Privacy Policy

A.The Short Version

• We collect what is needed to legally and safely ship a vape device to a verified 21+ adult in the United States.
• We do not sell, rent, or share your data with third parties for marketing. We have not in the past and have no intention to.
• Three external parties touch your order data: the payment processor, the age-verification vendor, and the shipping carrier. Each has its own privacy terms governing what it does with that data.
• You can ask us to access, correct, delete, or export your data at any time — email service@raz-vape.com. We respond within 30 days.
• If you are under 21, this store is not for you and we cannot legally fulfill an order — age check happens at placement and again at delivery.

B.Your Data from Checkout to Deletion

When you place an order, we collect:

• Identity — first and last name (matched against the age-verification check).
• Shipping address — used by the carrier to deliver the package.
• Email and phone — for order confirmations, shipping updates, and warranty contact.
• Billing details — handled by the payment processor; we see the last 4 digits of the card and the transaction ID, not the full card number.
• Age-verification signal — a pass/fail token from the age-verification vendor, plus the date of birth used to run the check. The vendor handles the underlying identity-document check.
• Site analytics — page visits, device type, referring source. Used to understand what is breaking on the site, never linked to your identity for cross-site tracking.

We keep order records as long as US tax law requires (currently 7 years). Age-verification compliance logs are kept under their own retention rule. Everything else (analytics, marketing email subscription) we delete on request without waiting for a retention period.

C.What We Commit to Never Doing

• We never sell your data. Not to advertisers, not to data brokers, not to anyone. This is a hard line.
• We never share your data for marketing purposes. If you get a marketing email from another vape brand, it did not come through us.
• We never use your data to retarget you across other sites. No Facebook pixel matching, no programmatic ad audiences built on your purchase data.
• We never share order details with law enforcement without a valid US legal process (subpoena, warrant, court order). Federal regulatory cooperation under PACT Act reporting is the one exception built into US law — when we are required to report disposable-vape sales to a state tobacco-tax authority, we comply with the minimum data required.

D.The Only Third Parties That Touch Your Data

• Payment processor. Handles the credit-card or other payment transaction. Receives your billing details and order amount. Does not receive what you bought (no product-level transmission). Has its own PCI-compliant privacy and security terms.
• Age-verification vendor. Receives your name, date of birth, and (where required) an identity-document image to confirm you are 21+. Returns a pass/fail signal to us. Their retention of the underlying data is governed by their own privacy terms.
• Shipping carrier. Receives the shipping address, your name, and the package weight/dimensions. Used for delivery and signature collection.

That is the complete list. No fourth party, no data broker, no analytics-overlay vendor that gets identity-level data. Aggregate, anonymized site analytics goes through a privacy-respecting analytics provider that does not match data to individuals.

E.How We Lock It Down — Encryption + Storage

Data in transit is encrypted with TLS 1.2 or higher — every page on this site, including the checkout flow, runs on HTTPS. Data at rest in our order database is encrypted using AES-256. Payment card details are never stored on our infrastructure; the payment processor handles tokenization. Access to the order database is restricted to authorized RAZ Vape direct-store staff (the Pomona warehouse fulfillment team and the customer service team) with multi-factor authentication.

If a breach happens that affects your personally identifiable information, we notify affected customers and the relevant regulators per US state breach-notification laws (each state has its own timeline; we follow the strictest applicable). No breach has occurred as of this policy's date.

F.Cookies — Plain English

This site uses cookies for three purposes only:

• Cart and login cookies. Required for the site to work — without these, your cart loses its contents on every page navigation, and you cannot stay logged into the My Account area.
• Age-verification cookie. Once you confirm 21+ on first visit, a cookie remembers it so you do not get the prompt every page.
• Aggregate analytics cookie. Anonymous page-visit tracking. No identity-level data.

We do not use advertising or cross-site tracking cookies. If your browser has Do Not Track set, the analytics cookie does not load.

G.Your Data, Your Call (CCPA / GDPR Rights)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what data we have, request deletion, request a copy in portable format, and opt out of any data sale. We do not sell data, so the opt-out is automatic. The other rights you can invoke by emailing service@raz-vape.com from the email address on file. We respond within 30 days. We do not charge for these requests.

If you are a visitor from the EU or UK, GDPR gives you the same set of rights (Access, Rectification, Erasure, Portability, Restriction of Processing, Objection). We do not actively ship to EU addresses, but if you have placed an order or have an account, you can invoke these rights by the same email path. Our lawful basis for processing is contract (your order) and legal obligation (US age-verification compliance).

If you are in any other US state with a comprehensive privacy law (Colorado CPA, Virginia CDPA, Connecticut CTDPA, Utah UCPA, and others as they pass), those rights apply through the same email channel.

H.Under 21? This Store Isn't for You

Federal law (the Tobacco 21 Act) sets the minimum age to purchase nicotine vape products at 21 across all 50 US states, US territories, and Washington DC. There is no state-level exception. Our age verification runs at order placement (date-of-birth + identity check) and again at delivery (carrier-collected adult signature where required). Orders that fail age verification are canceled and refunded automatically; we do not retain identity data from canceled-under-21 orders beyond what compliance log retention requires.

If you are under 21 and submitted personal data to us by mistake, contact service@raz-vape.com with the email used at order placement and we will delete the submitted data on the legal earliest date.

9..Other Things Worth Knowing

• Policy changes. When we update this policy, the effective date at the top of the page changes and we email all customers on file with a short summary. Continued use of the site after a policy update constitutes acceptance.
• Children's data. This site is not intended for users under 21. We do not knowingly collect data from minors. If you believe a minor has submitted data, contact us — we delete on confirmation.
• International transfer. Order data is processed and stored in the United States. By placing an order, you consent to the transfer of your data to the US for processing.
• Dispute resolution. Privacy disputes go through US courts, with venue in San Bernardino County, California (where the Pomona warehouse is located). State Attorneys General have parallel jurisdiction for CCPA / state-privacy violations.

10..Privacy Policy FAQ