Privacy Policy

1. What we collect

On this website. The site has no accounts, analytics, advertising or tracking tools. It keeps a few settings in your browser:

• one cookie, nm-age-verified, set when you confirm the age gate, so you aren't asked again for 30 days; and
• in your browser's local storage, the same age-gate confirmation, your light or dark theme, and your list or grid menu view.

None of these identify you, and we don't use them to track you. Our website host keeps basic technical logs of requests, such as IP address, browser type, the page requested and the time, to run and protect the site.

Maps and photos from other companies. Our homepage and Visit page show a map from Google, and product photos load from our point-of-sale provider, Dutchie. When your browser loads them, Google and Dutchie receive your IP address and browser details, and Google may set its own cookies. Their privacy policies cover what they do with that information.

In our store. When you buy from us, we record what Maine law and our point-of-sale system require: your name and contact details, the details on your medical cannabis certification or card and your ID (such as your date of birth, card number and expiration date), and what you buy.

When you contact us. If you call, email or use the Contact Us form, we keep what you send so we can respond. The form asks for your name, email, phone number (optional) and your message; we store it in our database and our email provider delivers it to our inbox.

2. How we use it

• to serve you at the counter and check that you're eligible to buy;
• to keep the records Maine law requires;
• to answer your questions;
• to run, protect and improve this website; and
• to understand our business, for example which products sell.

We don't sell your personal information, and we don't share it with other companies for their advertising.

3. Who we share it with

We share personal information only with:

• Companies that handle it for us: Dutchie, our point-of-sale provider, which holds our patient and sales records; Supabase, which hosts the database behind our internal operations tools; Vercel, which hosts this website; and our email provider.
• Regulators, when the law requires it, such as the Maine Office of Cannabis Policy.
• Law enforcement, only as described in section 4.

4. Patient confidentiality

We keep patient identity confidential. Maine law says a dispensary can't be required to give a law enforcement officer information that could identify a patient without a warrant requiring it (22 M.R.S. §2425-A(14)(I)). Our policy is to disclose it only with your written consent, when a warrant or court order requires it, or when a state regulator requires it by law.

5. Cookies and your browser

The only cookie this site sets is the age-gate cookie described in section 1. You can clear it, and the local-storage settings, in your browser's settings at any time; you'll just be asked to confirm the age gate again. The Google map may set its own cookies, which you can also clear or block in your browser.

6. How long we keep it, and how we protect it

We keep sales and patient records for as long as Maine law requires — at least four years for dispensary records (22 M.R.S. §2430-J(1)(B)) — and longer when another law or a real business need requires it. Our website host keeps its technical logs for a short time.

Access to patient records is limited to the staff who need it, and our internal tools require sign-in. No system is perfectly secure, but we work to protect your information.

7. If there's a data breach

If a security breach exposes your personal information, we will notify you, and the Maine Attorney General where required, within 30 days after we learn of it and its scope, as Maine law requires (10 M.R.S. §1348).

8. Your choices, children and changes

• Your information. You can ask what personal information we hold about you, or ask us to correct it. Some records must be kept by law and can't be deleted on request.
• Children. This site is for qualifying patients and registered caregivers. It is not directed to children, and we don't knowingly collect personal information from them through it.
• Changes. We may update this policy; the date at the top of this page shows when it last changed.

Questions or requests: call (207) 370-5603, email hello@newmillcannabis.com, or write to New Mill LLC, 518 West Bethel Road, Bethel, ME 04217.