Field Supply Cannabis & Provisions

Privacy Policy and Data Retention Policy

Version 2.0 | Effective date: August 1, 2025 | Last updated: September 1, 2026

This Privacy Policy explains what personal information Field Supply collects when you use our website, online menu, and mobile app, how we use and share it, how long we keep it, and the choices and rights you have. Please read it carefully. Section 9 contains our full data retention schedule.

1. Who we are and what this Policy covers

Field Supply Cannabis & Provisions ("Field Supply," "we," "us," or "our") is a retail marijuana store licensed by the Delaware Office of the Marijuana Commissioner, license number N07033. Field Supply is part of American Fiber Co.

This Policy applies to thefieldsupply.com, our online pre-order menu, our loyalty program, and the Field Supply Cannabis & Provisions mobile app available on the Apple App Store and Google Play (together, the "Services"). It also applies to information we collect from you in our store, because we maintain a single customer profile across all of these channels.

Our menu, ordering, loyalty, payments, and mobile app run on a platform provided by Courier Plus, Inc., doing business as Dutchie ("Dutchie"). For purposes of the Delaware Personal Data Privacy Act ("DPDPA"), Field Supply is the controller of your personal data and Dutchie is our processor. Dutchie also independently maintains certain technical, security, and payment underwriting data about its platform, which is governed by Dutchie's own privacy policy at dutchie.com/privacy.

Contact for privacy questions and requests: privacy@thefieldsupply.com or the mailing address in Section 19.

2. You must be 21 or older

You must be at least 21 years old to use the Services, or be a registered Delaware medical marijuana patient with a valid program card. If you are under 21 and not a registered patient, do not use the Services. We verify age with a valid, unexpired government-issued photo ID before every sale. We do not knowingly collect personal information from anyone under 21. If we learn that we have, we will delete it.

3. Information we collect

3.1 Information you give us

  • Account and profile: name, email address, mobile phone number, date of birth, password or social sign-in (Apple or Google), loyalty enrollment, referral activity, and communication preferences.

  • Orders and purchases: items ordered, order history, pickup selections, pricing, discounts, and loyalty rewards earned or redeemed, whether placed online, in the app, by phone, or in store.

  • Identity verification: when you shop in store we check your government-issued photo ID using an identity verification service. From that check we record your name, address, date of birth, the issuing state, and the expiration date of your ID in your customer profile. The verification service holds the scan data it processes for a short, limited period after verification and then deletes it in accordance with its own retention policy. Field Supply does not keep a copy of your ID image.

  • Medical patient status: if you tell us you hold a Delaware medical marijuana program card, we record your card status and expiration so we can apply the correct tax treatment and purchase rules. This is sensitive data and we ask for your consent before recording it (see Section 5).

  • Payments: if you enroll in Pay by Bank, the connection to your bank is handled by Dutchie and its payment partners. Field Supply never receives or stores your bank login, full account number, or routing number. We receive a confirmation of payment and a transaction record.

  • Communications: messages you send us by email, text, phone, in-app chat, or through customer support, and any feedback or reviews you provide.

3.2 Information collected automatically

  • Device and app data: device type, operating system, app version, unique device or advertising identifiers, push notification token, language, and crash and performance logs.

  • Usage data: pages and screens viewed, products viewed or added to a cart, searches, taps and clicks, session times, and the page that referred you to us.

  • Network data: IP address, which we may use to estimate your general location (city or region).

  • Precise location: only if you grant the app location permission. We use it to show the store location and directions. You can turn this off in your device settings at any time. Precise location is sensitive data (see Section 5).

  • Cookies and similar technologies: described in Section 8.

3.3 Information from other sources

Dutchie combines your activity across our website, app, phone orders, and in-store purchases into one customer profile so that your loyalty balance and order history are consistent everywhere. We do not purchase personal information about you from data brokers, and we do not combine your profile with third-party marketing data.

4. How we use your information

We use personal information to:

  • Create and secure your account and identify you as a user of the Services.

  • Verify that you are 21 or older or a registered medical patient, and comply with Delaware purchase limits and tax rules.

  • Process pre-orders for in-store pickup, hold your order, apply loyalty rewards and discounts, and process payment.

  • Send transactional messages such as order confirmations, ready-for-pickup notices, receipts, security alerts, and account notices.

  • Operate our loyalty and referral programs.

  • Send marketing communications you have signed up for (see Section 7).

  • Personalize the menu, recommendations, and offers you see, based on your browsing and purchase history.

  • Respond to your questions and provide customer support.

  • Analyze how the Services are used, fix problems, and develop new features and products.

  • Detect, investigate, and prevent fraud, theft, diversion, and other unauthorized or illegal activity.

  • Meet our legal, tax, and regulatory obligations, including reporting required by the Delaware Office of the Marijuana Commissioner and the Delaware Division of Revenue.

  • Protect our rights, property, and safety and those of our customers, employees, and the public.

5. Sensitive data and consent

Some information is treated as sensitive data under Delaware law. We do not process sensitive data without your opt-in consent, and we only use it for the purpose you consented to. For our Services this includes:

  • Medical marijuana patient status, which is health-related information.

  • Precise geolocation from your device.

  • Any health information you choose to share with us, for example in a conversation with a budtender that is recorded in your profile.

You can withdraw consent at any time by adjusting your app permissions, updating your profile, or contacting us. Withdrawing consent does not affect processing that happened before you withdrew it. Consent is not inferred from your continued use of the Services, and we do not use design tricks to obtain it.

6. How we share your information

We do not sell your personal information, and we have not sold personal information in the preceding 12 months. We share personal information only as follows:

  • Dutchie, which hosts and operates our menu, ordering, point-of-sale, loyalty, payments, marketing tools, and mobile app on our behalf.

  • Identity verification provider (IDScan.net), which checks the validity of government-issued IDs at the point of sale.

  • Payment partners engaged by Dutchie to process Pay by Bank and other electronic payments.

  • Communications providers that deliver our emails, text messages, and push notifications.

  • Analytics providers, including Google Analytics and Firebase, which help us understand how the Services are used.

  • Advertising platforms, only as described in Section 7, and only where you have not opted out of targeted advertising.

  • State regulators. Delaware requires us to record every sale in the state's seed-to-sale tracking system (BioTrack) and to keep sales, inventory, and tax records available to the Office of the Marijuana Commissioner, the Division of Alcohol and Tobacco Enforcement, and the Division of Revenue. These records identify products, quantities, prices, and times of sale. They do not include your name or ID information.

  • Legal process and safety. To comply with law, court orders, subpoenas, or other lawful requests; to enforce our terms; and to protect the rights, property, or safety of Field Supply, our customers, our employees, or others. Where permitted by law, we will try to notify you at the address on your account if we receive a lawful request for your information.

  • Business transfers. In connection with a merger, acquisition, financing, sale of assets, bankruptcy, or similar transaction, in which case the recipient will assume the obligations in this Policy.

  • With your direction or consent.

Every service provider that receives personal information from us is contractually required to use it only to perform services for us, to protect it, and to delete or return it when the engagement ends. Providers that serve personalized recommendations or ads inside the Services are prohibited from using our customer data for their own profiling or commercial purposes.

7. Marketing, advertising, and your choices

  • Email. If you give us your email address, we may send you news, offers, and updates about Field Supply and the brands we carry. Unsubscribe at any time using the link at the bottom of any email.

  • Text messages. We send marketing texts only if you have given prior express written consent, for example by opting in at checkout or in the app. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help. Transactional texts about your orders are sent regardless of marketing consent.

  • Push notifications. You can turn push notifications on or off in the app or in your device settings.

  • Personalized recommendations. We use your browsing and purchase history to recommend products and offers within the Services. You can ask us to stop this profiling (see Section 11).

  • Targeted advertising. We may use cookies and pixels to show you ads for Field Supply on other websites and apps based on your activity on our Services. You can opt out at any time through the Privacy Choices link in the app or on our website, or by using a browser or device signal such as Global Privacy Control, which we honor as a valid opt-out.

Delaware law restricts cannabis advertising to audiences that are at least 85% adults 21 and over. We send marketing only to account holders whose age has been verified, and any advertising placed in the app or on social media carries a notice that viewers must be 21 or older.

8. Cookies and tracking technologies

We and our providers use cookies, pixels, software development kits (SDKs), and similar technologies to keep you signed in, remember your cart and preferences, measure traffic and conversions, and, unless you opt out, support targeted advertising. Session cookies expire when you close your browser or the app. Persistent cookies and pixels last from 30 days to 24 months. You can control cookies through your browser settings and control advertising identifiers through your device settings (Limit Ad Tracking on iOS or Reset or Delete Advertising ID on Android). Blocking some cookies may affect how the Services work.

9. How long we keep your information (Data Retention Schedule)

We keep personal information only as long as needed for the purposes described in this Policy, to comply with Delaware cannabis and tax laws, to resolve disputes, and to enforce our agreements. The list below sets our retention periods. Where a legal requirement is longer than an operational need, the legal period controls.

Account and profile

  • Includes: Name, contact details, date of birth, preferences, loyalty balance
  • Kept for: Life of the account, then 3 years after your last purchase or login
  • Why: Customer relationship; dispute resolution

Order and purchase history

  • Includes: Items, prices, discounts, pickup records, rewards
  • Kept for: 5 years from the date of sale
  • Why: Delaware seed-to-sale and record-keeping rules (4 Del. Admin. Code 5001-7.0)

Tax and financial records

  • Includes: Transaction records, receipts, payment confirmations, tax reports
  • Kept for: 7 years from the end of the tax year
  • Why: Delaware Division of Revenue and IRS record-keeping

Identity verification

  • Includes: Name, address, date of birth, issuing state, and expiration date recorded from your ID
  • Kept for: Retained with your account profile (see above). Scan data processed by our identity verification provider is held for a short, limited period and then deleted; Field Supply does not keep ID images
  • Why: Age verification; fraud prevention (4 Del. C. 1332(f))

Medical patient status

  • Includes: Program card status and expiration date
  • Kept for: While your card is valid, then deleted within 90 days of expiration unless renewed; tax-exempt sale records kept 7 years
  • Why: Delaware medical program rules; tax records

Abandoned carts

  • Includes: Unpurchased cart items and value
  • Kept for: 90 days
  • Why: Operational

Marketing preferences and consent

  • Includes: Email and SMS opt-ins, opt-outs, preference settings
  • Kept for: Duration of consent plus 2 years of inactivity. Records proving consent or opt-out are kept 5 years after opt-out
  • Why: Consent management; TCPA and CAN-SPAM

Customer support

  • Includes: Emails, chats, call notes, complaints
  • Kept for: 3 years from the last message
  • Why: Customer service; dispute resolution

Device and push data

  • Includes: Push tokens, device identifiers
  • Kept for: Until you uninstall the app or 12 months of inactivity
  • Why: Operational

Cookies, pixels, analytics

  • Includes: Session and persistent cookies, analytics event logs
  • Kept for: Session cookies: end of session. Persistent: 30 days to 24 months. Analytics logs: 14 to 26 months
  • Why: Operational; provider defaults

Advertising data

  • Includes: Behavioral profiles used for ads
  • Kept for: Removed from ad audiences immediately on opt-out; otherwise same as account
  • Why: Consent; DPDPA opt-out

In-store video surveillance

  • Includes: Camera footage of the sales floor
  • Kept for: 90 days, or up to 36 months if footage records a significant event
  • Why: 4 Del. Admin. Code 5001-6.3.2.4

Fraud, theft, and diversion records

  • Includes: Investigation files, incident reports
  • Kept for: 5 years from the incident
  • Why: Regulatory reporting; legal defense

De-identified and aggregated data

  • Includes: Product and terpene trends, sales statistics with identifiers removed
  • Kept for: Indefinite
  • Why: Not personal data; re-identification prohibited

System backups

  • Includes: Encrypted backup copies of the above
  • Kept for: Overwritten on a rolling 30 to 90 day cycle
  • Why: Business continuity

Payment underwriting data. Bank account credentials, identity documents, and beneficial-owner information collected to underwrite Pay by Bank are held by Dutchie and its payment partners, not by Field Supply. Those parties retain such records for 7 years after account closure under federal know-your-customer and anti-money-laundering rules. Their retention is governed by their own policies.

Legal hold. If personal information is relevant to a pending or reasonably anticipated investigation, audit, regulatory inquiry, or legal claim, we will keep it until the matter is resolved, regardless of the schedule above.

10. How we delete data

When a retention period ends, or when we fulfill a verified deletion request:

  • Production erasure. The data is permanently deleted or de-identified in our production systems, marketing tools, and connected customer records within 45 days.

  • De-identification. Where we keep statistics for business analysis, we strip all direct and indirect identifiers first. We publicly commit not to re-identify de-identified data, and we contractually require anyone who receives it from us to make the same commitment.

  • Backups. Copies in encrypted backup systems are isolated and overwritten on a rolling 30 to 90 day cycle. Backup data is not restored to production except to recover from a system failure, in which case deletion is re-applied.

  • Secure disposal. Electronic records are purged using methods consistent with NIST SP 800-88 media sanitization guidelines.

11. Your privacy rights

If you are a Delaware resident, the DPDPA gives you the right to:

  • Confirm whether we are processing your personal data and access that data.

  • Correct inaccurate personal data.

  • Delete personal data we hold about you, subject to the legal retention requirements in Section 9.

  • Obtain a copy of your personal data in a portable, readily usable format.

  • Opt out of targeted advertising, the sale of personal data (which we do not do), and profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

  • Obtain a list of the categories of third parties to which we have disclosed your personal data.

How to exercise your rights. Use the Privacy Choices link in the app or on our website, email privacy@thefieldsupply.com, or write to us at the address in Section 19. We may ask you to verify your identity, usually by confirming details on your account. You may designate an authorized agent to submit an opt-out request on your behalf. We will respond within 45 days of receiving your request. If we need more time, we will tell you why and may extend once by an additional 45 days.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@thefieldsupply.com with "Appeal" in the subject line. We will respond within 60 days. If your appeal is denied, you may contact the Delaware Department of Justice, Consumer Protection Unit, at attorneygeneral.delaware.gov.

No discrimination. We will not deny you service, charge you a different price, or provide a different level of service because you exercised your privacy rights, except where a difference is reasonably related to the value you receive from a loyalty program you voluntarily joined.

Residents of other states with similar privacy laws may exercise the rights those laws provide using the same methods.

12. Deleting your account

You can delete your Field Supply account and the personal data associated with it at any time:

  • In the app: open Profile > Settings > Delete Account and follow the prompts.

  • On the web: visit https://dutchie.com/account, sign in, and select Delete Account. You do not need to reinstall the app to use this option.

  • By email: send a request from the email address on your account to privacy@thefieldsupply.com.

When you delete your account we permanently remove your profile, contact details, loyalty balance, marketing preferences, device and push data, and advertising profile from our production systems within 45 days. Deletion is permanent and cannot be undone; any unused loyalty rewards are forfeited. We do not merely deactivate or freeze accounts.

What we must keep. Delaware cannabis regulations and tax law require us to retain records of completed sales for 5 years and tax and financial records for 7 years, as shown in Section 9. These records are kept in restricted systems, are not used for marketing, and are deleted when those periods end. We may also keep information needed to prevent fraud, enforce our terms, or comply with a legal hold.

13. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, access controls limited to staff who need the data to do their jobs, logging and monitoring, and staff training. Our platform provider, Dutchie, maintains annual SOC 2 Type II and SOC 1 audit reports and HIPAA-aligned security controls covering the systems that store your data. No system is completely secure, and we cannot guarantee the security of your information. Keep your password confidential; Field Supply will never contact you to ask for it.

14. Data breach notification

If we discover a breach of security involving your personal information, we will investigate, take steps to contain it, and notify you and, where required, the Delaware Attorney General without unreasonable delay and no later than 60 days after we determine a breach occurred, as required by the Delaware Computer Security Breaches law (6 Del. C. ch. 12B).

15. Third-party links and services

The Services may contain links to third-party websites, apps, or services, including social media and map applications. This Policy does not cover them, and we are not responsible for their privacy practices. Please read their privacy policies.

16. United States only

The Services are intended for use in the United States, and specifically for customers who will pick up products at our Delaware store. Your information is stored and processed in the United States. If you access the Services from outside the United States, you do so at your own risk and consent to the transfer of your information to the United States and the application of U.S. law.

17. Children

The Services are not directed to anyone under 21. We do not knowingly collect personal information from children under 13 or from anyone under 21. If you believe a person under 21 has provided us with personal information, contact us and we will delete it.

18. Changes to this Policy

We may update this Policy from time to time. The dates at the top show when this Policy first took effect and when it was last updated. If we make material changes, we will notify you by email or through a notice in the app or on our website before the changes take effect. Continued use of the Services after the effective date of a revised Policy means the revised Policy applies to you.

19. Contact us

To exercise your privacy rights, ask a question, or file a complaint:

Email: privacy@thefieldsupply.com | General: info@thefieldsupply.com

Mail: Field Supply Cannabis & Provisions, Attn: Privacy, 4023 Kennett Pike, No. 302, Greenville, Delaware 19807

Store: Field Supply Cannabis & Provisions, 4543 Kirkwood Highway, Wilmington, Delaware