KANHA Treats Privacy Policy
Last Updated: February, 2026 | Effective Date: February, 2026
This Privacy Policy (“Policy”) describes how KANHA Treats, operated by Sunderstorm, Inc. (“Company,” “we,” “our,” or “us”), collects, uses, stores, shares, and protects your personal information when you visit our website at https://kanhatreats.com/ (the “Site”), use our services, or interact with us online or in connection with purchases of our KANHA Treats products.
We are committed to protecting your privacy in compliance with the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and all other applicable state and federal privacy laws. This Policy applies to residents of all states in which we operate, including California, Nevada, Massachusetts, and Illinois.
By using our website, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use our website or services.
NOTICE AT COLLECTION: Personal information is collected at or before the point of data collection, including at account creation, checkout, and when you subscribe to marketing communications. This Policy constitutes our Notice at Collection as required by the CPRA.
Legal Entity: Sunderstorm, Inc., operating as KANHA Treats
Business Address: 4605 Lankershim Blvd STE 418, North Hollywood CA 91601
Website: https://kanhatreats.com/
Contact Email: info@sunderstorm.com
Contact Phone: (866) 988-7405
We collect personal information necessary to operate our business, process orders, provide customer support, conduct analytics, and comply with applicable legal requirements. We may collect the following categories of personal information:
Identifiers
- Full name
- Email address
- Telephone number
- Billing and shipping address
- IP address and device identifiers
- Government-issued ID (for age verification purposes only, if required)
Account Information
- Username and account credentials (passwords are stored in encrypted form)
- Account preferences and settings
Commercial Information (If Applicable)
- Products purchased or considered
- Order history and transaction records
- Payment information (processed by third-party payment processors; we do not store full payment card details)
Internet and Network Activity Data
- Browsing and search history on our website
- Cookies, web beacons, and similar tracking technologies
- Device type, browser type, and operating system
- Referring URLs and pages visited
Geolocation Data
- General location data derived from IP address
- Precise location data only if you opt in and your device permits
Marketing and Communications Data
- Preferences for receiving marketing communications
- Records of communications consent and opt-in/opt-out status
Sensitive Personal Information
We may collect the following categories of Sensitive Personal Information, as defined under CPRA, solely to the extent necessary for the purposes described in this Policy:
- Government ID numbers used solely for age verification
- Account log-in credentials (encrypted)
We do not use or disclose Sensitive Personal Information for purposes beyond those permitted by law. You have the right to limit our use and disclosure of Sensitive Personal Information. See your rights section below for instructions on how to exercise this right.
We use the personal information we collect for the following purposes:
- To process, fulfill, and deliver your orders
- To verify your age and identity as required by applicable cannabis regulations
- To communicate with you about your order status, account, and customer support inquiries
- To send promotional communications, offers, and marketing materials, but only with your consent where required
- To improve our website, services, products, and user experience
- To conduct analytics and measure the effectiveness of our website and marketing campaigns
- To detect, prevent, and respond to fraud, security threats, and unauthorized access
- To comply with applicable state and federal laws, including cannabis licensing and regulatory requirements in California, Nevada, Massachusetts, and Illinois
- To resolve disputes, enforce our Terms of Service, and protect our legal rights
- To maintain accurate business records for tax, audit, and regulatory compliance purposes
We do not sell your personal information to third parties. We do not share your personal information for cross-context behavioral advertising purposes without offering you the ability to opt out. If this practice ever changes, we will update this Policy and provide a clearly labeled “Do Not Sell or Share My Personal Information” link.
We may share your personal information with the following categories of third parties, solely as necessary for the purposes described in this Policy:
- Payment processors, to securely process transactions
- Shipping and delivery carriers, to fulfill your orders
- Analytics service providers, to help us understand website performance
- Age verification service providers, to comply with cannabis regulatory requirements
- Marketing platform providers, to deliver communications you have consented to receive
- Legal and compliance service providers, including attorneys and accountants
- Law enforcement or regulatory agencies, when required by applicable law, court order, or to protect legal rights
- Business successors, in connection with a merger, acquisition, or sale of assets, subject to the same privacy protections described in this Policy
We require all third-party service providers to maintain appropriate security measures and to use your personal information only as directed by us and in accordance with applicable law.
Under California Civil Code Section 1798.83, California residents may request information about whether we have disclosed personal information to third parties for those parties’ direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. If our practices change, we will update this disclosure accordingly.
We use cookies and similar technologies on our website. Cookies are small data files stored on your device that help us improve functionality, analyze usage, and where applicable, deliver relevant content. The categories of cookies we use are:
- Strictly Necessary Cookies: Required for the website to function, including shopping cart functionality, session management, and age-gate verification. These cannot be disabled.
- Functional Cookies: Enable enhanced functionality such as saved preferences and personalization. Disabling these may affect your experience.
- Analytics Cookies: Allow us to understand how visitors use our website, which pages are most visited, and how to improve performance. These include tools such as Google Analytics.
- Marketing and Advertising Cookies: Used to deliver content relevant to your interests. These may be placed by third-party advertising partners.
You may manage cookie preferences through your browser settings or through our cookie preference center. You may also opt out of analytics tracking through the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
We honor opt-out preference signals, including the Global Privacy Control (GPC), where required by applicable law. If a valid GPC signal is detected, we will treat it as a request to opt out of the sale or sharing of personal information.
We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including:
- Transaction and order records: 7 years, for tax, regulatory, and audit compliance
- Account information: Duration of account plus 2 years following closure
- Age verification records: As required by applicable state cannabis regulations
- Marketing consent records: Duration of consent plus 3 years
- Customer support records: 3 years from resolution
- Legal hold records: As directed by counsel and applicable law
We periodically review and delete personal information that is no longer necessary for any business or legal purpose.
We implement commercially reasonable and industry-standard technical, organizational, and administrative security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, access controls and authentication requirements, regular security assessments, and employee training on data handling practices.
While we take reasonable precautions, no security system is impenetrable, and we cannot guarantee the absolute security of your information. In the event of a data breach affecting your personal information, we will notify affected individuals in accordance with California Civil Code Sections 1798.29 and 1798.82 and other applicable state breach notification laws. We will provide notice without unreasonable delay, and within the timeframes required by law.
Our website may contain links to third-party websites, including regulatory agency sites, partner brands, and social media platforms. We are not responsible for the privacy practices, content, or security of those sites. We encourage you to review the privacy policies of any third-party site you visit. Third-party sites accessed through links on our website are not covered by this Policy.
Our website and services are intended solely for individuals who are 21 years of age or older, consistent with the minimum legal age for cannabis purchase and use in all states where we operate. We do not knowingly collect personal information from individuals under the age of 21. If we become aware that we have inadvertently collected personal information from a person under 21, we will promptly delete it. If you believe we have collected information from a minor, please contact us immediately at info@sunderstorm.com.
As a California resident, you have the following rights under the CCPA and CPRA:
Right to Know
You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months, the categories of sources from which that information was collected, the business or commercial purposes for collection, and the categories of third parties with whom we have shared the information.
Right to Access
You have the right to request a copy of the specific personal information we have collected about you in the preceding 12 months.
Right to Delete
You have the right to request deletion of personal information we have collected from you, subject to certain exceptions permitted by law, such as information needed to complete a transaction, comply with a legal obligation, or detect and prevent fraud.
Right to Correct
You have the right to request correction of inaccurate personal information that we maintain about you. Upon receiving a verified request, we will use commercially reasonable efforts to correct the inaccurate information.
Right to Opt-Out of Sale or Sharing
You have the right to opt out of the sale or sharing of your personal information. We do not currently sell or share personal information as defined under CPRA. If this changes, we will provide a prominent “Do Not Sell or Share My Personal Information” link on our homepage and in this Policy.
Right to Limit Use of Sensitive Personal Information
You have the right to direct us to limit our use and disclosure of your Sensitive Personal Information to only what is necessary to provide the goods and services you request or as permitted by law. To exercise this right, contact us using the methods below.
Right to Non-Discrimination
We will not discriminate against you for exercising any of your privacy rights. We will not deny goods or services, charge different prices, or provide a different quality of service based on your exercise of these rights.
Authorized Agents
You may designate an authorized agent to submit CCPA/CPRA requests on your behalf. To do so, you must provide us with a signed written authorization or a valid power of attorney granting the agent permission to act on your behalf. We may also require you to verify your own identity in connection with the request. Authorized agents must submit requests using the contact methods below and include proof of authorization.
Verification and Response
We will verify your identity before processing any request. For most requests, verification involves matching the information you provide against information we have on file. We will respond to verifiable requests within 45 calendar days. If we require additional time, we will notify you and may extend our response by an additional 45 days. Requests may be made through the following channels:
- Email: info@sunderstorm.com
- Phone: (866) 988-7405
- Web Form: https://kanhatreats.com/privacy-request-form/
- Mail: Sunderstorm, Inc., 4605 Lankershim Blvd STE 418, North Hollywood CA 91601
We do not currently operate any loyalty, rewards, or financial incentive programs that involve the collection or use of personal information in exchange for discounts or other benefits. If we establish such a program in the future, we will provide a separate financial incentive notice describing the material terms as required by CCPA/CPRA.
If you opt in to receive marketing communications from us, you may opt out at any time by clicking the “Unsubscribe” link in any marketing email, contacting us at info@sunderstorm.com, or calling (866) 988-7405. We comply with the CAN-SPAM Act. All commercial emails we send will identify us as the sender, include a physical mailing address, and include a clear and functional opt-out mechanism.
We may update this Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We will post the updated Policy on our website with a revised “Last Updated” date. Material changes will be communicated to registered users via email or through a prominent notice on our website. Your continued use of the website following the posting of changes constitutes your acceptance of the updated Policy.
For questions about this Privacy Policy or to exercise your rights, please contact us:
Email: info@sunderstorm.com
Phone: (866) 988-7405
Website: https://kanhatreats.com/
Mail: Sunderstorm, Inc., 4605 Lankershim Blvd STE 418, North Hollywood, CA 91601
Privacy Request Web Form: https://kanhatreats.com/privacy-request-form/
We aim to respond to all privacy-related inquiries within 30 calendar days.
California Consumer Privacy Act (CCPA) & California Privacy Rights Act (CPRA) Notice
Last Updated: February, 2026 | Applies to California Residents
This California Consumer Privacy Act and California Privacy Rights Act Notice (“CCPA/CPRA Notice”) applies exclusively to individuals who reside in the State of California (“California Residents” or “consumers”). This Notice supplements our general Privacy Policy and is intended to satisfy the notice requirements under California Civil Code Sections 1798.100 through 1798.199.4, as amended by the California Privacy Rights Act of 2020 (Proposition 24).
This Notice describes our practices regarding the collection, use, disclosure, and sale or sharing of personal information of California Residents, and informs you of your rights under California law. In the event of a conflict between this Notice and our general Privacy Policy, this Notice controls with respect to California Residents.
Covered Business: Sunderstorm, Inc. (“Company,” “we,” “our,” or “us”), operating the KANHA Treats brand, with operations in California. Website: https://kanhatreats.com/
In the preceding 12 months, we have collected, and may continue to collect, the following categories of personal information, as defined under the CPRA and applicable regulations:
| Category of Personal Information | Examples | Collected? |
| Identifiers | Name, email, phone, address, IP address, government ID | Yes |
| Account Information | Username, credentials, preferences | Yes |
| Commercial Information | Purchase history, order records, transaction details | Yes |
| Internet/Network Activity | Browsing history on Site, cookies, device info | Yes |
| Geolocation Data | General location from IP; precise location with consent only | Yes |
| Marketing & Communications Data | Marketing preferences, opt-in/opt-out status | Yes |
| Sensitive Personal Information | Government ID (age verification only); account log-in credentials (encrypted) | Yes (limited purposes only) |
| Biometric Data | N/A | No |
| Audio/Visual Data | N/A | No |
| Professional/Employment Information | N/A | No |
| Education Information | N/A | No |
| Inferences | N/A | No |
We collect personal information from the following categories of sources:
- Directly from you, when you create an account, place an order, contact us, or subscribe to communications
- Automatically, through cookies and similar tracking technologies when you use our website at https://kanhatreats.com/
- Third-party age verification service providers, to confirm you meet minimum age requirements
- Analytics service providers, including web analytics tools
- Marketing and advertising platform providers, where you have consented to marketing
- Law enforcement or government agencies, where required by applicable law
We collect and use the personal information described above for the following business and commercial purposes:
- To process, fulfill, and deliver orders
- To verify age and identity in compliance with California cannabis regulations
- To maintain and secure user accounts
- To provide customer support and respond to inquiries
- To send transactional communications, including order confirmations and shipping updates
- To send marketing and promotional communications, subject to your consent
- To conduct analytics and improve our website and services
- To detect and prevent fraud, security incidents, and unauthorized access
- To comply with applicable California, Nevada, Massachusetts, and Illinois cannabis laws and all other applicable legal obligations
- To enforce our Terms of Service and protect our legal rights
- To maintain records for tax, audit, and regulatory compliance purposes
In the preceding 12 months, we have disclosed personal information to the following categories of third parties for the business purposes described above:
- Payment processors: to securely process transactions
- Shipping and delivery carriers: to fulfill your orders
- Age verification service providers: to confirm minimum age requirements under California and applicable state law
- Analytics providers: to measure website performance and improve user experience
- Marketing platform providers: to deliver communications you have consented to receive
- Legal and compliance service providers: attorneys, accountants, and compliance consultants
- Law enforcement and regulatory agencies: when required by applicable law, subpoena, or court order
- Business successors: in connection with a merger, acquisition, or asset sale, subject to the same privacy protections
We do not sell personal information as defined under the CCPA and CPRA. We do not share personal information for cross-context behavioral advertising purposes without providing California Residents the ability to opt out.
If our practices change and we begin selling or sharing personal information, we will update this Notice and our Privacy Policy, provide a prominent “Do Not Sell or Share My Personal Information” link on our homepage, and provide California Residents with the ability to opt out before any such activity begins.
As described above, we may collect the following categories of Sensitive Personal Information as defined under the CPRA:
- Government-issued identification numbers, collected solely for the purpose of age verification as required by California cannabis regulations
- Account log-in credentials, including usernames and passwords (stored in encrypted form)
We do not use Sensitive Personal Information for purposes beyond those expressly permitted under California Civil Code Section 1798.121(a). You have the right to direct us to limit our use and disclosure of Sensitive Personal Information to only what is necessary to provide the services you request. See the “Your Rights” section below for how to exercise this right.
As a California Resident, you have the following rights with respect to your personal information:
1. Right to Know (Categories and Specific Pieces)
You have the right to request disclosure of: (a) the categories of personal information we have collected about you; (b) the categories of sources from which personal information was collected; (c) our business or commercial purposes for collecting, selling, or sharing personal information; (d) the categories of third parties to whom we have disclosed personal information; and (e) the specific pieces of personal information we have collected about you. Our disclosure obligation covers the 12-month period preceding your request.
2. Right to Access
You have the right to request that we provide you with a copy of the specific personal information we have collected about you in the preceding 12 months. We will deliver the requested information in a portable and, to the extent technically feasible, readily usable format.
3. Right to Delete
You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law. We may retain personal information where necessary to: complete a transaction; detect security incidents or protect against fraud; comply with a legal obligation; or exercise our legal rights. We will inform you of any exception that applies to your request.
4. Right to Correct
You have the right to request that we correct inaccurate personal information that we maintain about you. Upon receiving a verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate information, taking into account the nature of the personal information and the purposes of the processing.
5. Right to Opt-Out of Sale or Sharing
You have the right to direct us to not sell or share your personal information. We do not currently sell or share personal information. If this changes, we will provide a “Do Not Sell or Share My Personal Information” link and a web-based opt-out mechanism on our homepage and in this Notice.
6. Right to Limit Use of Sensitive Personal Information
You have the right to direct us to limit our use and disclosure of your Sensitive Personal Information to only what is necessary to provide the goods and services you request, as permitted under California Civil Code Section 1798.121. To exercise this right, contact us using the methods provided in the “How to Submit a Request” section below.
7. Right to Non-Discrimination
We will not discriminate against you for exercising any of your rights under the CCPA or CPRA. We will not deny goods or services, charge different prices or rates, provide a different level of quality of goods or services, or retaliate against you for exercising your privacy rights.
You may submit a verifiable consumer request to exercise any of your rights described above using the following methods:
- Email: info@sunderstorm.com (Subject line: CCPA/CPRA Privacy Request)
- Toll-Free Phone: (866) 988-7405
- Web Form: https://kanhatreats.com/privacy-request-form/
- Mail: Sunderstorm, Inc., 4605 Lankershim Blvd STE 418, North Hollywood CA 91601, Attention: Privacy Compliance
We are required to verify your identity before processing your request to protect against unauthorized disclosure or deletion of personal information. We will use the personal information you provide in your request to verify your identity by matching it against information we maintain on file. Depending on the sensitivity of the request, we may require additional verification steps. We will not retain any information provided solely for verification beyond what is necessary to fulfill the request.
We will acknowledge receipt of your request within 10 business days and will respond to your request within 30 calendar days of receipt. If we require additional time (up to an additional 45 days), we will inform you in writing of the reason and extension period. We will provide our response to requests at no charge, unless requests are excessive, repetitive, or manifestly unfounded.
You may designate an authorized agent to submit a CCPA/CPRA request on your behalf. To use an authorized agent, you must provide the following to us:
- A signed written authorization from you permitting the agent to act on your behalf, OR a copy of a valid power of attorney granted pursuant to California Probate Code Sections 4000 to 4465
- Verification of the authorized agent’s identity
In addition, we may contact you directly to verify your own identity in connection with the agent’s request, unless you have provided a power of attorney. Failure to provide adequate authorization may result in denial of the request.
Where personal information is collected in connection with a household, all members of the household who are California Residents may jointly request to know, access, or delete the household’s personal information. We may require individual verification from each household member before responding to such requests.
We do not currently offer any financial incentive, loyalty, or rewards programs that involve the collection or use of personal information in exchange for a price difference or other benefit. If we establish such a program in the future, we will provide the required disclosures under California Civil Code Section 1798.125, including the material terms of the program and the estimated value of your personal information.
California Civil Code Section 1798.83 permits California Residents to request information about whether a business has disclosed personal information to third parties for those third parties’ direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. If our practices change, we will update this disclosure and provide the disclosures required by applicable law.
For questions, concerns, or requests related to this CCPA/CPRA Notice or your California privacy rights:
Email: info@sunderstorm.com
Phone: (866) 988-7405
Web Form: https://kanhatreats.com/privacy-request-form/
Mail: Sunderstorm, Inc., 4605 Lankershim Blvd STE 418, North Hollywood CA 91601, Attention: Privacy Compliance Officer
Website: https://kanhatreats.com/
We aim to respond to all privacy inquiries within 10 business days and to complete all verifiable consumer requests within 30 calendar days of receipt.
We may update this CCPA/CPRA Notice at any time to reflect changes in our practices, legal requirements, or regulatory guidance from the California Privacy Protection Agency (CPPA). Updates will be posted on our website with a revised Last Updated date. We encourage you to review this Notice periodically. For material changes, we will provide additional notice where required by law.
