Privacy Policy

Effective date: November 9, 2026

This site is operated by Carp Red Barn, Inc., a California corporation ("Slimmies," "we," "us"). This policy explains what information we collect through slimmies.us, how we use it, and the choices you have.

Who this site is for

This site is for adults 21 and older. We do not knowingly collect information from anyone under 21. If you believe someone under 21 has given us information, contact us and we will delete it.

Information we collect

Information you give us

The site has three forms. Each says next to its button what we will do with what you send.

  • Email updates: your email address, when you sign up for updates in the footer or on the merch page. Like the other forms, a signup reaches us as an email; we do not use a mailing list service.
  • Suggest a dispensary: your email address, and the dispensary name, city and zip code you send us, on Find Us.
  • Wholesale: your store name, location, email address, phone number or other contact details and your message.

Each form submission reaches us as an email, and we keep a copy of it in a spreadsheet in our own Google account, so we have them in one place. We also receive anything you choose to send us by email.

Information collected automatically

  • Your answer to the age question. When you confirm you are 21 or older, the site saves a cookie named sl_age in your browser for one year so we do not ask on every visit. It records only that you answered yes.
  • Your motion setting. If you turn animation off with the motion switch in the footer, the site saves that choice in your browser's local storage (sl_motion). It never leaves your browser.
  • Site analytics. We use Vercel Web Analytics to count visits. It does not use cookies. It records the pages viewed, the site that referred you, and general information about your browser, operating system, device type and country. Its script is served from this site's own domain.
  • Server logs. Our host, Vercel, processes the technical information every visit sends, such as your IP address, browser type and the time of the request, to deliver the site and keep it secure.

We do not use advertising cookies or tracking pixels.

Parts of the site run by others

Two parts of the site load from other companies, and only on their own pages:

  • The store locator on Find Us is provided by StoreRocket, with its map and address search from Mapbox. It loads only after you have answered the age question. When it loads, your browser contacts StoreRocket, Mapbox and jsDelivr, the network that serves the map's code, and each receives your IP address; StoreRocket and Mapbox receive any location you search for, and Mapbox receives information about how the map is used. If you use the locator's button to find your own location, your browser asks you first.
  • The playlist player on Tunes is provided by Spotify. It loads only after you have answered the age question and scrolled near it. When it loads, your browser contacts Spotify, which receives your IP address and may set its own cookies, and if you are signed in to Spotify it knows that you played the playlist.

Their own privacy policies cover what they do with that information.

How we use information

  • To send the updates you asked for, from our own email, if and when we send them.
  • To follow up on dispensaries you suggest, and to answer wholesale and partnership inquiries.
  • To run, secure and improve the site.
  • To comply with the law.

We do not sign you up for updates because you used the suggest-a-dispensary or wholesale form.

How we share information

We do not sell your personal information, and we do not share it for targeted advertising. We share information only:

  • Within our company, and with Mammoth, our distributor in California, which acts as our sales agent, when they need it to follow up on your inquiry or a dispensary you suggested for us.
  • With service providers that help us run the site, under terms that limit how they can use it: website hosting and analytics (Vercel), delivery of form submissions to our inbox (Resend), our email provider and the spreadsheet we keep form submissions in (Google), the store locator (StoreRocket, with maps from Mapbox) and the playlist player (Spotify).
  • When the law requires it, or to protect our rights, our users or the public.
  • As part of a merger, sale or other transfer of the business, in which case this policy continues to apply to information already collected.

We do not share personal information with other companies for their own direct marketing.

Marketing emails

You can unsubscribe at any time by replying to any update we send, or by contacting us.

Your choices and rights

You can ask us to tell you what personal information we hold about you, to correct it, or to delete it. We will not treat you differently for using these rights.

To make a request, email jose@pacificdutchgroup.com or write to us at the address under "Contact." We will reply within 14 days. If a request takes longer to complete, we will tell you why and finish it within the time the law allows. We may need to confirm your identity before we act on a request.

You can block or delete cookies in your browser settings. If you do, you will be asked the age question again.

Your California privacy rights

If you live in California, you have the right to know what personal information we collect, use and disclose, to have it deleted, to have it corrected, and to opt out of its sale or sharing. This section gives the details California law asks for.

What we collected in the last 12 months, and where it came from.

  • Identifiers: your email address and any phone number or other contact details you send, from you; your IP address, from your browser.
  • Commercial information: the store name, location and message you send through the wholesale form, and the name, city and zip code of a dispensary you suggest, from you.
  • Internet activity: the pages you view, the site that referred you, and your browser and device type, from your browser through our analytics and server logs.
  • General location: the country of your visit, from our analytics.

We collect no sensitive personal information as California law defines it.

Why we collect it. For the purposes listed under "How we use information."

Who receives it. Mammoth, as our sales agent, and the service providers listed under "How we share information," for those business purposes only. We have not sold or shared personal information, as California law defines those words, in the last 12 months, including that of anyone under 16.

How long we keep it. What you send through the forms reaches us as email, and our email system deletes messages 3,750 days (a little over ten years) after they arrive. Our spreadsheet of form submissions deletes each one on the same schedule. We also keep archive backups of our email, which do not expire on a schedule. If you unsubscribe, we stop sending you updates and delete your signup. Your IP address, internet activity and general location are kept in our analytics and server logs for the periods our host keeps them.

How to make a request. Use either method under "Your choices and rights." To confirm it is you, we will ask you to reply from the email address the request is about, or for details that match what we hold. You can ask someone to make a request for you; we will need your signed permission and may ask you to confirm your identity with us directly.

Browser privacy signals

We do not sell or share personal information for advertising, so there is nothing to opt out of. If that ever changes, we will honor Global Privacy Control signals.

Some browsers send a "Do Not Track" signal. This site does not track you across other websites, so it works the same way whether or not the signal is on.

How long we keep information

Form submissions and signups reach us as email, and we keep a copy of each in a spreadsheet. Our email system deletes messages 3,750 days (a little over ten years) after they arrive, and the spreadsheet deletes each submission on the same schedule. We also keep archive backups of our email, which do not expire on a schedule. If you unsubscribe from updates, we stop sending them and delete your signup. You can ask us to delete your information sooner. When you do, we delete it from our active email and the spreadsheet right away, and from an archive backup the next time that backup is opened or used.

Security

We use reasonable safeguards to protect the information we hold. No website can promise perfect security.

Links to other sites

This site links to retailers, Instagram, Spotify and other sites we do not control. Each has its own privacy practices, which this policy does not cover.

Changes to this policy

If we change this policy, for example if we start using a mailing list service for updates, we will post the new version here and update the effective date.

Contact

Carp Red Barn, Inc.
5360 Foothill Road
Carpinteria, CA 93105
License C11-0001912-LIC
jose@pacificdutchgroup.com