Privacy Policy

Empti, Inc. ("Empti," "we," "us," or "our") is a corporation organized under the laws of Nevada with its principal place of business at 6125 S. Valley View Blvd. #A, Las Vegas, NV 89118. We supply vape hardware, cartridges, and packaging to licensed businesses and to adult consumers.

This Privacy Policy explains how we handle personal information when you visit this website, place an order, request a quote or customization, apply for tax-exempt purchasing, or otherwise communicate with us. It applies to this website and to our related sales and support activities.

This policy does not apply to third-party services that operate under their own privacy policies, even when we link to them or hand you off to them. The clearest example is checkout: payment is completed on Shopify's infrastructure, and Shopify's own privacy policy governs what happens there.

This site and our products are intended only for adults 21 and over. We do not knowingly collect personal information from anyone under 21, and we never knowingly collect personal information from children under 13.

We collect only the categories below. We collect most of it directly from you; the rest is generated automatically as you use the site or is provided by a service that helps us operate.

What we do not collect. We do not collect your full payment card number, CVV, or bank credentials — you enter those on our payment provider's systems and they never reach our servers. We do not collect government identification numbers, biometric data, precise geolocation, health information, or information about your race, religion, union membership, sexual orientation, or political views. We do not ask for or store your date of birth as part of age confirmation. We do not buy personal information from data brokers.

Sensitive personal information. Tax exemption and resale certificate details are commercial records about a business rather than sensitive personal information, but we treat them as confidential and restrict internal access to the staff who need them to apply an exemption correctly.

We use personal information for these purposes and no others:

• Fulfilling orders. Taking payment, shipping products, providing tracking, handling returns, and honoring warranty claims.
• Responding to you. Answering support requests, preparing quotes, scoping custom orders, and following up on inquiries you started.
• Applying tax exemptions. Reviewing and validating certificates so we charge the correct tax, and retaining documentation for audit.
• Producing custom orders. Using artwork and specifications you submit to proof, tool, and manufacture your order.
• Operating and improving the site. Diagnosing errors, measuring aggregate traffic and performance, and improving the catalog and checkout.
• Security and fraud prevention. Detecting fraudulent orders, abuse, automated scraping, and unauthorized access.
• Age and eligibility screening. Confirming you meet the 21+ requirement and that we can lawfully ship to your jurisdiction.
• Legal and regulatory compliance. Meeting tax, recordkeeping, product compliance, and reporting obligations, and responding to lawful requests.
• Marketing you asked for. Sending email or SMS updates only where you opted in, and only until you opt out.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you, and we do not profile you for targeted advertising.

If we ever want to use your information for a materially different purpose, we will update this policy and, where the law requires it, ask for your consent first.

We disclose personal information only to service providers and contractors that process it on our behalf, under contract, for the limited purposes shown below. They are prohibited from using it for their own purposes.

Legal disclosures. We may disclose information when we reasonably believe it is required by law, subpoena, warrant, court order, or other legal process, or where disclosure is necessary to investigate suspected fraud, enforce our Terms of Service, or protect the rights, property, or safety of Empti, our customers, or the public. Where we are legally permitted to do so, we will attempt to notify you first.

Business transfers. If Empti is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its assets, personal information may transfer as part of that transaction. The receiving party will remain bound by this policy for information collected before the transfer unless and until you are given notice of and consent to a different policy.

We have not sold personal information, and we have not shared personal information for cross-context behavioral advertising, in the preceding 12 months. We do not do so now, and we have no plans to. "Sell" and "share" here carry the meanings given to them by the California Consumer Privacy Act as amended by the CPRA, which are broader than exchanging data for money.

We also do not knowingly sell or share the personal information of anyone under 16, which is straightforward for us because this site is restricted to adults 21 and over.

Because we do not sell or share, there is nothing for you to opt out of — but if that ever changes, we will update this section, post a clear notice, and provide a working opt-out mechanism before any such disclosure begins.

We run no advertising, targeting, or cross-site tracking technologies on this site. There is no ad pixel, no remarketing tag, and no third-party advertising cookie. What we do use is a small set of strictly necessary storage — your cart and age confirmation kept in your own browser, and one first-party session cookie that keeps your visit consistent between pages — plus two analytics products and one error monitoring service, described next.

Google Analytics 4. We use it to see which pages and products get attention, how people find us, and where the buying process falls down. It records page views, searches, cart activity, checkout starts, and form submissions in aggregate, along with a random identifier for your browser. We do not send it your name, email address, or the contents of any form field, and we do not join its identifier to your customer or order records. It is configured with Google Signals and ad personalization disabled, which keeps this measurement out of advertising and keeps our commitment not to share personal information for cross-context behavioral advertising accurate.

Klaviyo. We use Klaviyo to send email you opt into (newsletters and related marketing) and to measure onsite activity that improves those messages — for example, which products were viewed or added to a cart. When you subscribe we also store the buyer preference you select so we can send relevant offers. Quote, customization, and tax-exempt form submissions create corresponding events and profile fields in Klaviyo so sales can follow up. Onsite, Klaviyo may set a first-party __kla_id cookie and receive page and product views and cart events when analytics is allowed. Marketing email is sent only to addresses that subscribed; that consent is separate from the analytics cookie preference. We do not use Klaviyo for cross-site advertising networks.

Both Google Analytics and Klaviyo onsite scripts load only when analytics is allowed: visitors from the European Economic Area, the United Kingdom, and Switzerland are asked to Accept first; elsewhere they may load until you Reject them via the cookie bar or the Cookie preferences control in the footer. If your browser sends a Global Privacy Control signal or has Do Not Track enabled, neither analytics script is loaded and no analytics cookie is set.

Error monitoring. We use Sentry to find out when a page fails to load or a feature breaks. When something goes wrong it receives the error message and technical details of the failure, the page path where it happened, and your browser and device type. It sets no cookie and stores nothing in your browser. It does not record your screen or your keystrokes, and it does not capture what you type into a form: we strip the query string from every reported address and redact anything that looks like a name, email address, phone number, or postal address before a report is sent. Like analytics, the browser part of it is not loaded at all if your browser sends a Global Privacy Control signal or has Do Not Track enabled.

Failures that happen on our servers rather than in your browser are reported separately, and those reports are not affected by a Global Privacy Control or Do Not Track signal — a server error has to be recorded for the site to be fixed at all. They describe the request that failed, not the person who made it: they contain the page path, the error, and no browser identifier, no analytics identifier, and no contact details. All error reports, from either source, are deleted after 30 days.

Every cookie and browser storage key we set is itemized, with its purpose and lifetime, in our Cookie Policy.

Do Not Track and Global Privacy Control. We honor both for analytics (Google Analytics and Klaviyo onsite) and for browser-side error monitoring: if either signal is present, those scripts are never requested and no analytics cookie is set. For analytics we also record that preference so the cookie bar does not need to ask. The one thing these signals do not switch off is server-side error logging, described above, which records failing requests rather than people. Beyond that there is nothing further for these signals to disable, because we do not sell or share personal information and run no cross-site advertising tracking.

We keep personal information only as long as we need it for the purposes described above, or as long as the law requires. In practice that means:

When a retention period ends, we delete the information or de-identify it so it can no longer be associated with you. If you ask us to delete information we are legally required to keep — order records supporting a tax filing, for instance — we will delete what we can, tell you what we must retain, and explain why.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, and alteration. These include encryption of data in transit using HTTPS across the entire site, restricting access to personal information to personnel who need it for their role, keeping payment card data off our systems entirely by delegating payment to a specialist processor, storing our cart identifier in an HttpOnly cookie that scripts cannot read, serving protected assets through short-lived signed URLs, and contractually requiring our service providers to maintain appropriate security.

No system is perfectly secure, and no transmission over the internet can be guaranteed. We cannot and do not warrant absolute security. You are responsible for keeping any account credentials confidential and for notifying us promptly at support@empti.com if you believe your account or information has been compromised. If a breach affecting your personal information occurs, we will notify you and any required regulator within the timeframes the applicable law prescribes.

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — among other states with comprehensive privacy laws — have specific rights over their personal information. As a matter of policy we extend the rights below to everyone who contacts us, regardless of where you live, except where doing so would conflict with a legal obligation.

• Know and access. Ask what categories and specific pieces of personal information we hold about you, where we got it, why we use it, and who we disclosed it to.
• Correct. Have inaccurate personal information about you fixed.
• Delete. Have your personal information erased, subject to the legal and operational exceptions described in the retention section.
• Portability. Receive a copy of the information you provided in a portable, machine-readable format.
• Opt out of sale, sharing, targeted advertising, and profiling. We do none of these, so there is nothing to opt out of — but the right stands if that changes.
• Limit use of sensitive personal information. We do not collect sensitive personal information for any purpose that would trigger this right.
• Withdraw consent. Unsubscribe from marketing email or SMS at any time, using the link or reply instruction in the message, or by emailing us.
• Non-discrimination and non-retaliation. We will not deny you products, charge you a different price, provide a lower quality of service, or retaliate in any way because you exercised a privacy right. We operate no financial incentive programs tied to personal information.

How to make a request. Email support@empti.com with the subject line "Privacy Request," or write to us at the postal address at the end of this policy, or use our contact form. Tell us which right you are exercising and enough detail for us to locate your records.

Verification. To protect you, we must verify your identity before acting on a request to access, correct, or delete. We will generally ask you to confirm information we already hold — such as an order number and the email address used to place it — and we will ask for more where the request is broad or the information is sensitive. We use the information you provide for verification only, and we do not create new records from it. If we cannot verify you, we will tell you and, where possible, treat the request as a request about categories of information rather than specific pieces.

Authorized agents. You may use an authorized agent to submit a request. We will ask the agent for written, signed permission from you, or a valid power of attorney, and we may still ask you to verify your own identity and confirm you authorized the request.

Timing. We acknowledge requests within 10 days and respond substantively within 45 days. Where a request is complex or we receive several from you, we may extend by up to a further 45 days and will tell you why before doing so. Requests are free; we may charge a reasonable fee or decline only where a request is manifestly unfounded, excessive, or repetitive, and we will explain our reasoning if we do.

Appeals. If we decline your request in whole or in part, you may appeal by replying to our decision with the word "Appeal" in the subject line. A person not involved in the original decision will review it and respond within 45 days with the outcome and our reasoning. If we deny the appeal, we will tell you how to contact your state attorney general to complain. Colorado, Connecticut, Virginia, and several other states guarantee this appeal right; we extend it to everyone.

California Shine the Light. California Civil Code § 1798.83 lets California residents ask about disclosures of personal information to third parties for their direct marketing purposes. We make no such disclosures.

You must be at least 21 years old to use this site or purchase our products. We present an age confirmation screen before you can browse. Your confirmation is stored as a flag in your own browser and is not transmitted to us; we do not collect or retain your date of birth for this purpose.

We do not knowingly collect personal information from anyone under 21, and never from a child under 13. If we learn that we have collected such information, we will delete it promptly. A parent or guardian who believes a minor has provided us personal information should email support@empti.com and we will remove it.

This site links to third-party websites and hands you off to third-party services, including Shopify for checkout. We do not control those parties and are not responsible for their privacy practices or content. Review their privacy policies before providing them information.

We are based in the United States and we process and store personal information in the United States. Our service providers may process information in other countries. If you access this site from outside the United States, understand that your information will be transferred to and processed in the United States, where data protection law may differ from the law of your location. We ship only within the region described on our shipping page, and this site is not directed at individuals in the European Economic Area, the United Kingdom, or Switzerland.

We may update this Privacy Policy to reflect changes in our practices, our technology, or the law. When we do, we will revise the "Last updated" date at the top of this page. If a change materially reduces your rights or materially expands how we use personal information we already hold, we will provide more prominent notice — such as a site banner or an email to the address associated with your orders — before the change takes effect, and we will obtain your consent where the law requires it.

We encourage you to review this page periodically. Continuing to use the site after a change takes effect means you accept the updated policy.

For any privacy question, to exercise a right, or to report a concern, email support@empti.com or use our contact form. Written notice may be sent to:

Empti, Inc.6125 S. Valley View Blvd. #ALas Vegas, NV 89118Attn: Privacy

Empti, Inc. is the business responsible for the personal information described in this policy.