Privacy Policy

This policy explains what personal information we collect when you use cannabisdeliveryma.com and order cannabis delivery from us, why we collect it, who we share it with, how long we keep it and what you can ask us to do with it. It applies to the website, the checkout and the messages we send about your orders.

1. Who we are

Cannabis Delivery MA is operated by Dris Corporation, doing business as Cannabis Delivery MA, a Marijuana Delivery Operator licensed by the Massachusetts Cannabis Control Commission (License #MD1321). In this policy, "we", "us" and "our" mean Dris Corporation. We are responsible for the personal information described here. We are a delivery-only business with no storefront, and we serve adults 21 and older at residential addresses in Massachusetts.

2. Information we collect

We collect only what we need to verify your age, take and deliver your order and meet state rules.

• Account and contact details. Your name, email address and mobile phone number, and the one-time sign-in codes we send to them.
• Date of birth. To confirm you are 21 or older, both on your account and from your ID.
• Delivery address. Your residential address, unit number and any instructions you give the driver. We convert the address to map coordinates so the order can be routed.
• Order history. The products, quantities, prices, taxes, delivery window, payment method, status and delivery record of each order, including the signature collected at the door.
• ID images and details. A photo of the front of your government-issued photo ID (and of its back, for any ID but a passport), an optional photo of you holding it (a "selfie"), and the details you enter from it: ID type, name as printed, date of birth, expiration date and, if you choose, the last 4 characters of the ID number. See ID photos and age verification.
• Device and usage information. Your IP address, browser and device type, the pages you request, and the date and time of each request, which our hosting provider records in server logs.
• Cookies. A small number of cookies the site needs to work. See Cookies and analytics.
• Messages with us. What you tell us when you contact support, and records of your choices about marketing messages.

We do not collect Social Security numbers, and we never ask you to type in your full ID number. Card payments are taken at your door on a payment terminal, so card numbers never reach this website or our systems.

3. ID photos and age verification

Massachusetts delivery rules (935 CMR 500.145) require your identity and age to be verified before your first delivery, by examining a valid, unexpired, government-issued photo ID that shows your date of birth. At the door, our driver checks the same physical ID, your proof of order and your signature. We do this pre-verification ourselves: you upload a photo of your ID at checkout, and it is approved before your order goes out. You can place an order while your ID is being reviewed, but it isn't packed or sent until the ID is approved.

Automatic review. When automatic review is turned on, your ID photo is first read by an AI service from Anthropic, PBC, which acts as our service provider. It reads the printed details (such as the ID type, name, date of birth and expiration date) and checks that the photo shows a real, unexpired ID that matches your account. If everything is clear, the ID is approved automatically. If anything is unclear, the ID goes to trained staff, who make the decision. The image goes only to Anthropic for this check and is not used for anything else. We keep the result of the check (approved, sent to staff or not accepted, and the reasons) with your ID record, and a scrambled code made from your ID number so we can spot the same ID being used on another account. We don't keep the ID number itself. When automatic review is off, trained staff review every ID.

• What we collect. The ID photo, the optional selfie and the ID details listed in section 2. Your browser shrinks each photo and removes hidden photo data, such as GPS location, before it is uploaded.
• Why. To confirm that you are 21 or older, that the ID is valid and unexpired, and that it belongs to the person on the order, and so the driver can match it at the door. We don't use ID data for anything else. We never use it for marketing, and we never sell it.
• Your permission. Uploading an ID is how you ask us to verify it. By uploading it, you permit us to store it and use it as this policy describes, for the periods set out below.
• Who can see it. The automatic check described above, and only staff whose job is to verify IDs, each with their own account. Every time someone opens an ID, it is logged under their name. You can see the status of your ID at checkout (pending, approved, rejected or expired), but the site never shows the image or its details back to anyone else.
• How long we keep it. We delete ID photos and their details 30 days after the latest of your upload, its review or your most recent order placed with it. If you choose to keep your ID on file for future orders, we keep it until the ID expires, or until 30 days after your last order if that is later. When you replace an ID, or an ID is rejected, the old one is deleted 30 days after its last use.
• Your choices. You can replace your ID at checkout at any time, stop keeping it on file, or ask us to delete it now (see Your choices and rights). Without a verified ID we can't accept a delivery order, so you'll upload one again before your next order.

4. How we use information

• Age and identity verification, including the pre-verification required by 935 CMR 500.145 and the ID and signature check at your door.
• Taking and delivering orders: confirming your address is in our service area, scheduling a window, routing the driver, taking payment and giving you receipts and order updates.
• Meeting legal obligations. Under 935 CMR 500.140, a licensee collects and keeps your name, date of birth, address, phone number and email to carry out a delivery, uses it solely for that purpose and keeps it confidential. We also keep sales, tax and delivery records the Cannabis Control Commission and the Department of Revenue require, enforce purchase limits, and respond to lawful requests from regulators.
• Support: answering your questions and resolving problems with an order.
• Security: preventing fraud, sales to anyone under 21 and misuse of the site, and keeping our systems working.
• Marketing messages, only if you opt in (see Texts and email).

5. Who we share it with

We do not sell your personal information, and we do not share it with anyone for their own advertising. We share it only as follows:

• Our point-of-sale and e-commerce providers, which process orders, inventory and receipts for us and are required by state rules to record each sale.
• Dris, which powers our delivery. Your account details go to your Dris account, and each order goes to the Dris dispatch team and driver app so it can be delivered. Dris may send you texts, app notifications, tracking links and requests to rate your delivery about your orders. See "Your Dris account and delivery" below.
• Anthropic, when automatic ID review is on, to read your ID photo for the age and identity check described in section 3.
• Hosting and storage providers that run the website and store its data, including ID images, which they hold only in encrypted form.
• Payment processing: we accept cash or debit card. Debit card payments are processed at the door by our payment terminal provider and your card issuer.
• Messaging and mapping providers that send our sign-in codes, order updates and emails, and that turn your address into map coordinates for routing.
• The Cannabis Control Commission, the Department of Revenue, law enforcement and courts, when the law requires it, such as an inspection, an audit, a subpoena or a court order.
• Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
• A successor business, if the business or its license is transferred with the Commission's approval. This policy would continue to apply to your information.

Our service providers may use your information only to provide their services to us, and our contracts require them to protect it.

6. Your Dris account and delivery

Cannabis Delivery MA is powered by Dris. When you verify your sign-in code for the first time, we also create your Dris account, or link an existing one with the same phone number (or email), so you can track orders and get updates in the Dris app. If you already have a Dris account, we only fill in details it is missing; we never overwrite your name, email or preferences there.

What we send to create or update that account:

• first and last name, phone number and email address
• whether you're verified as 21 or older, and your ID review status (approved, pending or none)
• your marketing choices for email and texts
• a record of the consent shown to you at sign-up

We never send your date of birth, your ID photos or your ID number.

We send your account details again when your ID review status, your age verification or your marketing choices change. Replying STOP to our texts also turns off marketing texts on your Dris account.

To deliver your order, we send the Dris dispatch team and driver app your first name and last initial, phone number, delivery address and notes, the items with their prices, the tax breakdown and the amount due, the payment method, and whether your ID was verified before delivery. Drivers, vans, cash and tips are handled by Dris. Dris sends us back the delivery status, the driver and van, and the ID check at your door.

If you ask us to delete your account, we unlink it from Dris and ask Dris to clear the details that came from us. Your Dris account itself is deleted through Dris's own process, under the Dris Privacy Policy.

Dris Privacy Policy

7. Support chat

The chat on our site is answered by the Dris support team, with help from an automated assistant. What you type in the chat, and any order number you share, go to Dris support so they can answer you and look up your order.

Please don't share your full ID number, card details or sign-in codes in the chat.

8. How long we keep it

If a court order, subpoena or a request from the Commission or law enforcement covers specific records, we keep them until the matter is resolved.

9. How we protect it

We keep a Written Information Security Program under the Massachusetts data security regulation (201 CMR 17.00). Its safeguards include:

• Encryption. ID photos and ID details are encrypted with AES-256 before they are stored. The key is held only in our server environment, apart from the data, so a copy of the storage alone can't be read. The site uses HTTPS throughout.
• Private storage. ID images are kept in private storage with public access blocked, and never on public web pages.
• Limited, logged access. Only staff who need ID data for their job can reach it, each with their own account and a strong password, and accounts lock after repeated failed sign-ins. Every view and decision is recorded, and we review those records regularly.
• People and devices. Staff are trained before they get access and every year. They may not download, print, screenshot or forward IDs. Work devices must be encrypted, locked and kept up to date. Access ends on a person's last day.
• Vendors. We choose providers that can protect personal information and require them by contract to do so.
• Deletion. A scheduled job deletes ID data when its retention period ends.

No system is perfectly secure. Please keep your sign-in codes to yourself, and tell us right away if you think someone has used your account.

10. If there is a data breach

If a breach of security affects your personal information, we will notify you, the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay, as M.G.L. c. 93H requires. Our notice to you will explain your right to obtain a police report and how to request a free security freeze on your credit report, and any other steps you can take. We will also notify the Cannabis Control Commission where its rules require it.

11. Your choices and rights

You can ask us to:

• See the personal information we hold about you, and get a copy of it;
• Correct anything that is wrong or out of date;
• Delete your ID photos and details, your account, or both.

How to ask. Email support@cannabisdeliveryma.com from the address on your account, or write to us at Natick, MA. To protect your account, we confirm requests by sending a code to the email or phone number on your account. We will not ask you for another copy of your ID to do this. We respond within 30 days and tell you what we did.

Limits. We can't delete order, sales and tax records while the law requires us to keep them (see How long we keep it), but we will tell you what we keep and why. If you delete your ID, you'll need to verify a new one before your next delivery, and an order waiting for ID review can't go out until you do. You can also update your contact details in your account, and turn marketing messages off at any time. We won't treat you differently for making a request.

12. Texts and email

• Order messages. When you sign in or order, we send the codes, confirmations and delivery updates you need for that order by text or email. These aren't marketing.
• Marketing texts about the menu or offers are sent only if you give us your express written consent, which we ask for separately from checkout. Consent is never a condition of buying. Message frequency varies, and message and data rates may apply. Reply STOP to any text to stop them, or HELP for help. We honor opt-outs promptly.
• Marketing email is sent only if you opt in, and every one has an unsubscribe link. Unsubscribing doesn't stop order messages.
• We never send marketing to anyone we know is under 21, and our messages follow the Commission's advertising rules.

13. Cookies and analytics

The site uses only the cookies it needs to work:

• Age confirmation: remembers that you confirmed you are 21 or older, for 30 days.
• Sign-in: keeps you signed in during checkout. It can't be read by scripts on the page.
• Bag and checkout: remembers what is in your bag and where you are in checkout.
• Menu tests: a random ID, set when you first open the menu, so you keep seeing the same version of the menu while we test layouts (for example the order of its sections), and so we can count which version led to orders. It holds nothing about you and isn't shared. It is connected to your account only once you sign in, and it lasts a year.

We don't use advertising cookies or third-party analytics trackers, and we don't sell or share browsing data. We understand how the site is used from the server logs described in section 2. If we add an analytics tool, we will update this policy first. You can block or delete cookies in your browser, but the age check and checkout won't work without them.

14. Adults 21+ only

This site and our service are only for adults 21 and older. We don't knowingly collect personal information from anyone under 21, and we don't accept orders from them. If we learn that someone under 21 has given us personal information, we delete it, except any record the law requires us to keep of a refused sale or delivery.

15. Changes to this policy

We will post any change on this page with a new effective date. If a change materially affects how we use information we already hold, we will tell you by email or on the site before it takes effect. This policy is effective September 24, 2026.

16. Contact us

Questions or requests about your privacy: support@cannabisdeliveryma.com, or by mail to Dris Corporation, Attn: Privacy, Natick, MA. See also our Terms and Conditions.