Privacy Statement

Last updated: March 19, 2026

Who We Are

We’re Curaleaf, Inc. (collectively, “Curaleaf”, “Company” or “us” or “we” or “our”), a leading cannabis company operating dispensaries and related services across multiple states within the U.S., currently including:  Arizona, Connecticut, Florida, Illinois, Maine, Maryland, Massachusetts, Nevada, New Jersey, New York, North Dakota, Ohio, Pennsylvania and Utah. Note, we may elect to conduct business in additional states and if you reside in those states or any other state, this Privacy Policy will still apply.

This privacy policy (“Privacy Policy”) describes how we collect, disclose, and use your personal information when using services on our websites, including, without limitation, curaleaf.com, ir.curaleaf.com, selectbetter.com, anthemcannabisusa.com, grassrootscannabis.com, findyourflower.com, hellojams.com, drinkzeroproof.com, askingforfriends.com, endlesscoastseltzer.com, reefflowerco.com, higherstitch.com, thehempcompany.com or any state subdomains of curaleaf.com (e.g. nd.curaleaf.com, ct.curaleaf.com), (collectively, the “Site”), use our mobile applications, shop at our dispensaries, join our loyalty program, or use related services (collectively, the “Products” and/or “Services”). “Terms” means our Terms and Conditions. “Personal information” or “personal data” means personally identifiable information, personal information, or personal data, as defined in applicable laws.

We may update this Privacy Policy over time. Any changes will be reflected by updating the date at the top of this Privacy Policy. The Company reserves the right in its sole discretion to amend this Privacy Policy at any time, and you should check this Privacy Policy periodically for any amendments.

This Privacy Policy applies only to our United States operations. For information about Curaleaf operations outside of the United States, including within the European Union, United Kingdom, Canada, or Switzerland, please refer to the Curaleaf International Privacy Notice at: www.curaleafinternational.com/privacy.

Section 1 – Personal Information We Collect:

Information You Give Us.

  • Newsletter/Email Waitlist. When you voluntarily provide us with your email address, we collect your email address from which your identity is or may be discernible.
  • Account Creation. If you establish an account on the Service, we may collect your name, email address, billing address, and other information to support your use of the Service.
  • Payment and Transactional Data. When you pay for use of certain areas or features of the Services, if applicable, our payment processor or the applicable app store collects the financial information required to process your payments, including name, payment card information, bank account number, billing information. In addition to this Privacy Policy and our Terms, information related to your payments or purchases is also processed according to such app store’s services agreement and privacy policy.
  • Information Related to Cannabis Purchases. When you make purchases at our dispensaries or online, we collect information required by state cannabis regulations, including verification of your age and eligibility to purchase adult-use or medical cannabis products, transaction details required for state tracking systems, and distinction between adult-use and medical purchases.
  • Support. If you send messages through our contact form, or provide information to our sales or support teams, we collect your name, email address, and other information to reasonably provide the support you have requested.
  • Social Networking Service Data. We have pages on social media sites like our Facebook, Instagram, X (Twitter), TikTok or LinkedIn profiles (“Social Media Pages”). When you interact with our Social Media Pages, we will collect personal data that you elect to provide to us, such as your contact details. In addition, the companies that host our Social Media Pages may provide us with aggregate information and analytics regarding the use of our Social Media Pages.
  • Telephone Number/SMS Message. When you voluntarily provide us with your telephone number and/or opt into our SMS messaging system, we collect your telephone number from which your identity is or may be discernible.
  • Single Sign-On. If you access the Services or create an account using a third-party service, such as a social networking service like Meta or Google, we will collect personal information that you elect to provide to us, such as your name and contact details.
  • Surveys and User Research. We may send you surveys or contact you with questions to provide us with feedback on our Service. We collect any responses that you provide. Participation in surveys or research tasks is elective and does not affect your access to the Service.
  • Sweepstakes, Contests or Other Promotions. When you participate in or win a sweepstakes, contest, or other promotion we may collect personal information, including contact or tax information if required by law.

Information Automatically Collected. When you visit our Site, we automatically collect certain information through cookies, web beacons, pixels, tags, and similar technologies. This information may include identifiers such as:

  • Your IP address (which may indicate your general location)
  • Device and browser information (operating system, browser type and language)
  • How you interact with our Site (pages visited, time spent, referring website)
  • Your preferences and settings

Cookies are small data files stored on your device that help us remember your preferences, understand how you use our Site, and improve your experience. We and our trusted third-party service providers use cookies to analyze site traffic and enhance our Services.

To the extent that the cookies and web beacons we use to track your interaction with the Site, Products, or Services, customize our Site, Products, or Services for you, and to collect certain information and data related to your use of the Site, Products, or Services, as set forth in this Privacy Policy above, are deemed to be “pen registers” under Section 638.51 of the California Invasion of Privacy Act, by agreeing to this Privacy Policy and using the Site, Products, or Services, you provide us with consent to use such cookies and web beacons.

For more details about the cookies and similar technologies we use and how to manage your preferences, please see our Cookie Policy.

Information from Third-Parties. We may receive information about you from third parties, including analytics providers, advertising networks, social media platforms, service providers who assist us in operating our business, from app stores from which you download certain portions of the Site, your employer or organization, business contacts, friends and other third-parties, such as when they submit information to us about you or when they post content on the Site. Additionally, we may supplement the information we collect with records from third-parties for a variety of purposes, including to help us correct or supplement our records, enhance our ability to serve you, to help prevent or detect fraud, to tailor our content and ads to you, and to offer you opportunities that may be of interest to you.

To the extent we combine information we receive from those sources with your personal data, the combined information will be treated as personal data under this Privacy Policy, unless we have disclosed otherwise. In no other circumstances will this Privacy Policy apply to information we receive about you from third parties.

Location Information. Our Site, including mobile applications, may request access to your device’s location to help identify nearby dispensaries. Where you choose to enable this feature, your location is processed locally within your browser or device solely to display the nearest dispensary location. Curaleaf does not store or otherwise collect this location data through this feature. Where required by law, we obtain your consent before accessing precise geolocation information.

Do Not Track Signals. We do not currently take actions to respond to “Do Not Track” (DNT) signals because a uniform technological standard has not yet been developed. We continue to review new technologies and may adopt a DNT standard once one is created. For information about DNT, please visit: www.allaboutdnt.org.

Information About Children. The Site, Products, and Services are intended for the use of users who are at least 18 years of age. The Site, Products, and Services are not directed to persons under the age of 18. We do not knowingly collect or solicit information from, market to or accept services from persons under the age of 18 years old. If we become aware that a person under the age of 18 has provided us with personal information, we will take steps to remove such personal information. Please advise us if you believe we have collected information about someone under the age of 18 years old by contacting us at legal@curaleaf.com.

Section 2 – How We Use Personal Information:

We use the information we collect primarily to provide, maintain, protect and improve our Site, Products and Services, and to improve features. We use personal information collected through our Site and/or when providing you with our Products and Services as described in this Policy to:

  • Create and secure your account and identify you as a user in our system;
  • Improve our Products, Site, Services and business;
  • Understand and enhance your experience with us;
  • Facilitate your order and deliver the Products you request;
  • Verify your age and eligibility to purchase cannabis products in compliance with state laws;
  • Validate medical marijuana patient status and ensure appropriate product access;
  • Manage and administer loyalty program benefits and rewards;
  • Comply with state cannabis tracking and reporting requirements;
  • Process wholesale orders for our B2B customers;
  • Maintain separate records for recreational versus medical cannabis purchases as required by law;
  • Respond to your comments or questions and provide Products and Services;
  • Respond to investor relations inquiries and provide communications on investor-related matters;
  • Send you information, including confirmations, invoices, updates, support and other messages;
  • Communicate with you about promotions, upcoming events and news about Products and Services, and for other marketing purposes;
  • Link or combine your information with other information we get from third parties to help understand your needs and provide you with better service;
  • Protect, investigate and deter against fraudulent, unauthorized or illegal activity;
  • Transfer your information to new owners if our Company is acquired or merged so that we may continue to sell Products and provide Services to you; and
  • For any additional purposes for which we have obtained your consent to the use or disclosure of your personal information.

Where required by law, we obtain your consent before collecting or using certain types of information, including sensitive information or information used for marketing or advertising purposes.

If you provide your email address, we may send you updates, offers, and information about our Products and Services in accordance with applicable law. You may opt out of marketing emails at any time by clicking the “Unsubscribe” link included in our emails or by contacting us at legal@curaleaf.com.

Please note that even if you opt out of marketing communications, we may still send you transactional or service-related messages (such as order confirmations or account notices).

How to Withdraw Your Consent?

Where we rely on your consent, you may withdraw it at any time by following the instructions provided at the point of collection, adjusting your preferences (where available), clicking “Unsubscribe” in marketing emails, or contacting us at legal@curaleaf.com or mailing us at:

Curaleaf, Inc.
290 Harbor Drive
Stamford, CT 06902

Withdrawing consent will not affect processing that occurred before your request and may limit our ability to provide certain services where the information is necessary.

How Long We Keep Your Information

We retain your personal information only for as long as reasonably necessary for the collection purposes described in this Privacy Policy, unless a longer retention period is required by law.

Section 3 – Disclosure of Personal Information:

Because we operate in multiple states within the U.S., your information may be used and stored in a different state from where it was collected. While we do not sell your personal information for monetary compensation, we may share it with our partners and third parties to support our own operational purposes in providing Services to you. In certain circumstances, these disclosures may constitute a “sale” or processing for targeted advertising under applicable state privacy laws.

We may also disclose personal information as required to comply with applicable laws, regulations, court orders, subpoenas, or other legal processes. Further details regarding these disclosures are provided below.

Sharing of Information

We may share personal information in accordance with applicable law and consistent with generally accepted industry standards, as described below.

  • Service Providers and Contractors. We share personal information with vendors, service providers, contractors, and agents who perform services on our behalf, such as payment processing, order fulfillment, IT and hosting support, analytics, marketing services, compliance support, and professional advisory services. These third parties are contractually required to use personal information solely to provide services to us, maintain its confidentiality, and implement appropriate technical and organizational safeguards consistent with applicable privacy and security laws. They are not permitted to use personal information for their own independent purposes except as required by law.
  • Advertising and Analytics Partners. We may share certain identifiers, device information, and browsing data with advertising networks and analytics providers to support functions such as cross-context behavioral advertising, performance measurement, and site optimization. While we do not sell personal information for monetary compensation, certain disclosures to advertising and analytics partners may constitute a “sale” or “sharing” under applicable state privacy laws. Where required, you may exercise your right to opt out of such sale or sharing as described in the “Your Privacy Rights” section below.
  • Affiliates and Corporate Family. We may share personal information with our parent company, subsidiaries, and other entities under common ownership or control for purposes consistent with this Privacy Policy, including business operations, compliance, and internal administration.
  • Business Transactions. We may disclose personal information in connection with, or during negotiations of, a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or other corporate transactions. In such cases, personal information may be transferred as a business asset, subject to applicable legal protections.
  • Legal, Regulatory, and Compliance Obligations. We may disclose personal information to comply with applicable laws, regulations, legal processes, or governmental requests, including state cannabis regulations that require reporting transaction data to state tracking systems and regulatory agencies. We may also share information to enforce our agreements, policies, and terms; to detect, prevent, or address fraud, security, or technical issues; and to protect the rights, property, or safety of the Company, our employees, customers, or others.
  • Marketing at Your Direction. Where you provide consent or opt in, we may share personal information with third parties, partners, or affiliated brands for their own marketing purposes. Any such use will be governed by the third party’s privacy policy. You may withdraw your consent at any time where required by law.
  • External Websites and Third-Party Services. Our website may contain links to third-party websites, including payment processors or other service providers. When you navigate to a third-party site, you are subject to that party’s privacy policy and terms. We encourage you to review their privacy practices before providing personal information.
  • Emergency and Protection Purposes. We may disclose personal information when necessary to respond to an emergency, protect the safety of any person, or safeguard the integrity of our systems and operations.

We do not disclose personal information to third parties except as described above or as otherwise permitted or required by applicable law.

Section 4 – How We Secure Your Information:

We take the security of your personal information seriously and use reasonable administrative, technical and physical measures to protect it from unauthorized access, use, disclosure, or alteration. While no system is completely secure, we follow generally accepted security standards and respond promptly to potential incidents.

Wherever we or a trusted third-party service collects sensitive information (such as credit card data), that information is encrypted and transmitted in a secure way. You can verify this by looking for a closed lock icon at the bottom of your web browser or looking for “https” at the beginning of the address of the web page. When you make a purchase at our store with a credit card, the information is encrypted using Transport Layer Security technology (TLS) and stored with AES-256 encryption. We follow all PCI-DSS requirements and implement additional generally accepted industry standards.

Section 5 – Your Privacy Rights:

We operate across multiple states and comply with applicable state privacy laws. Several states where we operate have enacted comprehensive privacy laws granting residents specific rights regarding their personal information.

Depending on your state of residence and where we operate, you may have  rights under that state’s privacy laws. In addition, medical marijuana patients may have extra privacy protections under state medical cannabis laws and certain health privacy regulations.

These rights may include:

Right to Know: You can request that we disclose the categories and specific pieces of personal information we have collected, used, disclosed, sold, or shared in the past 12 months, the sources of that information, the business or commercial purposes for its collection, and the categories of third parties with whom it was shared.

Right to Access: You can ask for a copy of your personal information.

Right to Delete: You can ask us to delete personal information we collected and retained, subject to legal exceptions.

Right to Correct: You can request that we correct inaccurate personal information.

Right to Opt Out: You can opt out of the sale or sharing of your personal information for targeted or cross-context behavioral advertising. You may exercise this right, where available, by clicking the “Do Not Sell or Share my personal information” link in the footer of our website or by adjusting your preferences in our Cookie Settings tool. If you are a resident of Maryland, Connecticut, Utah or New Jersey you may also have the right to opt out of: the sale of your personal information, processing of your personal information for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Right to Data Portability: You may request a copy of the personal information you have provided to us in a portable and readily usable format, so you can transfer it to another provider.

Additional California Rights: Separate from the CCPA and CPRA, California’s Shine the Light law (California Civil Code Section 1798.83) gives California residents the right to ask companies what personal information (as that term is defined in Section 1798.83) they share with third parties for those third parties’ direct marketing purposes. You may contact us at legal@curaleaf.com to request this information.

EXERCISING YOUR RIGHTS

If you reside in a state that provides you with these rights and we are subject to such laws, to exercise any of these rights, email us at legal@curaleaf.com or mail your request to:

Curaleaf, Inc.,
290 Harbor Drive,
Stamford, CT 06902.

Only you, or a person legally authorized to act on your behalf (an “Authorized Agent”), may make a verifiable consumer request related to your personal information. You have the right to request this information up to two times in a 12-month period. Before completing your request, we may need to verify your identity or authority to ensure the security of your personal information.

Appeals Process

If we decline to take action on your request, you may have the right through your applicable state privacy law to appeal our decision. To submit an appeal, please contact us at legal@curaleaf.com with the subject line “Privacy Rights Appeal.” We will review and respond to your appeal within 45 to 60 days as required by your state’s applicable law. If your appeal is denied, you may have the right through your applicable state privacy law to submit a complaint to your state Attorney General.

AUTHORIZED AGENTS

If you use an Authorized Agent to submit a request to know or a request to delete, we may require the Authorized Agent to submit proof that they have been authorized to act on your behalf. We may accept as proof either:

  • Written permission from you; or
  • A power of attorney. We may also require the Authorized Agent to verify their identity directly with us.

Section 6 – Questions and Contact Information:

If you have any questions about this Privacy Policy or simply want more information, please contact:

privacy@curaleaf.com; or

Curaleaf, Inc.
290 Harbor Drive
Stamford, CT 06902
Phone: (781) 451-0150