01
What we collect
When you visit luxuryleafstl.com we receive your IP address, browser user agent, timestamp, the pages you view, and the referring URL, in ordinary server and CDN request logs. When you clear the age gate we set one cookie recording that you confirmed you are 21 or older. When you choose Accept or Reject on the privacy banner we set one cookie recording that choice. When you place a Dutchie order we collect your delivery address, phone number, and ID verification, all handled by Dutchie under Dutchie's terms. When you email us we keep the message.
02
What we never collect
We do not collect Social Security numbers, medical history, or financial account credentials on this website. Cannabis purchase records are tracked under Missouri Department of Cannabis Regulation rules in the Metrc seed to sale system, which is separate from this site. We do not sell your personal information for money, and we do not hand customer lists to data brokers.
03
The two cookies this site sets
This website sets exactly two cookies of its own. ll_age_verified records that you confirmed you are 21 or older and lasts 30 days. ll_consent_v2 records your Accept or Reject choice so the banner stops asking, and lasts 180 days. We also keep a copy of that same consent choice in your browser local storage under the key ll_consent_v2. Neither cookie holds your name, your email, an advertising identifier, or any profile of you. Both are first party, meaning only luxuryleafstl.com can read them. Clearing cookies in your browser removes both, and the site will ask you to confirm your age again on the next visit.
04
Analytics: Google Analytics 4 through Google Tag Manager
Our analytics stack is Google Analytics 4, loaded through Google Tag Manager container GTM-5Z445G5K. Google Consent Mode v2 is set to denied by default in the page head, before the tag loads, for analytics storage, advertising storage, advertising user data, and ad personalization. In that denied state Google Analytics does not write its own cookies, although Google can still receive a cookieless signal that a page was viewed, with no identifier attached to you. If you press Accept, Google Analytics and Google Tag Manager write their own cookies and Google receives advertising signals from your visit. We do not run Vercel Analytics or any other analytics product on this site.
05
The Dutchie menu is a separate surface we do not control
Our menu and ordering run on Dutchie. Dutchie is mounted on this domain at luxuryleafstl.com/stores/luxury-leaf through a Cloudflare reverse proxy, so the cookies and scripts loaded there appear as first party cookies in your browser even though this website did not set them and cannot switch them off. In a July 2026 measurement of that surface we observed vendor scripts that included Terpli, AlpineIQ, Sift, and LaunchDarkly, plus a third party analytics pixel that performs device fingerprinting. That is what one measurement showed. Dutchie controls that list and it can change at any time without notice to us, so we do not publish a cookie count for it. For the authoritative and current list, read Dutchie's own privacy policy at dutchie.com.
06
What Accept and Reject actually do
Accept sets Google Consent Mode to granted, so Google Analytics and Google Tag Manager may set cookies and Google may receive advertising signals. Reject keeps the denied default in place for this browser and records that decision for 180 days. Being exact about the limits: Reject does not remove the 21+ age cookie, which age gating requires. Reject does not stop server and CDN request logs, which we need for security and abuse detection. Reject does not stop cookies on the Dutchie menu surface described in section 05, because that surface is outside this site's control. If you want to stop collection on the menu right now, use your browser cookie controls or a tracker blocking extension, and send your request to Dutchie directly.
07
Who we share with
Google receives analytics data and, if you press Accept, advertising signals, through the tag described above. Dutchie, our menu and order processor, sees your order details under Dutchie's privacy policy. Vercel, our hosting provider, sees server logs. Cloudflare, our CDN and reverse proxy, sees request logs. The Missouri Department of Cannabis Regulation sees what Metrc legally requires. Law enforcement only with a valid subpoena. We do not share your information with any third party not named here.
08
Your rights, including CCPA and CPRA
Email info@luxuryleafstl.com to request a copy of the data we hold about you, to ask us to delete it, or to correct an inaccuracy. We aim to respond within 30 days. Under the CCPA and CPRA you can also direct us not to sell or share your personal information. The immediate mechanism is the Reject button on the privacy banner, which stops the advertising signals this site controls. Because it does not reach the Dutchie menu surface, send a matching request to Dutchie as well. If you placed a Dutchie order, that request goes to Dutchie under Dutchie's privacy policy.
09
Children
This is a 21+ site. We do not knowingly collect data from anyone under 21. If you believe a minor has used this site, email info@luxuryleafstl.com and we will delete any associated records immediately.
10
Updates
This policy was last updated on 2026-07-28. Material changes will be posted at the top of this page. Continued use of the site after a change means you accept the updated terms. For questions, contact info@luxuryleafstl.com.
The menu and ordering surface at luxuryleafstl.com/stores/luxury-leaf is operated by Dutchie. Cookies and vendor scripts on that surface are governed by Dutchie's privacy policy, not by this one, and the Reject button on our privacy banner does not switch them off.
For California residents (CCPA and CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or other state-level privacy rights, email info@luxuryleafstl.com with the subject line “Data Rights Request.” We will route it to the right team within 24 hours. A request about the Dutchie menu surface at luxuryleafstl.com/stores/luxury-leaf also has to go to Dutchie, because we cannot action it on your behalf. Missouri-specific cannabis-data requests go through the Missouri Department of Cannabis Regulation.
