This Privacy Policy explains how pourd, Inc. (“pourd,” “we,” “us,” or “our”) collects, uses, and shares personal information when you visit pourdhq.com, claim a winery account, or use our software (collectively, the “Services”). We are a California-based company and we take a plain-English approach: we collect what we need to run the Services, and we do not sell your personal information.
Information we collect
Depending on how you use the Services, we may collect the following categories of personal information:
- Winery contact information. The business name, contact name, email address, and phone number associated with a winery, used to verify and manage account access.
- Event and check-in information. Staff names, emails, and phone numbers entered at an event check-in, along with pour counts, ratings, written feedback, and related event activity.
- Account information. The email address you use to sign in, a password (stored only as a one-way hash by our sign-in provider, Supabase) or your Google or Microsoft sign-in, and your role and membership within a winery account.
- Event documents. Files and details an organizer asks a winery for, such as insurance certificates, Responsible Beverage Service (RBS) certificates and RBS numbers. They are shared with the organizer of that event.
- Agreement signatures. When someone signs an organizer’s participation agreement in pourd, we keep the signed name or drawn signature, the date and time, the device’s IP address and browser details, and a copy of what was signed, so the signature can be checked later.
- Booth payments. If an organizer takes card payments, the winery pays on the organizer’s own Stripe account. We keep the amount, any discount, the payment status and Stripe’s reference numbers. Card details go straight to Stripe; we never see or store card numbers.
- Connected social accounts. If an event organizer chooses to connect a Facebook Page, an Instagram business account or a LinkedIn account, we receive the information described in “Connected social accounts” below.
- Usage and device information. Basic technical and usage data such as pages viewed, approximate region, browser type, and similar analytics needed to operate and improve the Services. We use Vercel Web Analytics, which counts visits without using cookies.
How we use information
- To provide, secure, and improve the Services.
- To verify winery accounts and authenticate sign-in.
- To deliver event results and benchmarks.
- To let organizers collect documents, signatures and booth fees from the wineries at their events.
- To communicate with you about your account, including transactional messages such as email confirmations, password resets, invitations, reminders and service notices.
- To comply with legal obligations and enforce our terms.
How we share information
We share personal information only as needed to run the Services, with service providers acting on our behalf:
- Supabase: database, authentication, and hosting of application data.
- Stripe: card payments for booth fees, made on the organizer’s own Stripe account.
- Resend: delivery of account and event emails.
- Vercel: hosting of the website and application, and Vercel Web Analytics.
- Meta (Facebook and Instagram) and LinkedIn: only if an organizer connects an account, and only the posts that organizer scheduled, sent when it is time to publish them.
Event organizers also see what a winery shares for that organizer’s event, including its profile, documents, agreement signatures and booth payments.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We may disclose information if required by law or to protect the rights, safety, and property of pourd, our users, or others.
Your choices and rights
You may request access to, correction of, or deletion of your personal information by emailing hello@pourdhq.com, or see our data deletion page. We will respond consistent with applicable law. Depending on where you live, you may have rights including:
- The right to know what personal information we collect and how we use it.
- The right to request deletion of your personal information.
- The right to correct inaccurate personal information.
- The right to opt out of the “sale” or “sharing” of personal information (note: we do not sell or share it as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act).
- The right not to be discriminated against for exercising these rights.
We include these California (CCPA/CPRA) rights for transparency and future-proofing, even where pourd does not currently meet the statutory thresholds that make every provision mandatory.
Connected social accounts
pourd has a marketing planner for event organizers. Organizers write posts for their event, add a photo, pick a time and choose the networks. Publishing those posts for them is coming soon. When it is available, an organizer can choose to connect the Facebook Page and Instagram business account they manage, or their LinkedIn account, so pourd can publish their scheduled posts at the time they chose. Connecting is optional, and the planner works without it.
When an organizer connects an account, we store:
- An access token from Facebook, Instagram or LinkedIn, kept encrypted and never shown to anyone.
- The account’s ID and name, the permissions the organizer granted, and when they connected it.
- The posts and photos the organizer wrote in pourd, and the post IDs the network sends back once a post is published.
We use this only to publish the posts the organizer wrote and scheduled. We do not:
- post anything the organizer did not write and schedule;
- read followers’ data, messages or comments;
- sell this information or use it for advertising.
An organizer can disconnect an account at any time, in pourd or in their Facebook, Instagram or LinkedIn settings. Removing pourd on the network makes the access token stop working right away, and disconnecting in pourd deletes it from our systems. To have pourd delete everything we hold about a connected account, follow the steps on our data deletion page.
Cookies
We use only the cookies needed to keep you signed in and remember your place in pourd. We do not use advertising or tracking cookies.
Do Not Track
Some browsers offer a “Do Not Track” (DNT) signal. There is no consistent industry standard for responding to DNT signals. At this time, pourd does not respond differently to DNT signals. If a uniform standard is adopted, we will update this Policy accordingly.
Third-party collection
We do not authorize third parties to collect personally identifiable information about your online activities over time and across different websites when you use the Services, other than the service providers listed above acting on our behalf. Third-party services we link to have their own privacy practices, which we do not control.
Data retention and security
We keep personal information for as long as needed to provide the Services and for legitimate business or legal purposes, then delete or de-identify it. We use reasonable technical and organizational measures to protect personal information, though no method of transmission or storage is completely secure.
Children’s privacy
The Services are intended for wineries and event organizers and are not directed to children under 18. We do not knowingly collect personal information from children.
Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide a more prominent notice. Material changes will be communicated through the Services or by email to account holders.
Contact us
Questions about this Policy or your personal information? Email hello@pourdhq.com or write to pourd, Inc., San Luis Obispo, California.