Privacy policy

This policy covers My Cigar Stash, operated by My Prepack Cigars LLC of 10900 NW 21st St, Unit 230, Miami, FL 33172, and it applies to mycigarstash.com and to orders placed through it. Questions about anything below go to order@mycigarstash.com.

The store is in preview while payment approval completes. In this state the site has no accounts, no login, and no server that stores anything about you. Your cart, your age-gate answer, and the drop-list signup live in your own browser's local storage and never leave the device. Checkout is a labelled preview that takes no card details and creates no order.

The rest of this policy describes what will be collected once checkout opens, so it is on the record before the first order rather than after.

• Order details. Name, shipping address, billing address, email, phone number, and what you bought.
• Age verification data. Date of birth, and whatever else our verification vendor needs to match you against public records. If the instant check cannot confirm you are 21 or older, that vendor may ask you for a photo ID.
• Payment details. Card number, expiry, and security code, entered directly with our payment gateway.
• Correspondence. Anything you send us about an order, a claim, or a question.
• Site usage. Pages viewed, referring site, rough location from your IP address, device and browser type.

Your full card number never touches this website. It goes straight to the payment gateway, which returns an authorisation and a last-four. We could not produce your card number if we wanted to.

Photo ID images, where the verification vendor asks for one, are held by that vendor under their own retention policy. We receive a pass or fail, not the document.

• To take, pack, and ship your order, and to talk to you about it.
• To confirm you are 21 or older, which federal and state law require us to do before a tobacco sale.
• To take payment and to investigate fraud and chargebacks.
• To calculate and remit sales tax and any tobacco excise tax your state charges.
• To meet the reporting duties described under PACT Act reporting below.
• To send you drop announcements, but only if you asked for them. Every one carries an unsubscribe link.

This is the part most tobacco privacy policies bury, so read it before you order.

The federal Prevent All Cigarette Trafficking Act obliges remote sellers of tobacco to register with the tobacco tax administrator of every state they ship into, and to file a report each month listing the shipments made into that state. Those reports identify the name and address of each customer, and what was shipped to them.

We cannot opt out of this and neither can you. It is a condition of buying tobacco by mail from anyone in the United States, and any retailer telling you otherwise is not filing. Nothing else in this policy is disclosed to a government body as a matter of routine.

We share only what each of these needs to do its job:

• The payment gateway and the merchant bank, to authorise and settle the charge.
• The age verification vendor, to run the check.
• USPS and UPS, to carry the parcel and to collect an adult signature where the state requires one.
• State tobacco tax administrators, as described above.
• Our commerce platform and email provider, which hold the order and message records on our behalf under contract.
• Law enforcement, where a valid legal demand requires it.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have no interest in renting a customer list, and a tobacco customer list is not something to be careless with.

The preview site sets no cookies at all. It uses your browser's local storage for three things, all of which stay on your device: your cart, whether you have confirmed you are 21, and whether you have seen the drop-list invitation. Clearing site data removes all three.

When checkout opens, the commerce platform will set cookies necessary to keep a session and a cart on the server. If we later add analytics or advertising tags, this section will name them and a consent control will appear before any non-essential tag runs.

Order and tax records are kept for as long as tax and tobacco regulations require, which in practice means several years after the order. Verification results are kept as proof that the check was run. Marketing contacts are kept until you unsubscribe. Support email is kept for two years unless it relates to a claim.

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or ask us to stop emailing you. Write to order@mycigarstash.com and we will answer within 45 days.

If you are in California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy statute, those laws also give you the right to appeal a refusal, and the right not to be discriminated against for exercising any of this. There is no financial incentive programme here and no sale of data to opt out of.

One limit worth stating plainly: we cannot delete records that tax law or the PACT Act requires us to keep, and we cannot un-file a report already sent to a state.

This site is for adults 21 and over. We do not knowingly collect anything from anyone under 21, and certainly not from a child under 13. If you believe a minor has given us information, write to order@mycigarstash.com and we will delete it.

The site is served over HTTPS. Card data is handled by a PCI-compliant gateway and never stored by us. Access to order records is limited to the people who pack and support orders. No system is perfect, and we will tell you promptly if one of ours is breached in a way that affects you.

When this policy changes in substance, the date at the top changes with it. Material changes affecting how we use information already collected will be emailed to customers on record.

My Prepack Cigars LLC, 10900 NW 21st St, Unit 230, Miami, FL 33172. Email order@mycigarstash.com, or use the contact page. Related reading: terms of sale, age verification, and shipping and state restrictions.