1. Introduction & Agreement
WINDBAR (referred to in this Policy as "the Company," "we," "us," or "our") operates this website to provide product information, technical consultation, and business cooperation channels to qualified U.S. visitors and business partners.
Important Notice: This website is an information and inquiry platform. It provides product information, user registration, and business inquiry functions only. It does not support online ordering, payment processing, order fulfillment, or product returns.
This Policy only applies to data directly collected via this Site and does not cover data processing activities of third-party links, web plugins or partner platforms. By accessing or browsing the Site, registering a B2C personal account or B2B enterprise account, and submitting inquiry forms, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you disagree with any term herein, you shall immediately cease accessing and using all services of this Site.
Special Notice: The Company's public electronic vapor product scope is limited to products verified by third-party testing as zero-nicotine and free of tobacco-derived ingredients. The Company also provides OEM/ODM manufacturing of empty, CBD-compatible vaping hardware only, and does not fill, formulate, supply, or handle any CBD e-liquid, hemp extract, or THC-containing material; brand partners are solely responsible for such content and its compliance with applicable federal and state law. The Company does not manufacture, sell, or supply THC-containing devices. For details of the Company's full scope of business, please see our Statement of Business Scope.
2. Key Definitions
- Personal Information: Information that directly or indirectly identifies, relates to, links to, or can be associated with a specific U.S. natural person consumer, B2B enterprise contact, or household/business entity, including identifiers, contact information, user profiles, inquiry records, device metadata, geolocation, and age verification materials.
- Sensitive Personal Information: Government-issued identification numbers, precise geolocation data, biometric information, and age verification records, as defined under the CCPA/CPRA. This Site does not collect or store any sensitive data such as payment credentials or bank card information.
- Sale/Sharing: As defined under California privacy law, the disclosure of Personal Information to third parties for valuable consideration, or the use of Personal Information for cross-context behavioral advertising tracking.
- U.S. User: A natural person physically located within the United States who accesses, browses or uses the Site's services, including B2C individual visitors and authorized B2B enterprise contacts.
- Age Verification Data: Date of birth, government-issued identity documents, and validation logs collected pursuant to the federal PACT Act, used to restrict minors from accessing vaping product information and submitting commercial inquiries or cooperation applications.
3. Categories of Personal Information We Collect
We adhere to the data minimization principle and collect personal data only as described below.
3.1 Information You Voluntarily Submit
3.2 Automatically Collected Technical Data
This Site collects lightweight device and browsing data via cookies, web beacons and tracking pixels, including device model, operating system, browser type, access IP address, browsing track, page dwell time, saved product records, and privacy control signals (Global Privacy Control/GPC, Do Not Track/DNT). We only derive approximate geolocation from IP addresses and will never collect precise GPS location data without the user's explicit written consent.
3.3 Data from Authorized Third Parties
We obtain supplementary data from compliant age verification vendors, cloud server providers and anti-fraud risk control tools, solely used for identity verification, malicious registration interception, website security operation and compliance audits, and shall not be used for irrelevant marketing purposes.
Special Statement: This Site has no transaction functions, and we do not collect any transaction-related data including orders, bills, bank card information, logistics tracks, after-sales return and exchange data at any time.
- Basic Account Data: Username, encrypted login password, full name, email address, phone number, and mailing address;
- B2B Exclusive Data: Enterprise name, business qualification documents, contact person's position, cooperation intention, and enterprise correspondence address;
- Inquiry Data: Product consultation content, customized requirements, sample request messages, and business communication demands;
- Age Verification Data (required for vapor product inquiries): Date of birth, and where applicable, government-issued identification documents and verification logs. Original ID images are permanently deleted within 72 hours of verification; only encrypted audit logs are retained. Where the Website uses a self-attested age gate only, persistence may be stored locally in the visitor's browser;
- Communication & Feedback Data: Online customer service chat records, form messages, user reviews, complaints and optimization suggestions;
- Marketing Preference Data: Opt-in and opt-out selections for email/SMS product updates and industry newsletters.
4. Lawful Purposes for Data Processing
We process personal information for the following business purposes, as permitted by applicable U.S. federal and state law:
1. User Service Operation: Complete account registration, login and permission management, process product inquiries, sample requests and B2B business docking, and respond to customer service consultations and user feedback;
2. Regulatory Compliance Obligations: Enforce mandatory age verification requirements under the PACT Act, block minors from accessing vaping-related consultation channels, retain industry regulatory and tax compliance records, and respond to lawful data requests from judicial authorities and regulators;
3. Website Security & Optimization: Troubleshoot technical faults, prevent hacker intrusions, identify malicious registrations and fake inquiries, and optimize product display logic and user browsing experience;
4. Informational Communication: Send mandatory service messages such as inquiry replies and account security notifications; product and industry promotional content is only sent upon the user's explicit opt-in, with a one-click unsubscribe function embedded in all marketing emails;
5. Legitimate Interest Protection: Enforce the Terms of Service, resolve user disputes, prevent fraudulent activities, and protect the legitimate commercial rights and interests of the WINDBAR brand;
6. Statistical Analysis & Research: Generate de-identified, non-traceable aggregated statistical data for website operation analysis, product display optimization and industry trend research;
We shall not use Sensitive Personal Information for non-core business purposes such as targeted advertising and user profiling without the user's separate explicit consent.
Special Statement: This Site does not conduct online transactions, and user data will never be used for e-commerce scenarios including order fulfillment, payment settlement, logistics delivery, and after-sales returns and exchanges.
5. Information Sharing & Disclosure
We will not share user data with advertisers or traffic platforms for cross-context targeted tracking without the user's voluntary explicit consent. California users hold the permanent right to opt out of data sharing for targeted advertising.
Special Statement: This Site has no cooperation partners for payment or logistics, and we will not share any user information with payment institutions or logistics enterprises.
- WINDBAR DOES NOT SELL your Personal Information under any circumstances. We only share necessary data with third-party vendors who have signed data compliance agreements under the following restricted and legal scenarios, and all third parties are subject to strict data usage restrictions:
- Authorized Compliant Vendors: Qualified age verification platforms, compliant cloud server providers, website data analytics tools, and outsourced customer service teams. All vendors may only perform designated services under contractual agreements and shall not reuse, forward or resell user data for secondary purposes;
- Mandatory Legal Disclosure Scenarios: Disclose relevant user data pursuant to valid court subpoenas, official regulatory investigation orders, and lawful requirements from law enforcement authorities;
- Business Entity Change Scenarios: In the event of brand merger, acquisition, asset liquidation or other entity changes, the data transferee must assume all data compliance obligations under this Privacy Policy. We will notify all registered users in advance via email;
- Aggregated Anonymous Data: Aggregated statistical data with all personal identifiers removed may be used for industry market analysis and product research, and cannot be linked to any specific user.
6. Data Retention & Security Protection
6.1 Data Retention Period (Strictly Adhering to Data Minimization Principle)
6.2 Technical & Administrative Security Safeguards
We implement full-site SSL/TLS transmission encryption, encrypted database storage, role-based internal access control, regular vulnerability scanning and penetration testing, and company-wide data compliance training. A data breach emergency response mechanism is established to complete risk disposal and user notification within statutory time limits.
Please note that internet data transmission and electronic storage cannot achieve 100% absolute security. Users shall properly safeguard their account login credentials to prevent account theft risks.
- Basic Account Data: Retained during the validity period of the account; all retrievable personal data will be erased within 45 days after account deletion, and statutory regulatory and tax records will be retained for 5-7 years in accordance with U.S. federal and state laws;
- Age Verification Materials: Original ID document images are permanently deleted within 72 hours after verification, with only encrypted verification logs retained for compliance audits;
- Inquiry & Communication Data: Retained while the account is active, and deleted synchronously upon account cancellation, excluding regulatory audit data required by law;
- Marketing Contact Data: Retained until the user submits an unsubscribe request or data deletion request;
- Transaction Data: This Site does not generate or store any transaction data, with no corresponding retention obligations.
7. U.S. User Statutory Privacy Rights
Residents of California, Virginia, Colorado, Utah, Connecticut and other regulated U.S. states have the following statutory privacy rights. You may submit rights requests via our dedicated privacy email or the built-in website privacy request form. We will respond within 45 calendar days upon receipt of the request, with a lawful 45-day extension permitted for complex compliance matters.
Request Verification Rules: To prevent unauthorized data access, we will conduct compliant identity verification for applicants and will not request excessive sensitive information. User-authorized agents may submit rights requests on behalf of users with written authorization documents.
- Right to Know: Request disclosure of the categories of Personal Information we have collected, data sources, usage purposes, and third-party sharing lists within the past 12 months;
- Right to Delete: Request permanent erasure of your Personal Information (excluding statutorily retained records, inquiry data for compliance audits, and ongoing risk control verification data);
- Right to Correct: Amend inaccurate or incomplete account registration information and filed inquiry data;
- Opt-out of Targeted Advertising (California Exclusive): Click the "Do Not Sell or Share My Personal Information" link in the website footer to opt out of advertising tracking; this Site recognizes browser Global Privacy Control (GPC) signals as valid statutory opt-out instructions;
- Right to Limit Sensitive Data Usage: Restrict your Sensitive Personal Information from being used for behavioral advertising, user profiling, and secondary business scenarios unrelated to account operation and inquiry processing;
- Right to Data Portability: Obtain core data of your personal registration information and historical inquiry records in machine-readable format;
- Right to Non-Discrimination: We shall not deny basic website services, implement differential pricing, or degrade service quality when you exercise your statutory privacy rights;
- Right to Appeal: If your privacy rights request is rejected, you may submit a review appeal to our compliance team within 30 days.
8. Cookies & Tracking Technologies
This Site uses cookies, pixel beacons and similar tracking technologies, categorized by function into Necessary Cookies and Optional Analytics/Marketing Cookies.
- Necessary Cookies: Used for account login authentication, saved product collection retention, user privacy preference storage, and age verification popup triggering. Disabling these cookies will disable core website functions such as account registration and inquiry submission;
- Analytics/Marketing Cookies: Used for website traffic statistics, user browsing preference analysis, and personalized product information push. Users may disable them via browser settings or the website privacy center;
- Privacy Tracking Compatibility: This Site is fully compatible with browser Do Not Track (DNT) and Global Privacy Control (GPC) signals. The system will automatically terminate all targeted advertising tracking activities once enabled by the user.
9. Minor Protection (COPPA + PACT Act Compliance)
All vaping products (verified by third-party testing as zero-nicotine) and commercial cooperation channels of WINDBAR are exclusively open to adult users aged 21 and older within the United States. We fully comply with the Children's Online Privacy Protection Act (COPPA) and the federal PACT Act.
If you identify that a minor has submitted personal information to this Site without authorization, please initiate a data deletion request via our privacy contact channels immediately.
- Prohibition of Knowingly Collecting Minor Data: We do not knowingly collect any Personal Information from individuals under 21 years of age. Once minor data is identified, it will be permanently and completely deleted within 24 hours;
- Age Access Control: Age verification is required on all vapor product pages, inquiry forms, and B2B application pages. Users who do not pass verification will not be able to view full product information or submit inquiries;
- Minor Marketing Ban: Any product promotion or brand marketing content targeting audiences under 21 years of age is strictly prohibited.
10. Third-Party Links
Pages on this Site may contain external links to social media, industry news platforms, partner official websites and other third-party websites. This Privacy Policy only governs the data processing activities of WINDBAR itself and does not apply to any third-party platforms. We shall not be jointly liable for the privacy rules, data security or content compliance of third-party websites.
Before accessing external third-party links, users shall independently review the privacy policy and terms of service of the corresponding platform and bear access risks on their own.
Special Statement: This Site does not contain any redirect entrances for third-party payment, transactions or logistics.
11. Policy Amendments & Notifications
We may revise this Privacy Policy timely based on updates to U.S. federal/state privacy laws, brand business adjustments, and changes to regulatory requirements.
For material amendments to core clauses including user rights, data usage purposes and minor protection, we will publish the revised content on the website homepage and send a 30-day advance email notice to all registered users. The "Last Updated" date at the top of this document indicates the effective time of the latest revision.
Your continued access to the website, use of account functions, and submission of inquiries after the effective date of this Policy constitute voluntary acceptance of all revised policy terms.
12. Privacy Contact Information
- For privacy inquiries, statutory rights requests (access, correction, deletion, opt-out of sale/sharing), review appeals, compliance complaints and other demands, please contact the WINDBAR compliance team:
- Dedicated Privacy Email: [email protected]
- U.S. Registered Physical Address: Contact Windbar for our registered business address.
- Privacy Request Form URL: https://windbar.ai/contact?purpose=privacy-request
13. Governing Law & Go-Live Deployment Guidelines
13.1 Governing Law
This Privacy Policy shall be governed by the federal laws of the United States and the laws of the State of California, without regard to conflict of law rules. All disputes arising from this Policy shall be under the exclusive jurisdiction of the state or federal courts located in California, USA.
13.2 Deployment Notes
Website footer compliance links, mandatory age verification, and the statement that this Site has no online transaction functions and does not collect payment or logistics data remain in force for public deployment.
This policy should be reviewed by qualified U.S. legal counsel before publication.