Privacy Policy

2. Information you give us

• Account details — your name, email address, and password or social sign-in, handled by our authentication provider, Clerk. Your password is never stored by us and never visible to us.
• Membership and payment details — the plan you choose, billing status, renewal dates, and the last four digits and brand of your card. Full card numbers go directly to Stripe and never reach our servers.
• Donations — the amount, frequency, the name you give, and any message or dedication you attach.
• Ticket, event, and space-rental bookings — who is attending, contact details, dates, party size, and any access or dietary notes you choose to share.
• Shop and print orders — the items ordered, your shipping address, and order history.
• Forms you submit — contact enquiries, volunteer applications, artifact and document donation offers, research requests, and feedback on archive records.
• Member wall entries — if — and only if — you opt in, the display name and profile photo you choose are shown publicly. You can turn this off at any time.
• Newsletter subscriptions — your email address, and whether you opened or clicked a message we sent.

3. Information collected automatically

When you use the site, our hosting and analytics providers record technical information about the visit. We use it to keep the site working, to detect abuse, and to understand which pages and exhibits people find useful.

• IP address, approximate location derived from it, and internet service provider.
• Browser, operating system, device type, screen size, and language.
• Pages viewed, referring page, search terms used on the site, time on page, and links clicked.
• Dates and times of requests, error and performance diagnostics, and security logs.
• Identifiers stored in cookies or similar technologies, described in the next section.

4. Cookies, analytics, and similar technologies

Cookies are small files stored by your browser. We use them in three categories, and you can control the last two.

• Strictly necessary — sign-in and session cookies set by Clerk, checkout and fraud-prevention cookies set by Stripe, your cart, and security tokens. The site cannot function without these, so they are not optional.
• Analytics — Google Analytics 4 cookies and identifiers, used to measure traffic, referral sources, and which pages perform. We configure it to measure the site, not to build profiles of individuals.
• Advertising and measurement — Google Ads cookies and conversion tags, used to measure whether an ad led to a visit, a membership, a ticket, or a donation, and to show museum ads to people who have visited the site.

You can clear or block cookies in your browser settings, though blocking the strictly necessary ones will break sign-in and checkout. You can opt out of Google Analytics across all sites with Google's browser add-on at tools.google.com/dlpage/gaoptout, and manage ad personalisation at myadcenter.google.com. Where the law requires it, we ask for your consent before setting analytics or advertising cookies, and we honour Global Privacy Control signals as a request to opt out of targeted advertising.

5. Advertising and measurement

We advertise the museum, its exhibits, and its programming through Google Ads and similar platforms. Those platforms may use cookies and device identifiers to show you our ads on other sites and to tell us, in aggregate, how many people who saw an ad went on to visit, buy a ticket, join, or donate.

We may upload a hashed version of an email address to an advertising platform to build or exclude an audience — for example, to stop showing membership ads to people who are already members. We never sell your personal information, and we never share the contents of an archive search, a donation amount, or a membership tier with an advertising platform.

Under some state laws, using advertising cookies counts as "sharing" personal information for cross-context behavioural advertising. You can opt out at any time using the controls in the previous section or by emailing us.

6. How we use your information

• Create and secure your account, and keep you signed in.
• Process memberships, donations, tickets, rentals, and shop orders, and send you receipts and confirmations.
• Provide member benefits, including admission, discounts, and archive access.
• Answer enquiries, process volunteer applications, and evaluate offers of artifacts and documents.
• Send service email you cannot opt out of while you hold an account — renewal notices, receipts, security alerts, and changes to these policies.
• Send the newsletter and event announcements, which you can unsubscribe from at any time.
• Operate, debug, and improve the site and the archive, and measure which programming reaches people.
• Advertise the museum, and measure whether that advertising works.
• Prevent fraud and abuse, enforce our terms, and comply with legal, tax, and accounting obligations.

7. Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases: performance of a contract, for memberships, orders, and bookings; consent, for the newsletter, the member wall, and non-essential cookies, which you may withdraw at any time; legitimate interests, for site security, fraud prevention, measurement, and improving what we offer; and legal obligation, for tax, accounting, and record-keeping duties.

8. Who processes your information

We do not sell your personal information. We share it only with the service providers below, who process it on our instructions, and where the law requires disclosure.

• Clerk — accounts, sign-in, and session security.
• Stripe — payments, subscriptions, refunds, and the billing portal. Stripe is PCI-DSS certified and is the only party that handles your full card number.
• Resend — delivery of transactional email and the newsletter.
• Vercel — website hosting, edge delivery, request logs, and file storage.
• Neon — the managed Postgres database where museum records are stored.
• Google — analytics, advertising, conversion measurement, and maps.
• Shipping and print partners — fulfilment of shop and print orders, limited to the details needed to deliver them.
• Professional advisers and authorities — accountants, auditors, and lawyers where necessary, and law enforcement or regulators where we are legally required to respond or must protect someone's safety.
• A successor organisation — if the museum merges with, or transfers its collection and operations to, another institution, records may transfer with it under this policy.

9. Information you make public

The member wall and any donation recognition are public by choice, never by default. If you opt in, the display name and photo you select can be seen and indexed by anyone, including search engines. You can withdraw at any time from your membership settings, and we will remove the entry — though copies may persist in search engine caches or archives outside our control until they refresh.

10. How long we keep it

• Account records: while your account is open, and up to 24 months after it closes.
• Payment, donation, and order records: at least 7 years, because tax and accounting law requires it.
• Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again by mistake.
• Form submissions and enquiries: up to 3 years, so we can pick up a conversation where it left off.
• Volunteer applications: up to 2 years unless you ask us to delete them sooner.
• Analytics and advertising data: as configured in Google Analytics, up to 14 months for event-level data.
• Security and server logs: up to 12 months.

11. How we protect it

The site is served entirely over HTTPS. Passwords are handled by Clerk and never stored by us. Card numbers are handled by Stripe and never stored by us. Access to museum records is limited to staff and volunteers who need it, and administrative actions are logged. No system is perfectly secure, so we cannot guarantee absolute security — but if a breach affects your information, we will notify you and the relevant authorities as the law requires.

12. Your rights and choices

Wherever you live, you can ask us to show you the personal information we hold about you, correct it, delete it, or send you a copy. You can unsubscribe from marketing email using the link in any message, and change your member wall setting yourself at any time.

If you are a California resident, you have the right to know what we collect and disclose, to delete it, to correct it, to opt out of sharing it for cross-context behavioural advertising, to limit the use of sensitive information, and not to be discriminated against for exercising any of these rights. We do not sell personal information, and we do not knowingly collect or share the information of anyone under 16 for advertising.

If you are in the European Economic Area or the United Kingdom, you additionally have the right to object to processing based on legitimate interests, to restrict processing, to withdraw consent, and to lodge a complaint with your local supervisory authority.

To exercise any of these, email info@cannabismuseum.com from the address on your account, or write to us at 16050 Canaanville Hills Road, Athens, OH 45701, United States. We respond within 45 days, and will tell you if we need longer. We may need to verify your identity first, and an authorised agent must provide written proof that they act for you.

13. Children

The site is not directed at children under 13, and we do not knowingly collect their personal information. Tickets and memberships for children are bought by an adult. If you believe a child has given us information, email us and we will delete it.

The museum documents the history of cannabis for research and education. It does not sell cannabis or cannabis products, and nothing on this site is directed at minors as a consumer audience.

14. International transfers

The museum and its records are in the United States. If you use the site from elsewhere, your information is transferred to and processed in the United States, where privacy law differs from your own. Where a transfer is from the European Economic Area or the United Kingdom, our providers rely on the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.

15. Links to other sites

The site links to external resources, partner institutions, ticketing pages, and social media. Those sites have their own privacy policies, and we are not responsible for their practices. Read them before giving them information.

16. Changes to this policy

We update this policy when our practices or the services behind them change. The date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or by a notice on the site before it takes effect.

17. Contact us

The Cannabis Museum · 16050 Canaanville Hills Road, Athens, OH 45701, United States · info@cannabismuseum.com · +1 (740) 331-4558