Policy

Privacy policy

Effective November 6, 2026. Last updated November 6, 2026.

This policy explains what personal information Sessions by the Bay collects, why we collect it, who we disclose it to, how long we keep it and the choices you have. It covers our website (sessionsbythebay.com), online orders, website accounts, our loyalty program, texts and emails, and your visits to our store, lounge and events, including phone calls and security recordings.

It does not cover other companies' websites, such as OpenTable or Eventbrite, even when you reach them from our site. It also does not cover information about our employees and job applicants.

The short version

We collect what we need to sell cannabis legally, fill your orders, run our lounge and events, and stay in touch if you ask us to.
California law requires us to check your ID. We use your ID details only to verify your age, identity and eligibility and to meet legal requirements. We never use them for marketing.
We do not sell your personal information for money.
After you pass our age gate, our website loads Google analytics and advertising tags. California law may call that "sharing." You can turn it off (see sections 7 to 9).
California's cannabis law limits who we may give your information to, and we follow it.

1. Who we are

Sessions Ventures LLC, doing business as Sessions by the Bay ("Sessions," "we," "us"), runs a licensed cannabis dispensary and an on-site consumption lounge with events at 700 Bay Marina Drive, National City, CA 91950. California cannabis retail license C10-0001553-LIC. Phone (619) 935-7374. Email info@sessionsbythebay.com.

2. What we collect, why, and how long we keep it

The table below lists the personal information we collect, where it comes from, what we use it for, who we disclose it to and how long we keep it. It covers the last 12 months and what we collect today. If the California Consumer Privacy Act applies to us, this table is also our notice at collection.

What we collect	Examples	Where it comes from	Why we use it	Who we disclose it to	How long we keep it
Contact details	Name, email, phone number, mailing address	You; Proteus	Orders, your account, loyalty, replying to you, texts and emails you asked for	Proteus; our website hosting, database and email providers (Vercel, Supabase, Resend)	While you are a customer, and as long as we keep related records. Details tied to sales records: 7 years
Age, identity and medical eligibility (sensitive)	Date of birth; ID type, number, expiration date and photo or scan; for medical patients, the physician's recommendation and any state medical ID card	You, at our counter or check-in; the Proteus checkout	Verifying age, identity and eligibility; purchase limits; meeting state and local cannabis law; preventing fraud	Proteus, which runs our transactions and ID checks; state and local cannabis authorities when the law requires	7 years, as California cannabis record rules require
Purchases and orders	Items, prices, date, order status, pickup, returns	You; Proteus	Filling orders, sales and tax records, returns, loyalty, understanding what sells	Proteus; payment processor; tax and cannabis authorities when the law requires	7 years
Payment details	Card or bank details, payment status, last four digits	You, through the Proteus checkout or at our counter	Taking payment, refunds, preventing fraud	Proteus and its payment processor. We do not store full card or bank numbers	As the processor's rules and the law require
Loyalty	Points, tier, rewards, birthday, visit and purchase history	You; Proteus	Running the loyalty program (see section 17.8 if it applies)	Proteus	While you are a member, and as long as we keep related sales records
Website account	Email, password (stored scrambled, never in plain text), sign-in codes, link to your Proteus profile	You; Proteus	Signing you in; showing your points and purchases	Supabase; Resend (sends sign-in codes); Vercel	Until you close your account. Sign-in codes expire after 10 minutes
Messages you send us	Contact form (name, email, phone, topic, message), emails, texts, voicemails. The contact form also keeps a scrambled code made from your IP address to block spam	You	Answering you; routing your message; blocking spam	Our website hosting, database and email providers; our phone system provider	As long as we need it to answer you and keep a record of the conversation
Phone calls	Recordings and transcripts of calls to and from Sessions	You, when you call us or we call you	Quality, training, safety, resolving disputes	Our phone system provider	As long as our phone system keeps them, and longer if tied to an incident or claim
Marketing choices	Your opt-ins and opt-outs for texts and email, with date and source	You; Proteus	Sending only the messages you agreed to; proving consent; honoring opt-outs	Proteus	As long as we keep your customer profile, so we can prove what you agreed to
Reservations and tickets	Name, party size, phone, email, booking notes	OpenTable; Eventbrite	Seating you, running events, contacting you about your booking	OpenTable and Eventbrite already hold it under their own policies	As long as we need it for your booking and our event records
Device and website use	IP address, browser, device type, pages viewed, links clicked, the site you came from, approximate location based on IP	Your browser, through cookies and tags (section 7)	Keeping the site working; measuring use; fixing problems	Google (Analytics); Vercel	Google Analytics keeps it for no more than 14 months
Advertising data	Cookie IDs, ad clicks, visits after an ad	Your browser, through Google Ads tags	Measuring and improving our ads, including ads shown on other websites	Google. California law may call this "sharing" (section 9)	Under Google's retention rules
Security recordings	Video and audio throughout our premises, inside and out; security officers' body cameras. Never in restrooms or changing areas	Our cameras, when you visit	Safety, security, meeting cannabis license rules, investigating incidents	Our security contractors, insurers and lawyers; cannabis authorities and law enforcement when the law requires	At least 90 days, as state cannabis rules require, and longer if tied to an incident or claim
Event photos and video	Photos and video of our space and events, which may show guests	Our staff and photographers	Marketing, as the Guest Agreement explains	Our marketing vendors; the public, when we post	As long as we use them
Inferences	The kinds of products and events you seem to like, based on your purchases	Your purchases and loyalty activity	Tailoring offers in our texts and emails	Proteus	While you are a customer

We do not collect your precise location.

3. How we use personal information

In addition to the uses in the table, we use personal information to:

Run our business: process sales, keep records, handle returns and answer questions.
Meet our legal duties: cannabis license rules, tax law, purchase limits, record keeping and lawful requests from authorities.
Keep people safe: protect our guests, staff and property, and prevent fraud and misuse.
Improve our website and services.
Market to you, but only by text or email if you opted in, and only if you are 21 or older.

4. Your ID and medical information

California law requires us to check ID before every cannabis sale and at lounge entry. We collect your date of birth, the details on your ID and, for medical patients, your physician's recommendation.

We use this information only to verify your age, identity and eligibility, to apply purchase limits, to meet state and local cannabis law and to prevent fraud. We do not use it for marketing. We do not sell or share it. We do not use it to make guesses about you, such as your health or other characteristics.

California cannabis rules require us to keep sales records, which include some of this information, for seven years. We cannot delete it on request before then.

5. Who we disclose personal information to

California's cannabis privacy rule. California law limits what a licensed cannabis business may share about its customers (Business and Professions Code section 26161.5). We disclose the personal information that law protects (such as your name together with your ID number, your medical information, or your account sign-in details) only:

to complete your payment;
to companies that run our transactions or check eligibility for us under contract, which may not use or keep it for anything else or share it with anyone but us;
to state and local cannabis authorities carrying out their duties; or
with your consent.

We will never refuse you service because you decline to let us share your information with a company that is not part of your purchase.

Our service providers. Companies that help us run the business, under contracts that limit how they use your information:

Proteus: point of sale, online ordering and checkout, ID checks, loyalty, and our texts and emails.
Supabase and our other website database host: store website accounts and contact form messages.
Vercel: hosts our website.
Resend: sends website emails, such as sign-in codes and contact form notices.
Google: website analytics (Google Analytics).
Our phone system provider, which records and transcribes calls.
Our security contractors, who staff our premises and handle recordings.
Our payment processor, through Proteus.

Advertising partners. Google, through the tags described in section 7.

Authorities and legal duties. Cannabis regulators, tax authorities and law enforcement when the law requires it, and others when we must respond to legal process, protect someone's safety or defend our legal rights, as far as California law allows.

If our business changes hands. If Sessions is sold or reorganized, customer records may transfer to the new owner, as far as the law allows, and this policy will keep applying to them.

Companies you choose to use. When you book through OpenTable or buy tickets through Eventbrite, you give your information to them directly, and their privacy policies apply.

We do not give your name, ID or medical details to cannabis brands or any other business for their own marketing.

6. Texts and emails

We send marketing texts and emails only if you opt in, and only to adults 21 and older. Our texts and marketing emails run through Proteus.

Texts. Reply STOP to stop and HELP for help. Message frequency varies, and message and data rates may apply. You can also opt out by telling staff, calling us or emailing info@sessionsbythebay.com. We honor opt-outs within 10 business days.
Your mobile number stays with us. We do not sell or share your mobile number or your text consent with other companies for their own marketing.
Emails. Every marketing email has an unsubscribe link. Order, pickup, sign-in and account emails keep coming while you have an order or account.
We keep a record of your consent and opt-outs so we can prove what you agreed to and make sure we stop when you ask.

7. Cookies and tracking

Our tags wait for the age gate. Our Google analytics and advertising tags load only after you confirm you are 21 or older, and the gate tells you so. The OpenTable booking widget is run by OpenTable and loads with the pages it appears on.

What our website uses:

Name	What it does	Kind	How long
Age gate answer (`sbtb.age.confirmed`, stored in your browser, not a cookie)	Remembers that you confirmed your age	Needed for the site	24 hours
Site preferences (stored in your browser, not cookies)	Remembers your theme, saved favorites, hidden deals and motion setting. Never sent to us	Needed for the site	Until you clear your browser
Account cookie (`__Host-sbtb_account`)	Keeps you signed in	Needed for the site	30 days, or until you sign out
Google Analytics (cookies such as `_ga`)	Counts visits and shows how the site is used	Analytics	Up to 2 years
Google Ads tags (cookies such as `_gcl_au`)	Measures whether our ads lead to visits, and helps Google show our ads to people who visited	Advertising	Up to 90 days
OpenTable reservation widget	Runs bookings on our home, reservation and event pages. OpenTable may set its own cookies	Third party	Under OpenTable's policy
Proteus checkout	Runs your cart and checkout on Proteus's pages. Proteus may set its own cookies	Third party	Under Proteus's policy

Other companies that track activity across sites. Google may collect information about your activity on our site and on other websites over time. OpenTable and Proteus may collect information when you use their widget or checkout.

How to opt out:

Your browser. Most browsers let you block or delete cookies, including third-party cookies. Blocking our account cookie will sign you out.
Google. Use the Google Analytics opt-out add-on at tools.google.com/dlpage/gaoptout, and turn off personalized ads at myadcenter.google.com.
Industry tools. You can opt out of many companies' interest-based ads at optout.aboutads.info and optout.networkadvertising.org.
Global Privacy Control. See section 8.

8. Do Not Track and Global Privacy Control

Do Not Track. There is no common standard for what a "Do Not Track" signal means, so our website does not respond to it.

Global Privacy Control (GPC). If your browser or extension sends a GPC signal, we treat it as a request to opt out of sharing for advertising. On that browser we turn on Google's restricted data processing and turn off ad personalization and Google signals, so Google may use the data only to measure our ads, not to target ads to you. GPC applies to the browser that sends it. If you want us to apply your choice to your account too, sign in while GPC is on, or email us.

9. Selling and sharing

We do not sell personal information for money.

Our Google Ads tags let Google know that a browser visited our site, so we can measure our ads and show them to people who have visited. California privacy law may treat this as "sharing" personal information for advertising, and possibly as a "sale." You can stop it with GPC (section 8), the opt-out tools in section 7, or the Do Not Sell or Share My Personal Information link at the bottom of every page.

We do not knowingly sell or share the personal information of anyone under 16. Our website is for adults 21 and older.

10. Your website account

When you create an account at sessionsbythebay.com/account, we store your email address and, if you set one, your password in scrambled form. We use your email to find your loyalty profile in Proteus and show your points, purchases and details. You sign in with a one-time code we email you or with your password.

You can close your account from your account page or by emailing info@sessionsbythebay.com. Closing it deletes your website account. Sales and ID records that California cannabis law requires us to keep stay in Proteus for the time the law requires.

11. Children and minors

Our website is for adults 21 and older. Our lounge and events are 21 and older. In our store, we also serve medical cannabis patients 18 and older with a valid physician's recommendation and valid ID.

We do not knowingly collect personal information from anyone under 18. If we learn that someone under 21 has created a website account or joined our marketing lists, we close the account or remove them from the lists. If you believe a minor has given us personal information, email info@sessionsbythebay.com and we will delete it, unless the law requires us to keep it.

12. How we protect your information

We use reasonable safeguards to protect personal information, including encrypted connections on our website, scrambled passwords, sign-in codes that expire after 10 minutes, and limits on which staff and vendors can reach customer records.

No system is perfectly secure. If a breach affects your personal information, we will notify you as California law requires. Please do not send sensitive information, like a photo of your ID, by email or through our contact form.

13. How long we keep information

We keep personal information only as long as we need it for the reasons in this policy, and as long as the law requires. The table in section 2 gives the period for each kind of information. When we no longer need it, we delete it or remove anything that identifies you.

14. Your choices

Marketing. Reply STOP to texts, use the unsubscribe link in emails, or ask us.
Cookies and ads. Use your browser settings, Google's tools, GPC or the industry tools in section 7.
See or correct your information. Your account shows your points, purchases and details. To review or correct anything we hold about you, email info@sessionsbythebay.com, call (619) 935-7374 or ask at the counter. We will check your identity first.
Close your account. From your account page, or email info@sessionsbythebay.com.

15. California "Shine the Light"

California Civil Code section 1798.83 lets California customers ask whether a business has disclosed their personal information to other companies for those companies' own direct marketing. We do not disclose personal information to other companies for their own direct marketing. If you have a question about this, email info@sessionsbythebay.com with "Shine the Light" in the subject line or write to us at the address in section 19. We will reply within 30 days.

16. Need this policy in another format?

Call us at (619) 935-7374 and we will read it to you or send it in a format that works for you.

17. Your California privacy rights (CCPA)

If you are a California resident, the California Consumer Privacy Act gives you the rights below.

17.1 Your rights

Right to know. Ask what personal information we have collected about you, where it came from, why we collected it, who we disclosed it to, and for a copy of it.
Right to delete. Ask us to delete personal information we collected from you. We may keep what the law requires, such as cannabis sales and ID records for seven years, or what we need for security, completing a transaction or another reason the law allows. We will tell you what we kept and why.
Right to correct. Ask us to fix information that is wrong.
Right to opt out of selling and sharing. Tell us not to sell or share your personal information for advertising. Use the Do Not Sell or Share My Personal Information link at the bottom of every page, turn on GPC, or contact us.
Right to limit use of sensitive information. We use sensitive personal information (ID details, medical eligibility and account sign-in details) only for purposes the law allows without offering this right, such as verifying identity, completing your purchase, security and legal compliance. So we do not offer it.
No discrimination. We will not deny you service, charge you a different price or give you a lower quality of service because you used these rights. Section 17.8 explains the loyalty program.

17.2 How to make a request

Email info@sessionsbythebay.com with "Privacy request" in the subject line.
Call us at (619) 935-7374.
Ask in person at our store, 700 Bay Marina Drive, National City.
To opt out of selling and sharing, use the Do Not Sell or Share My Personal Information link.

17.3 Verifying your request. To protect you, we check your identity before we act on a request to know, delete or correct. We match the details you give us (such as your name, email, phone and a recent purchase) against our records. For requests that involve ID or medical details, we may ask you to come in and show your ID. We do not need to verify a request to opt out.

17.4 Authorized agents. Someone else can make a request for you with your signed written permission. We may still ask you to verify your identity with us directly or to confirm that you gave the agent permission. We do not require this if the agent holds a power of attorney under California Probate Code sections 4121 to 4130.

17.5 Timing. We confirm a request within 10 business days and answer within 45 calendar days. If we need more time, we tell you why and may take up to 45 more days. We act on opt-out requests within 15 business days.

17.6 If we say no. If we deny a request, we explain why. You can ask us to reconsider by replying to our answer.

17.7 What we collected and disclosed in the last 12 months. In CCPA terms, we collected these categories: identifiers; customer records; characteristics of protected classifications (age); commercial information; internet or other electronic network activity; approximate location based on IP address; audio and visual information; inferences; and sensitive personal information (government ID details, medical eligibility information and account sign-in details). The sources, purposes and recipients are in section 2.

Disclosed for business purposes to the service providers in section 5: all of the categories above.
Shared for cross-context behavioral advertising with Google: identifiers (such as cookie IDs and IP address) and internet activity.
Sold: none for money.

17.8 Notice of financial incentive: our loyalty program

Our loyalty program is a financial incentive under California law, because you give us personal information and get rewards in return.

What it is. You earn points on qualifying purchases at a rate set by your tier. 12,000 points equal $1 in value toward rewards. Points expire after 90 days without a purchase. The Loyalty Program Terms have the full material terms.
What information it uses. Name and email (required), phone number and birthday (optional), and your purchase and reward history.
How to join. In store or online. Joining is optional and you never need to join to shop.
How to leave. Tell any staff member or email info@sessionsbythebay.com at any time. Unused points are forfeited when you leave.
Why the value is fair. We value a member's personal information at about what we give back for it: 2.5% to 20% of the member's qualifying spending, depending on tier, paid as points. We use this method because the rewards are how we pay for the information, so the rewards are reasonably related to its value to us.

18. Changes to this policy

We may update this policy. When we do, we post the new version here and change the dates at the top. For a change that matters, such as a new use of your information or a new kind of company we share it with, we also post a notice on our website and email account holders at least 30 days before it takes effect. We review this policy at least once every 12 months.

19. Contact us

Questions or requests about your privacy:

Sessions Ventures LLC, doing business as Sessions by the Bay
700 Bay Marina Drive, National City, CA 91950
(619) 935-7374
info@sessionsbythebay.com