Privacy Policy

Information you give us: name, shipping and billing address, email, phone number, order contents, provider or wholesale application details, and any message you send to support.

Information collected automatically: IP address, browser and device type, pages viewed, and referring page. This is used to keep the site secure and to understand which educational pages people find useful.

Payment information: card details are entered on our payment processor's hosted checkout. Blue Key CBD never receives or stores full card numbers.

To process, ship, and support your order, including age verification where required by law.

To respond to support, certificate of analysis, provider, and wholesale requests.

To send order updates. Marketing email is only sent if you opt in, and every message includes an unsubscribe link.

To meet legal, tax, and hemp-product recordkeeping obligations.

We do not sell your personal information.

We share only what is necessary with service providers who work on our behalf: our commerce and checkout platform, payment processor, shipping carriers, and email provider.

We may disclose information when required by law, subpoena, or a regulatory request, or to protect the rights and safety of our customers and staff.

We use strictly necessary cookies to keep your cart and signed-in session working, plus limited analytics to measure page performance.

You can block or delete cookies in your browser settings. Blocking necessary cookies may break the cart and account areas.

Order and tax records are kept as long as required by law, generally seven years. Support messages are kept for two years. Account data is kept until you ask us to delete it.

You can ask us to access, correct, export, or delete the personal information we hold about you, and to stop marketing email at any time.

Email privacy@bluekeycbd.com with your request. We verify identity before acting and respond within 45 days.

We do not knowingly collect information from anyone under 18. Our products are sold only to adults 18 and older.

The site is served over HTTPS, checkout is handled by a PCI-compliant processor, and access to customer records is limited to staff who need it.

No system is perfectly secure. If a breach affects your information, we will notify you as required by Missouri and federal law.

When this policy changes we update the effective date below and, for material changes, post a notice on this page for 30 days.