sell” other personal information types.

To opt-out, email [email protected] with a “Do Not Sell” request. While we won’t sell your data after receiving this request, we may continue to share some data with service providers for verification, payment, or email communications. Note that opting out will not undo any previously shared information. To apply this setting on other devices, visit our site from those devices and follow the same process.

Cookie Controls

Most browsers accept cookies by default, but you can adjust settings to delete or reject them. Keep in mind that disabling cookies may affect some features on our site, and previously stored preferences may need to be reset if cookies are deleted.

Do Not Track (DNT)

Our site does not respond to DNT signals, as there is no standardized way to interpret them. However, you can control data collection using the cookie and advertising settings mentioned above.

Information from Third-Party Sources

We gather data from third parties and apply the same protection standards outlined in this Notice. Third-party sources include:

• METRC: California’s cannabis track-and-trace software. As an approved METRC integrator, we receive data like API keys, product info, facility details, UIDs, transfer data, and test results for account verification and operations.
• California Department of Cannabis Control: Provides public cannabis license data, which we analyze to gain insights and support our Services.

Information Created or Generated

We create inferences from collected data to understand your likely preferences or characteristics. For example, we might suggest products based on previous purchases or conduct predictive cannabis market analyses.

You may choose not to provide certain information or use device controls to limit data collection. However, declining data requests may affect your access to some products or features.

Sharing Your Information

Higher Origins Services may allow you to share actions, comments, profile info, and other content publicly or with specific individuals. Depending on your account type, you can manage certain information shared through your profile settings. Be cautious when deciding what to make public, as we cannot control others’ use or security of shared data.

Our platform may also let you share information via services like Meta, Google, or X. Once shared publicly, we are not responsible for third-party use or re-sharing of your data. Adjust privacy settings on these networks if needed, and review their privacy policies for more details.

How Higher Origins Uses Your Information

We use collected data for purposes listed in this Notice or as otherwise disclosed:

These uses help us operate our business, personalize your experience, support customers, communicate updates, and inform you of new products, offers, and events. See the Information Choices section to adjust promotional communication preferences.

Combining Data for a Better Experience

We combine data from different sources to provide a smoother, more personalized experience. For example, we may use your geographic location to tailor content, recommend services, and confirm the availability of certain features in your area. Aggregated or de-identified information (no longer linked to an identifiable person) may be used for any business purpose.

How Higher Origins Shares Your Information

We may share your data in the following situations:

• With Your Consent: We share information as necessary to complete transactions or provide requested services. For example, when you place an order through our platform, we may share your contact details and order information with the licensed dispensary to fulfill the order.
• With Affiliates and Subsidiaries: We share information within our corporate family to provide and improve services.
• With Service Providers: We use third parties, like AWS SES for emails, Braintree for payments, and METRC for compliance, to perform tasks on our behalf.
• For Legal Reasons: We may disclose information to comply with legal obligations, such as court orders or subpoenas, or to prevent harm, fraud, or illegal activities.
• During Business Transactions: If we are involved in a merger, acquisition, financing, or sale, your data may be transferred as part of the transaction. In cases of bankruptcy or dissolution, data may also be considered a transferable asset.

Third-Party Links

Some products or publications may reference third-party links or content. Information shared with these third parties is subject to their privacy practices, not ours. Please review third-party privacy policies before sharing data or interacting with their services.

Data Security

We take multiple precautions to protect your personal information, including encryption for stored and transmitted data. We use trusted third-party providers with robust security tools and take additional steps to prevent unauthorized access or disclosure. However, no system is entirely secure. Protect yourself by using a unique password for our Services and avoiding reusing passwords from other sites.

Third-Party Links Disclaimer

Higher Origins may contain links to external sites not controlled by us. We are not responsible for their privacy practices, policies, or content. Access third-party links at your own risk, and we encourage you to review their privacy policies and terms.

Minors and Restricted Access

Higher Origins is only accessible to users who meet the legal age to consume cannabis in their area (usually 21+). By using Higher Origins, you confirm that you meet these age requirements.

Location of Personal Data

Your data may be stored in the U.S. or other countries where we or our partners operate. While some countries may not have as robust data protection laws as your home country, we take steps to ensure that your data is managed in line with this Notice and applicable laws.

Data Retention

We retain your information as needed to fulfill requested services, meet legal obligations, resolve disputes, and for other legitimate business needs. Retention periods vary based on data type, user expectations, and legal requirements.

Information Choices

• Access, Correction, and Deletion: To access, correct, or delete your data, email [email protected]. We may decline requests that are excessive or not permitted by law.
• Communication Preferences: To opt-out of marketing emails or texts, follow instructions in the messages or update your account settings. You’ll still receive essential non-promotional communications, such as account notices.
• Cookie and Tracking Controls: See our Cookies section for ways to control cookies and ad tracking. You can opt out of ad tracking in the U.S. via NAI or DAA; in Canada at Digital Advertising Alliance of Canada; and in Europe at Your Online Choices.

Your Rights Under EU Privacy Laws

If EU data protection law applies, you may:

• Request access, correction, or deletion of your data.
• Request data portability, object to processing, or restrict processing under certain conditions.
• Withdraw consent for future data processing.
• For France residents, provide specific instructions for data handling after death.

Contact us for these requests or direct them to the relevant data controller if we process on their behalf. You can also file complaints with your local supervisory authority, though we encourage you to reach out to us first.

California Privacy Rights

If you’re a California resident, you have rights under the CCPA, including:

• Right to Know: You may request information about the personal data we collect, sources, purposes, third-party sharing, and any data “sold.”
• Right to Request Deletion: Request deletion of your data, subject to legal exceptions.
• Right to Opt-Out: To opt-out of “sales” of your data, visit our "Do Not Sell My Info" page.

To exercise these rights, email [email protected]. You may also designate an authorized agent to make requests on your behalf, with appropriate verification. You will not be discriminated against for exercising these rights.

Under California’s “Shine the Light” law, California residents may also request information about our sharing of data for third-party marketing purposes once per year by emailing [email protected].

Changes to this Notice

We may update this Privacy Notice to reflect changes in our practices or legal requirements. The latest update date is noted above. Material changes will be communicated as required by law.