Privacy policy
Privacy Policy
21 Cigar Company LLC, doing business as 21 Cigar Co.
Last updated: July 26, 2026
This Privacy Policy describes how 21 Cigar Company LLC ("we," "us," or "our") collects, uses, and discloses personal information when you visit 21cigarcompany.com (the "Site"), purchase from us, or otherwise interact with us (collectively, the "Services").
"You" and "your" refer to you as a user of the Services, whether you are a customer, a website visitor, or another individual whose information we collect.
Scope. Our Services are offered only to persons 21 years of age or older located in the United States. We ship only to U.S. street addresses in the states listed in our Shipping Policy — not to P.O. Boxes, APO/FPO addresses, or U.S. territories. We do not direct the Services to individuals outside the United States.
1. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices, our vendors, or applicable law. We will post the revised policy on the Site, update the "Last updated" date above, and take any additional steps required by law, including notifying you of material changes.
2. Personal Information We Collect
2.1 Information you provide directly
Basic contact details — name, postal address, phone number, email address.
Order information — name, billing address, shipping address, email address, phone number, order contents, and payment confirmation.
Payment information — card and billing details submitted through our card processor. We do not store full payment card numbers on our systems. For bitcoin payments, see Section 6.
Age verification information — see Section 5.
Account information — username, password (stored in hashed form), order history, saved addresses, and preferences.
Shopping information — items you view, add to your cart, or save to a wishlist.
Customer support information — the contents of your messages to us and any information you choose to include in them.
Marketing preferences — your email subscription status and interaction history.
You may decline to provide information, but doing so may prevent you from completing a purchase or using certain features.
2.2 Information we collect automatically
We collect information about your interactions with the Services ("Usage Data") through cookies, pixels, tags, and similar technologies ("Cookies"):
- Device information — device type, operating system, browser type, screen size, language settings.
- Network information — IP address, approximate location derived from IP address, connection details.
- Interaction data — pages viewed, referring URL, time on page, links and buttons clicked, search terms entered on the Site, cart activity.
See Section 4 for details on Cookies and your choices.
2.3 Information we obtain from third parties
- Our e-commerce platform, which collects and processes information to operate the Site.
- Our payment processors, which collect and verify payment and billing information and return transaction results, fraud scores, and chargeback notices to us.
- Our age verification provider, which returns a verification result to us (see Section 5).
- Our shipping and fulfillment providers, which return tracking, delivery confirmation, and adult-signature confirmation. Carriers may inspect government-issued identification at the point of delivery; the carrier, not us, collects and retains that information under its own policies.
- Analytics and advertising providers, which supply Usage Data, audience and measurement data, and advertising performance data.
- Fraud prevention and identity providers, which supply risk signals associated with an order.
Information obtained from third parties is handled under this Privacy Policy. We do not control and are not responsible for the accuracy of third-party information or the privacy practices of those parties.
2.4 Sensitive personal information
Some information collected in connection with your order is classified as "sensitive personal information" under California law or "sensitive data" under other state laws. This includes payment account information and information submitted for age verification.
Depending on what verification requires, age verification may involve your date of birth, the last four digits of a Social Security number, a driver's license or state ID number, or an image of a government-issued ID. Most of this is submitted directly to our verification provider rather than to us. Section 5 explains what we actually receive and retain.
We collect and use sensitive personal information only for the purposes for which it was provided — completing your transaction, verifying your age as required by law, preventing fraud, and complying with our legal obligations. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose it for purposes that would require us to offer a right to limit its use under California law.
3. How We Use Personal Information
| Purpose | Description |
|---|---|
| Providing the Services | Processing payments, verifying eligibility, fulfilling and shipping orders, managing claims and returns, sending order and account notifications, enabling product reviews, and otherwise performing our contract with you. |
| Age and eligibility verification | Confirming you are 21 or older and that we are permitted to ship to your address, as required by federal, state, and local law. |
| Marketing and advertising | Sending promotional email; showing you tailored advertising on the Site and on third-party platforms; measuring the performance of that advertising. |
| Security and fraud prevention | Detecting, investigating, and preventing fraudulent, unauthorized, or unlawful activity; securing accounts; verifying transactions; managing chargebacks. |
| Customer support | Responding to inquiries and resolving issues. |
| Analytics and improvement | Understanding how the Services are used and improving them. |
| Legal and regulatory compliance | Meeting tax, tobacco, recordkeeping, reporting, and other legal obligations; responding to lawful requests; establishing, exercising, or defending legal claims; enforcing our terms. |
4. Cookies, Analytics, and Advertising
We use Cookies to operate the Site, remember your preferences, run analytics, and support advertising. Our e-commerce platform, analytics providers, and advertising partners also set Cookies and may collect information about your activity on the Site and, in some cases, across other websites over time.
Your choices. You can manage or block Cookies through your browser settings. Blocking Cookies may degrade Site functionality and will not necessarily stop all information sharing with third parties.
Global Privacy Control. We honor the Global Privacy Control (GPC) signal. If your browser or extension transmits a GPC signal, we will treat it as a request to opt out of the sale or sharing of personal information and of targeted advertising for that browser. Because a GPC signal is browser-specific and not tied to your identity, you should also submit a request through Section 10 if you want the opt-out applied to your account across devices.
Do Not Track. Browsers may transmit a "Do Not Track" signal. There is no common industry standard for interpreting it, and we do not currently respond to Do Not Track signals. We do respond to GPC as described above.
5. Age Verification
Because we sell age-restricted tobacco products, every order is subject to age verification through a third-party verification service before it is fulfilled.
Verification is generally performed against public and commercial records using the name, address, and date of birth you supply at checkout. If those records are insufficient, the service may ask you to provide additional information, which may include the last four digits of your Social Security number or an image of a government-issued photo ID.
What we receive and keep. Our verification provider processes that information under its own privacy policy. We receive the verification outcome, the date and time of verification, and a reference identifier, and that is what we retain in our own records. We do not store images of your government-issued ID or your full Social Security number on our systems. Please review the verification provider's privacy policy for how it handles information you submit directly to it.
California orders. California's STAKE Act requires us to verify your age before shipment, confirm the order by telephone after 5:00 PM Pacific, and obtain an adult signature at delivery. We use your phone number for that confirmation call.
All shipments of cigars require an adult signature at delivery.
6. Bitcoin Payments and Public Blockchain Data
We accept bitcoin through a self-hosted BTCPay Server instance running on third-party cloud infrastructure. How your payment is handled depends on which method you use.
On-chain payments settle directly to a wallet we control. No payment processor sits between us, and no third-party intermediary receives your order information.
Lightning payments are settled through Strike, which provides our Lightning liquidity. Strike is a custodial service. A Lightning payment passes through Strike before reaching us, and Strike handles that transaction under its own privacy policy and its own regulatory obligations, which may include recordkeeping and identity requirements that do not apply to us. We do not send Strike your name, shipping address, or order contents — but the payment itself is not a direct peer-to-peer transfer. If you would rather avoid a custodial intermediary, pay on-chain.
Please read this carefully:
- Bitcoin transactions are recorded on a public, permanent, distributed ledger. Transaction amounts, timestamps, and the addresses involved are publicly visible to anyone and are outside our control.
- We cannot delete, alter, or anonymize on-chain data. A request to delete your personal information will remove information from our systems as described in Section 10, but it will not and cannot remove any record from the Bitcoin blockchain.
- Our internal records associate a payment with an order for accounting, tax, and support purposes. That association exists in our records for the retention periods in Section 9, and we do not publish it. However, anyone with independent knowledge of an address you control may be able to draw inferences from public chain data.
- If we issue a refund in bitcoin, we send you a claim link through which you supply your own receiving address. That address is retained with the refund record.
If on-chain visibility is a concern for you, consider the privacy practices you use for the wallet you pay from. We cannot advise you on wallet privacy, but we will not require you to reuse an address.
Refunds on Lightning payments may be issued on-chain where a Lightning refund is not practical. We will tell you which method we're using before we send it.
7. How We Disclose Personal Information
Service providers and processors — vendors that perform services for us under contract, including our e-commerce platform, payment processors, age verification provider, email marketing platform, customer relationship management systems, shipping and fulfillment software and carriers, inventory management, cloud hosting, IT support, and analytics providers. These vendors are permitted to use the information only to provide services to us.
Advertising and marketing partners — as described in Section 8.
With your direction or consent — for example, when you ask us to ship to a third party or connect a social media account.
Corporate transactions — in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, including during diligence for such a transaction.
Legal, regulatory, and safety — to comply with applicable law and lawful requests (including subpoenas, warrants, and tax or tobacco regulatory requirements); to enforce our terms; to establish, exercise, or defend legal claims; and to protect the rights, property, or safety of 21 Cigar Co., our customers, or others.
Tobacco delivery-sale reporting. Certain states require sellers who ship tobacco products directly to consumers to register with state authorities and to file periodic reports identifying purchasers, shipping addresses, and quantities shipped. Where such a requirement applies to an order, we will disclose the required information to the applicable state agency. This disclosure is legally mandated and is not subject to opt-out.
Categories disclosed in the preceding 12 months
| Category of personal information | Categories of recipients |
|---|---|
| Identifiers (contact details, order and account information) | Service providers; advertising and marketing partners; carriers; state tax and tobacco authorities where required |
| Commercial information (order details, shopping activity, support communications) | Service providers; advertising and marketing partners |
| Internet or other network activity (Usage Data) | Service providers; advertising and marketing partners |
| Financial information (payment and billing details) | Payment processors; fraud prevention providers |
| Sensitive personal information (age verification and payment account information) | Age verification provider; payment processors — for the permitted purposes in Section 2.4 only |
8. Sale of Personal Information, Sharing, and Targeted Advertising
We do not sell personal information for money.
However, we use analytics and advertising technologies that disclose identifiers and Usage Data to advertising partners so we can show you relevant advertising on other platforms and measure its performance. Under California, Virginia, Colorado, Connecticut, and similar state privacy laws, this activity may be considered a "sale" of personal information, "sharing" for cross-context behavioral advertising, or processing for "targeted advertising."
You may opt out. To do so:
- Submit a request as described in Section 10, or
- Enable a Global Privacy Control signal in your browser (see Section 4), or
- Use the "Do Not Sell or Share My Personal Information" link in the footer of 21cigarcompany.com.
We do not knowingly sell or share the personal information of consumers under 16 years of age. Because the Services are restricted to persons 21 and older, we do not knowingly collect such information at all.
We do not use personal information for automated decision-making or profiling that produces legal or similarly significant effects concerning you.
9. Retention
We retain personal information only as long as necessary for the purposes described in this policy, to comply with legal obligations, to resolve disputes, and to enforce our agreements. Our general practice:
| Information | Retention period |
|---|---|
| Order, transaction, and tax records | 7 years from the date of the transaction |
| Age verification result and reference ID | 5 years from the date of verification, or longer where state law requires |
| Account information | For the life of the account, then 2 years after closure |
| Marketing contact and consent records | Until you unsubscribe, then 3 years to evidence consent and honor your opt-out |
| Customer support communications | 3 years |
| Usage Data and analytics | Generally 26 months |
| Bitcoin blockchain records | Permanent and outside our control (see Section 6) |
Where a legal hold, open dispute, chargeback, or regulatory obligation applies, we retain the relevant records until it is resolved.
10. Your Rights and Choices
Depending on where you live, you may have some or all of the following rights:
- Access / know — request the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the categories of recipients.
- Delete — request deletion of your personal information, subject to the exceptions below.
- Correct — request correction of inaccurate personal information.
- Portability — receive a copy of your personal information in a portable format.
- Opt out of sale, sharing, and targeted advertising — see Section 8.
- Limit use of sensitive personal information — we do not use sensitive personal information for purposes that trigger this right (see Section 2.4).
- Withdraw consent — where we rely on your consent.
- Opt out of marketing — unsubscribe from emails using the link in any marketing email, or reply STOP to any marketing text. You will still receive transactional messages.
- Non-discrimination — we will not deny you goods or services, charge you a different price, or provide a different level of quality because you exercised a privacy right.
- Appeal — if we decline your request, you may appeal.
How to submit a request. Email contact@21cigars.com with the subject line "Privacy Request," or use the request form linked in the Site footer. Because we operate exclusively online, email is our designated method for consumer requests.
Verification. We will take reasonable steps to verify your identity before acting, typically by confirming control of the email address associated with your account or orders, or by asking you to confirm details of a prior transaction. We may decline a request we cannot verify. You may use an authorized agent, who must provide written proof of authorization; we may still verify your identity directly.
Timing. We will confirm receipt within 10 business days and respond substantively within 45 days. Where reasonably necessary, we may extend that period by an additional 45 days and will tell you why.
Appeals. To appeal a denied request, reply to our response with the word "Appeal." We will respond to appeals within 45 days with a written explanation of our decision. If your appeal is denied, you may contact your state Attorney General to submit a complaint.
Limits on deletion. We may retain information despite a deletion request where necessary to complete a transaction, comply with a legal obligation (including tax and tobacco recordkeeping requirements), detect or prevent fraud, exercise or defend legal claims, or maintain the security and integrity of our systems. We cannot delete records written to a public blockchain (see Section 6).
11. User-Generated Content
If you post reviews, comments, or other content in public areas of the Services, that content and any information you include in it will be publicly visible and may be indexed by search engines. We are not responsible for information you choose to make public or for how others use it.
12. Third-Party Sites and Links
The Services may link to third-party websites, platforms, and social media. We do not control and are not responsible for their privacy practices, security, or content. Review their policies before providing information.
13. Children's Data
The Services are intended solely for persons 21 years of age or older. We do not knowingly collect personal information from anyone under 21, and we do not knowingly collect personal information from children under 13 as defined by the Children's Online Privacy Protection Act. If you are a parent or guardian and believe a minor has provided us with personal information, contact us and we will delete it.
14. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and vendor diligence. No system is completely secure, and we cannot guarantee absolute security. Information you send us by ordinary email is not encrypted end to end; please do not send payment card numbers, government ID numbers, or other sensitive information by email.
If we become aware of a breach affecting your personal information, we will notify you and applicable authorities as required by law.
15. Where Your Information Is Processed
We and our service providers process personal information in the United States. Because the Services are offered only in the United States, we do not routinely transfer personal information internationally, and this policy is not intended to describe rights under the EU or UK General Data Protection Regulation.
If you access the Site from outside the United States, understand that your information will be processed in the United States under United States law.
16. Contact Us
21 Cigar Company LLC 495 Grand Blvd, Ste 206 Miramar Beach, FL 32550
Phone: (813) 336-2066 Email: contact@21cigars.com Privacy requests: contact@21cigars.com (subject line "Privacy Request")
Read alongside our Terms of Service, Shipping Policy, and Return and Refund Policy.
This Privacy Policy is a description of our practices. It is not legal advice and does not create rights beyond those provided by applicable law.