VinTrak

Privacy Policy

Effective date: July 15, 2026

This Privacy Policy explains how VinTrak ("VinTrak," "we," "us," or "our") collects, uses, and shares information when you use our website and application (the "Service"). By using the Service, you agree to the collection and use of information as described in this policy.

1. Information We Collect

Account information. When you sign up, we collect your name, email address, winery/organization name, and password (stored securely by our authentication provider, Supabase). If you sign in with Google, we receive basic profile information from that provider.

Business and financial data. We store the data you enter or upload to operate the Service, including vintage and production records, contracts, invoices, cost and pricing data, barrel and inventory records, wine club member and shipment information, and accounting sync data.

Payment information. Subscription payments are processed by Stripe. We do not store your full payment card details on our servers; Stripe handles that information under its own privacy and security practices.

Usage and device information. We may collect information about how you interact with the Service, such as pages visited and actions taken, and technical information such as IP address, browser type, and device identifiers, to help secure and improve the Service.

Cookies. We use cookies that are necessary to keep you signed in and to maintain your session (authentication cookies). We do not use cookies for third-party advertising.

2. How We Use Information

  • To provide, maintain, and operate the Service;
  • To process transactions and manage your subscription;
  • To communicate with you, including transactional emails (e.g. account, billing, and document-processing notifications) sent via Resend;
  • To power AI-assisted document extraction for contracts and invoices you upload;
  • To sync data with third-party services you connect, such as Zoho Books;
  • To detect, investigate, and prevent fraud, abuse, and security incidents;
  • To comply with legal obligations.

3. AI Document Processing

When you upload a contract, invoice, or similar document for automated data extraction, the document content may be sent to third-party AI providers, including Anthropic and Google, solely to extract structured data on your behalf. These providers process the content under their own applicable data processing terms. Extracted data is presented to you for human review before it is saved as authoritative in your records.

4. How We Share Information

We share information with service providers who help us operate the Service, including:

  • Supabase, for authentication and database hosting;
  • Stripe, for payment processing;
  • Resend, for transactional email delivery;
  • Anthropic and Google, for AI-assisted document processing;
  • Netlify, for application hosting;
  • Zoho Books, when you connect that integration to sync your accounting data.

We do not sell your personal information or Customer Data. We may disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections.

5. Data Retention

We retain account and business data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations or to resolve disputes. You may request deletion of your account data, subject to records we are required to retain by law.

6. Data Security

We use reasonable administrative, technical, and organizational measures to protect your information, including encrypted connections, role-based access controls, optional two-factor authentication, and audit logging of key account actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Choices and Rights

You can access and update most account information directly within the Service. Depending on your location, you may have additional rights under applicable privacy law, such as the right to request access to, correction of, or deletion of your personal information. To exercise these rights, contact us through the support channels available in the Service.

8. Children's Privacy

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from children.

9. International Data Transfers

Our service providers may process and store data in the United States and other countries. Where required, we rely on appropriate safeguards for such transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice, such as by email or an in-app notice. The "Effective date" above reflects the date this policy was last updated.

11. Contact

If you have questions about this Privacy Policy or how we handle your information, please contact us through the support channels available in the Service.