Your privacy, by design

We collect only what is needed to fulfil your order: your chosen delivery locker or collection point, an email address for your tracking code, and your payment confirmation. We do not ask for your name, ID, or proof of age beyond the 21+ declaration.

When you create an account we store your username, email, and password (encrypted). Your order history is stored to support refunds and wallet balance.

Your data is used to: process and dispatch your order, send tracking updates (plus your InPost collection code for locker orders), credit wallet balance, and respond to support requests.

We never sell, rent, or share your personal data with third parties for marketing.

Orders are shipped in sealed packaging. The sender details are neutral and nothing on the outside reveals the contents.

Collection from an InPost locker requires only your one-time code — 21+ only, no signature, no face-to-face handover.

Card payments and wallet top-ups are processed by our card payment provider, and crypto payments by our crypto payment processor. We never store your full card number or crypto keys — payment details are handled entirely by these providers over encrypted connections.

Each provider's own privacy policy applies to the payment data they process on your behalf.

We keep tracking to the bare minimum. We do not use advertising cookies, and we run no third-party tracking or social pixels on this site.

Stored in your browser (local storage) — required to use the site, so no consent banner is needed: gh:cart keeps your basket between visits; gh_age_verified remembers that you confirmed you are 21+; gh_chat_session is a random ID that keeps your live chat thread together.

Cookie we set: bv:auth-token keeps you signed in for up to 7 days. It is set only after you sign in.

You can clear all of these at any time in your browser settings. Browsing and checkout still work — you will be asked to confirm your age again, and may need to sign in again.

Our own visit statistics: we count visits through our own server (cms.greenhub420.co.uk/api/track). It records the page visited, the page you arrived from, your browser type, and — derived from your IP address — an approximate country, region and city. It sets nothing in your browser.

We store your IP address together with a fingerprint hash that changes every day, so it cannot follow you from one day to the next. If you are signed in, that visit is linked to your account email so we can see which channels bring customers. Visits by non-members are never linked to an account.

We use this only to understand traffic and keep the site working. We never sell it and we never use it for advertising. You can opt out by blocking that request — any content or ad blocker does this. The site works normally without it.

Order, wallet and accounting records are kept for 6 years, as UK tax law requires. Support conversations are kept for 24 months. Visit statistics are kept for up to 12 months, after which the IP address and browser details are deleted automatically.

Under UK GDPR you have the right to access, correct, or delete your data, and to request a copy of everything we hold. To exercise any right, use the in-app live chat on our website, and we will respond within 30 days.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) — ico.org.uk · 0303 123 1113.

For any privacy question or request, use the in-app live chat on our website.

The data controller is Green Hub 420, the operator of this website.

Our lawful bases under UK GDPR are: performance of our contract with you (orders, delivery, wallet and refunds), our legitimate interests (visit statistics, and preventing misuse and fraud), and legal obligation (keeping accounting records). We do not rely on consent except where you ask us to do something optional.