Privacy Policy

Effective Date: May 5, 2026
Last Updated: May 5, 2026

1. About This Policy

Fernway Holdings LLC (“Fernway”, “we”, “us”, or “our”) respects your privacy. This Privacy Policy explains what personal information we collect when you visit fernway.com (the “Site”) or interact with our marketing emails, our forms, our chat widget, our social media presence, or our products in licensed retail dispensaries, and what we do with that information.

This Privacy Policy applies to personal information we collect on or after the Effective Date above and to personal information we have previously collected about you.

This policy does not cover:

Job applications. When you apply for a role at Fernway, our careers privacy notice (powered by Pinpoint) governs that process.
Licensed dispensary purchases. When you buy a Fernway product at a dispensary, that dispensary is responsible for its own customer data; we are not a party to your purchase.
Third-party websites. Links from fernway.com to other sites are governed by those sites’ policies.

By using fernway.com, you agree to this policy.

2. Cannabis Compliance Notice

Fernway is a cannabis brand operating in licensed-cannabis states. Cannabis remains a Schedule I controlled substance under U.S. federal law and is legal only in certain states under state-specific regulatory regimes.

You must be 21 or older to use this Site. We use an age-verification gate to limit access. Do not use this Site if you are under 21.
We do not sell cannabis directly to consumers. Our products are sold only through licensed retailers in Massachusetts, New Jersey, New York, Illinois, and Missouri. Fernway is not the seller of record for any consumer cannabis transaction.
State regulators may receive reports about cannabis sales, marketing, and licensee operations as required by state law. We comply with those reporting obligations.

3. Information We Collect

3.1 Information You Provide

We collect information you give us directly, including:

Contact information when you fill out a form, sign up for our newsletter, contact our customer service team, or chat with us through our website (name, email, phone, mailing address, dispensary affiliation if applicable).
Communications you send to us by email, chat, social media, or any other means.
Event registrations when you sign up for an event we host or attend (such as budtender sessions, trade shows, or pop-ups).
Survey and feedback responses if you choose to share them.
Business information if you represent a licensed retailer, distributor, or partner, including license numbers, business addresses, and contacts.

3.2 Information Collected Automatically

When you visit the Site, we and our service providers automatically collect:

Device and browser information (user agent, operating system, screen size, language).
IP address and approximate geolocation derived from it (city, state, country).
Usage data (pages viewed, time on site, referring URL, search terms used on our Site, links clicked).
Cookies and similar technologies as described in Section 4.

3.3 Information from Third Parties

We may receive information from:

Dispensary partners (in aggregated, de-identified form for sell-through analytics through our data warehouse partners).
Marketing platforms (e.g., audience-matched marketing lists from advertising networks).
Public sources (business directories, regulatory filings, social media).

4. Cookies, Tracking Pixels, and Similar Technologies

We use cookies and similar technologies on fernway.com. As of the effective date of this policy, the Site uses the following:

Service	Purpose	Data captured	Provider
HubSpot	CRM, web analytics, embedded forms, live chat, marketing emails	Page views, IP address, cookie ID (`__hstc`, `__hssc`, `__hsfp`, `hubspotutk`), form submissions, chat messages	HubSpot, Inc.
Google Analytics 4	Site usage analytics	Page views, IP address (truncated), session identifiers, device data	Google LLC
Google Tag Manager	Tag management container	Loads other tags listed here	Google LLC
TikTok Pixel	Advertising attribution and audience building	Page views, IP address, cookie ID (`_ttp`), conversion events	TikTok Inc.
Gravity Forms / HubSpot Forms	Form submissions on the Site	Form field data, IP, timestamp	Rocketgenius / HubSpot
Cloudflare Turnstile (via Gravity Forms Turnstile)	Spam prevention on form submissions	IP address, browser challenge data	Cloudflare, Inc.
WP Rocket / Imagify	Site performance and image optimization	None for tracking purposes	WP Media
Cookie Consent (Complianz)	Records your cookie consent choices	Consent preferences	Complianz B.V.

Cookie consent banner. When you visit the Site, our cookie banner allows you to accept, reject, or selectively allow categories of cookies. Strictly necessary cookies (such as those required to render the Site, save your consent choice, and verify your age) are always set. All other cookies, including HubSpot analytics, Google Analytics, and TikTok, are blocked until you grant consent.

Do Not Track and Global Privacy Control. Our Site honors the Global Privacy Control (GPC) signal as a valid opt-out request under California, Colorado, Connecticut, and other state privacy laws. Browsers transmitting a GPC signal will be treated as having opted out of the sale or sharing of personal information. We do not currently respond to legacy “Do Not Track” headers, which the W3C deprecated.

5. Email Tracking

If you receive marketing or commercial emails from Fernway, those emails contain tracking technologies. Specifically:

Tracking pixels (1×1 transparent images embedded in the email) load when you open the email and report your IP address, the timestamp, and your email client’s user agent back to HubSpot.
Click tracking links rewrite outbound URLs through *.hubspotlinks.com so we can record which links you clicked, when, and from what IP address.

We use this information to measure email engagement and to improve our marketing. You can opt out by:

Clicking Unsubscribe at the bottom of any marketing email,
Configuring your email client to block remote images, or
Emailing us at info@fernway.com.

Transactional emails (order confirmations, customer-service replies, security notices) do not contain marketing tracking pixels.

6. How We Use Your Information

We use the information described above to:

Operate and improve fernway.com and our products.
Respond to your inquiries through our forms, chat widget, and email.
Send marketing communications to people who have opted in or who have an existing relationship with us.
Run our wholesale business with licensed dispensary partners.
Personalize content on the Site, in emails, and in advertising.
Measure and improve marketing campaigns, including through advertising platforms.
Detect and prevent fraud, abuse, and security incidents.
Comply with legal obligations, including cannabis regulatory reporting and tax obligations.

We do not engage in automated decision-making with legal or similarly significant effects on individuals.

7. How We Share Your Information

We do not sell your personal information for money. We share personal information only as follows:

Service providers acting under written contracts and processing data on our behalf, including HubSpot (CRM, marketing, chat), Google (analytics, productivity, hosting), TikTok (advertising), Pinpoint (recruitment), Cloudflare (security), Postmark and Site Mailer (transactional email), WordPress hosting providers, and our IT and operations vendors.
Dispensary and distribution partners to coordinate product sell-in, sell-through reporting, and field marketing programs. We share only the minimum information needed.
Advertising partners (such as Meta and TikTok). For California residents, sharing personal information with advertising partners for cross-context behavioral advertising may be considered a “sale” or “share” under the California Consumer Privacy Act and you have the right to opt out. See Section 8.
Professional advisors (lawyers, accountants, auditors) under confidentiality obligations.
Acquirers in connection with a corporate transaction (merger, acquisition, financing, or sale of assets), subject to confidentiality.
Government agencies and regulators when required by law, subpoena, court order, or to comply with state cannabis regulations.
To protect rights and safety of Fernway, our employees, our customers, or others.

8. Your Privacy Rights

8.1 Universal Rights

Regardless of where you live, you may:

Access the personal information we hold about you,
Correct information that is inaccurate,
Delete information we no longer need to retain,
Opt out of marketing emails by clicking unsubscribe in any marketing email,
Opt out of cookies and tracking through our cookie banner,
Object to our use of your information for direct marketing.

To exercise any of these rights, contact us at info@fernway.com or by mail at 178 Industrial Drive, Northampton, MA 01060. We will respond within 45 days (or sooner where required by law). We may need to verify your identity before completing your request.

8.2 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know what personal information we have collected, used, disclosed, and sold or shared in the prior 12 months.
Right to delete personal information we have collected from you, subject to exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. We do not sell your personal information for money. We do, however, share certain personal information with advertising partners (such as TikTok and Meta) for cross-context behavioral advertising, which is considered “sharing” under California law. To opt out, use the cookie banner, send a Global Privacy Control signal from your browser, or email info@fernway.com.
Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes beyond those permitted under California law without offering this right.
Right to non-discrimination for exercising any of these rights.

Authorized agents. You may designate an authorized agent to exercise your rights. We will require proof of authorization and verification of your identity.

Categories of personal information collected, sold, or shared. In the past 12 months, we have collected the categories of personal information described in Section 3 (identifiers, internet activity, geolocation, commercial information, professional information for B2B contacts, inferences). We have shared identifiers, internet activity, and geolocation with the advertising partners listed in Section 7 for cross-context behavioral advertising.

California “Shine the Light”. California Civil Code Section 1798.83 entitles California residents to request a list of third parties to whom we have disclosed personal information for those parties’ direct marketing purposes. We do not disclose personal information for third-party direct marketing.

Notice of Right to Opt Out under the California Invasion of Privacy Act (CIPA). Our Site uses tracking technologies (cookies, pixels, and similar technologies) that may, when enabled, capture metadata about your interactions with the Site and our marketing emails (such as IP addresses, timestamps, and pages visited). California residents have the right to opt out of this collection through our cookie banner and through a Global Privacy Control signal.

8.3 Other U.S. State Residents

Residents of states with comprehensive privacy laws, including but not limited to Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, generally have the rights described in Section 8.1, plus, depending on the state:

The right to opt out of “targeted advertising” or the “sale” of personal information (use our cookie banner, GPC signal, or email us).
The right to opt out of certain profiling.
The right to appeal a denial of any privacy request (email info@fernway.com with “Appeal” in the subject).

If you live in one of these states and we cannot resolve your concern, you may also contact your state attorney general.

8.4 European Union, United Kingdom, and Other Non-U.S. Residents

Fernway sells products only in U.S. states where we are licensed to do so. fernway.com is intended for a U.S. audience. If you are accessing the Site from outside the United States, you do so on your own initiative.

Where the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, or similar non-U.S. laws apply to our processing, you have additional rights including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your supervisory authority. Our lawful bases for processing are: consent (where required), legitimate interests (running our business, marketing to existing relationships, security), and contract performance (where you have a contractual relationship with us).

9. How Long We Keep Your Information

We retain personal information for as long as necessary to:

Provide the services you have requested,
Comply with legal obligations (tax, regulatory, recordkeeping; typically up to 7 years for financial records, longer where state cannabis regulations require),
Resolve disputes and enforce our agreements, and
Maintain reasonable business records.

When we no longer need personal information, we delete or de-identify it.

10. Children’s Privacy

fernway.com is intended only for adults aged 21 or older. We do not knowingly collect personal information from anyone under 21. Our age gate is intended to prevent access by minors.

If we learn that we have collected personal information from a person under 21, we will delete it. If you believe we have collected information from a child, please contact us at info@fernway.com.

11. Security

We use reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit, access controls, vendor security review, and employee training. No system is perfectly secure, however, and we cannot guarantee the security of any information you transmit to us.

If we discover a security incident affecting your personal information, we will notify you and applicable regulators in accordance with applicable law.

12. Third-Party Links and Services

The Site contains links to third-party websites and embedded third-party content (including social media platforms such as Facebook, Instagram, and TikTok, and embedded video and document viewers). We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing information to them.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the top of the policy and, where required by law, give you additional notice (such as an email or banner on the Site). Material changes will not take effect retroactively. Your continued use of the Site after a change indicates your acceptance of the updated policy.

14. Contact Us

For questions about this policy, to exercise any privacy right, or to report a concern:

Email: info@fernway.com
Mail: Fernway Holdings LLC, Attn: Privacy, 178 Industrial Drive, Northampton, MA 01060

If you have a disability and need this policy in an alternative format, contact us using the information above.