Privacy Policy
What the museum collects when you use this site, why, who else touches it, and how to get it back or have it removed.
Last updated: August 31, 2026
1. Who we are and what this policy covers
The Cannabis Museum operates a museum, a public archive, and this website. This policy explains what personal information we collect through the site, why we collect it, who processes it on our behalf, how long we keep it, and the choices and rights you have.
It covers cannabismuseum.com and every page and account area served from it, including membership, donations, ticketing, the shop, the archive, forms, and email we send you. It does not cover sites we link to, or what happens at the museum in person beyond the records described here.
For questions, requests, or complaints, contact us at info@cannabismuseum.com, +1 (740) 331-4558, or 16050 Canaanville Hills Road, Athens, OH 45701, United States.
2. Information you give us
- Account details — your name, email address, and password or social sign-in, handled by our authentication provider, Clerk. Your password is never stored by us and never visible to us.
- Membership and payment details — the plan you choose, billing status, renewal dates, and the last four digits and brand of your card. Full card numbers go directly to Stripe and never reach our servers.
- Donations — the amount, frequency, the name you give, and any message or dedication you attach.
- Ticket, event, and space-rental bookings — who is attending, contact details, dates, party size, and any access or dietary notes you choose to share.
- Shop and print orders — the items ordered, your shipping address, and order history.
- Forms you submit — contact enquiries, volunteer applications, artifact and document donation offers, research requests, and feedback on archive records.
- Member wall entries — if — and only if — you opt in, the display name and profile photo you choose are shown publicly. You can turn this off at any time.
- Newsletter subscriptions — your email address, and whether you opened or clicked a message we sent.
3. Information collected automatically
When you use the site, our hosting and analytics providers record technical information about the visit. We use it to keep the site working, to detect abuse, and to understand which pages and exhibits people find useful.
- IP address, approximate location derived from it, and internet service provider.
- Browser, operating system, device type, screen size, and language.
- Pages viewed, referring page, search terms used on the site, time on page, and links clicked.
- Dates and times of requests, error and performance diagnostics, and security logs.
- Identifiers stored in cookies or similar technologies, described in the next section.
5. Advertising and measurement
We advertise the museum, its exhibits, and its programming through Google Ads and similar platforms. Those platforms may use cookies and device identifiers to show you our ads on other sites and to tell us, in aggregate, how many people who saw an ad went on to visit, buy a ticket, join, or donate.
We may upload a hashed version of an email address to an advertising platform to build or exclude an audience — for example, to stop showing membership ads to people who are already members. We never sell your personal information, and we never share the contents of an archive search, a donation amount, or a membership tier with an advertising platform.
Under some state laws, using advertising cookies counts as "sharing" personal information for cross-context behavioural advertising. You can opt out at any time using the controls in the previous section or by emailing us.
6. How we use your information
- Create and secure your account, and keep you signed in.
- Process memberships, donations, tickets, rentals, and shop orders, and send you receipts and confirmations.
- Provide member benefits, including admission, discounts, and archive access.
- Answer enquiries, process volunteer applications, and evaluate offers of artifacts and documents.
- Send service email you cannot opt out of while you hold an account — renewal notices, receipts, security alerts, and changes to these policies.
- Send the newsletter and event announcements, which you can unsubscribe from at any time.
- Operate, debug, and improve the site and the archive, and measure which programming reaches people.
- Advertise the museum, and measure whether that advertising works.
- Prevent fraud and abuse, enforce our terms, and comply with legal, tax, and accounting obligations.
7. Legal bases for processing
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases: performance of a contract, for memberships, orders, and bookings; consent, for the newsletter, the member wall, and non-essential cookies, which you may withdraw at any time; legitimate interests, for site security, fraud prevention, measurement, and improving what we offer; and legal obligation, for tax, accounting, and record-keeping duties.
9. AI assistants and connected agents
Members and staff can connect AI assistants to the museum through two dedicated surfaces. This section explains what each connection can reach and what we record when it is used.
- Member AI connections — eligible members can connect their own AI client to the archive through connect.cannabismuseum.com. The connection is read-only — it can search and view archive records and images, and nothing more. Each plan includes a monthly quota of AI calls, and every tool call is logged against your account so we can enforce that quota and detect abuse.
- Staff and administrative connections — staff may connect AI tools that act under their own staff account and role permissions. Every action taken through such a tool is attributed to that staff member and logged, the same way their own administrative actions are.
When you use a member AI connection, your queries and the records returned pass through the AI provider you chose to connect with. That provider processes them under its own privacy policy, which we do not control — read it before connecting.
AI connection logs are kept up to 12 months, the same as our other security and server logs.
10. Information you make public
The member wall and any donation recognition are public by choice, never by default. If you opt in, the display name and photo you select can be seen and indexed by anyone, including search engines. You can withdraw at any time from your membership settings, and we will remove the entry — though copies may persist in search engine caches or archives outside our control until they refresh.
11. How long we keep it
- Account records: while your account is open, and up to 24 months after it closes.
- Payment, donation, and order records: at least 7 years, because tax and accounting law requires it.
- Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again by mistake.
- Form submissions and enquiries: up to 3 years, so we can pick up a conversation where it left off.
- Volunteer applications: up to 2 years unless you ask us to delete them sooner.
- Analytics and advertising data: as configured in Google Analytics, up to 14 months for event-level data.
- Security and server logs: up to 12 months.
12. How we protect it
The site is served entirely over HTTPS. Passwords are handled by Clerk and never stored by us. Card numbers are handled by Stripe and never stored by us. Access to museum records is limited to staff and volunteers who need it, and administrative actions are logged. No system is perfectly secure, so we cannot guarantee absolute security — but if a breach affects your information, we will notify you and the relevant authorities as the law requires.
13. Your rights and choices
Wherever you live, you can ask us to show you the personal information we hold about you, correct it, delete it, or send you a copy. You can unsubscribe from marketing email using the link in any message, and change your member wall setting yourself at any time.
If you are a California resident, you have the right to know what we collect and disclose, to delete it, to correct it, to opt out of sharing it for cross-context behavioural advertising, to limit the use of sensitive information, and not to be discriminated against for exercising any of these rights. We do not sell personal information, and we do not knowingly collect or share the information of anyone under 16 for advertising.
If you are in the European Economic Area or the United Kingdom, you additionally have the right to object to processing based on legitimate interests, to restrict processing, to withdraw consent, and to lodge a complaint with your local supervisory authority.
To exercise any of these, email info@cannabismuseum.com from the address on your account, or write to us at 16050 Canaanville Hills Road, Athens, OH 45701, United States. We respond within 45 days, and will tell you if we need longer. We may need to verify your identity first, and an authorised agent must provide written proof that they act for you.
14. Notice at Collection for California residents
In the last 12 months we collected the categories of personal information below. The sections above describe each in full; the retention section above gives how long each is kept. We do not sell personal information in any category, and we do not collect sensitive personal information beyond the sign-in credentials handled by Clerk, which we never see.
- Identifiers — name, email address, postal and shipping address, phone number, IP address, and account identifiers. Collected from you and from your browser; used for accounts, orders, delivery, and security; disclosed to Clerk, Stripe, Resend, Vercel, Neon, and shipping partners. Kept per the account, order, and log periods in the retention section.
- Commercial information — memberships, donations, tickets, rentals, and shop orders. Collected from you; used to process purchases, provide benefits, and meet tax and accounting duties; disclosed to Stripe and to shipping and print partners. Kept at least 7 years, as the retention section describes.
- Internet or network activity — pages viewed, links clicked, referring pages, diagnostics, and cookie identifiers. Collected automatically from your device; used to operate, debug, measure, and advertise the site; disclosed to Google and Vercel. Kept up to 14 months for analytics and 12 months for logs.
- Approximate location — derived from your IP address, never from GPS. Used for security and measurement; disclosed to Google and Vercel with the network activity above, and kept on the same schedule.
- Inferences — aggregate measures of which pages and exhibits perform, produced by Google Analytics. Used to improve the site and its programming; not used to build profiles of individuals.
15. Do Not Sell or Share My Personal Information
We do not sell your personal information. Under California law, the advertising cookies described above count as "sharing" it for cross-context behavioural advertising, and you can opt out of that at any time.
- Turn on Global Privacy Control in your browser — we honour it as an opt-out request automatically.
- Opt out of Google Analytics at tools.google.com/dlpage/gaoptout, and manage ad personalisation at myadcenter.google.com.
- Withdraw your cookie consent where we asked for it, or email info@cannabismuseum.com and we will apply the opt-out for you.
Under California Civil Code §1798.83 (the "Shine the Light" law), California residents may ask once a year about personal information disclosed to third parties for their own direct marketing. We do not disclose personal information to third parties for their direct marketing, so there is nothing to list — but you are welcome to ask.
16. Children
The site is not directed at children under 13, and we do not knowingly collect their personal information. Tickets and memberships for children are bought by an adult. If you believe a child has given us information, email us and we will delete it.
The museum documents the history of cannabis for research and education. It does not sell cannabis or cannabis products, and nothing on this site is directed at minors as a consumer audience.
17. International transfers
The museum and its records are in the United States. If you use the site from elsewhere, your information is transferred to and processed in the United States, where privacy law differs from your own. Where a transfer is from the European Economic Area or the United Kingdom, our providers rely on the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.
18. Links to other sites
The site links to external resources, partner institutions, ticketing pages, and social media. Those sites have their own privacy policies, and we are not responsible for their practices. Read them before giving them information.
19. Changes to this policy
We update this policy when our practices or the services behind them change. The date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or by a notice on the site before it takes effect.
20. Contact us
The Cannabis Museum · 16050 Canaanville Hills Road, Athens, OH 45701, United States · info@cannabismuseum.com · +1 (740) 331-4558