Privacy notice

This notice covers patient accounts and document verification at PuffBox, 921 Eastern Ave, Augusta, Maine 04330.

What you provide

We collect your legal name, contact email, date of birth, Maine MMCP certification serial and expiration, and photos of your current Maine ID and MMCP certification. Passkey sign-in stores a public key; your device PIN, biometric data and private passkey are not sent to PuffBox.

Why we collect it

Staff use these records to check that you meet PuffBox’s 18+, Maine ID and Maine MMCP requirements. Submission does not guarantee approval. New, changed, incomplete or expired documents cannot authorize purchases or membership.

How access is restricted

Account details and document photos are encrypted before storage on our Cloudflare-hosted backend. Only authorized verification staff can retrieve photos through the protected review service. Document access and decisions are recorded. Photos are not published, used in grow records, or sent to a payment processor. Do not upload medical histories or other documents that we have not requested.

Retention and requests

PuffBox keeps verification records for four years after the most recent verification update to support its business recordkeeping. Records connected to transactions may need to remain longer where legally required. To request a correction, account closure or review of retained information, contact store management in person or by mail at the address above. Do not send ID or certification photos by email. We review deletion requests against applicable retention obligations.

Membership payments

PUFF BOX recurring billing is not active yet. Before enrollment opens, the payment provider, price, contents, authorization and cancellation terms will be shown. A payment provider will handle bank linking; PuffBox will not ask you to enter bank credentials into this website.

Age acknowledgment

The browsing gate checks the date you enter and saves only a same-day tab-session acknowledgment. It does not save or transmit that date of birth and does not approve your patient account.