Privacy Policy

BurlingtonDispensaries.com ("we," "our," "the site") is an independent cannabis directory for Vermont. This page explains — in plain English — what information we collect, why, and how you can control it.

1. What we collect

We collect only the minimum we need to run a useful directory:

Aggregate traffic analytics via Cloudflare Web Analytics (a privacy-friendly, cookie-less service) and Google Analytics 4. We run GA4 with IP anonymization on and Google Signals / ad-personalization off, so it measures page views, referrers, and coarse geography for aggregate reporting — it is not used for advertising or cross-site ad targeting. GA4 does set a first-party analytics cookie (see the Cookies section below).
Newsletter signup — if you submit your email to "The Drop" signup in the footer, we store that email address (and the timestamp / coarse request metadata) in Cloudflare KV storage so we can email you. Nothing else.
Contact / form submissions — if you email us or fill out a contact form, we keep that message to respond to you.
Server logs — Cloudflare, our hosting provider, keeps short-lived request logs (IP, user agent, timestamp) for security and abuse prevention. We do not receive a copy of these logs for analytics.

2. What we do NOT collect

We do not sell your data. Ever.
We do not share your email with dispensaries, advertisers, or data brokers.
We do not set advertising cookies or run third-party ad networks.
We do not track you across the web.

3. How we use your info

Aggregate analytics — to see which pages are useful and fix what isn't.
Newsletter — to send you "The Drop," a weekly Vermont cannabis roundup. Every email includes a one-click unsubscribe link.
Support — to respond to messages you send us.

4. Sub-processors

We use a small number of third-party services ("sub-processors") to operate the site. They act on our behalf, under contract:

Cloudflare — hosting (Cloudflare Pages), DNS, CDN, Web Analytics, and KV storage for newsletter subscribers.
Google Analytics — aggregate traffic measurement (GA4), configured with IP anonymization and ad-personalization disabled.
If/when we send a welcome email, we may use an email-sending provider such as Resend or Cloudflare Email Workers. No mail has been sent on your behalf outside this narrow purpose.

5. Cookies

We do not set advertising cookies. Google Analytics sets a first-party analytics cookie (_ga) to count returning vs. new visitors in aggregate; it is not shared with ad networks and, with Google Signals disabled, is not used to track you across sites. Cloudflare may also set a short-lived, security-only cookie (__cf_bm) for bot management on some requests, which expires within 30 minutes of inactivity.

6. Your rights

You can, at any time:

Unsubscribe from the newsletter via the link at the bottom of any email, or by emailing us.
Request deletion of any personal data we hold about you (your email address is typically the only thing). Email [email protected] with the subject "Delete my data" and we will erase your record within 14 days.
Request a copy of the data we hold on you.

7. Children

This site is intended for adults 21 years of age or older. We do not knowingly collect information from anyone under 21. If you believe a minor has submitted information, email us and we will delete it.

8. Security

Data is stored on Cloudflare's infrastructure in encrypted form in transit (HTTPS) and at rest. No system is perfectly secure; we will notify affected users of any material data incident without undue delay.

9. Changes

We may update this policy occasionally. The "Last updated" date at the top will change when we do. Material changes will also be flagged in the newsletter.

10. Contact

Questions, requests, or corrections: [email protected]