Privacy Policy

VineSeat is a reservation platform for wine country experiences. This policy explains what information we collect when you visit our site or book through it, how we use that information, who we share it with, and the choices you have. We try to keep things in plain language — if anything is unclear, write us at privacy@vineseat.com.

This policy applies to vineseat.com, app.vineseat.com, admin.vineseat.com, affiliate.vineseat.com, the booking widget we provide to wineries, and any transactional email we send.

VineSeat is operated by VineSeat LLC. References to “we”, “us”, and “our” in this policy mean VineSeat LLC. For data-protection purposes we are the controller of the personal information described below, except where a winery acts as the controller of information you submit directly to them.

Information you give us

• Account details — name, email, phone, and password when you create an account or sign in via magic link.
• Reservation details — the experience, date, time, party size, the names of guests in your party, dietary or accessibility notes you choose to share, and answers to any custom questions the winery asks.
• Payment information— card details are entered directly into Stripe’s payment fields and are never seen or stored by VineSeat. We retain a Stripe customer ID, the last four digits of the card, the brand, and the amount charged.
• Communications — emails or support messages you send us, and replies we send back.
• Reviews — content you write about a visit, including any star rating, name, and the partner you reviewed.

Information we collect automatically

• Usage data — pages viewed, links clicked, referrer, approximate location based on IP, browser, and device type. This is collected via Vercel Analytics and is retained in aggregate form.
• Cookies — we use first-party cookies to keep you signed in and remember preferences. Wineries who embed our checkout widget on their own sites may rely on these cookies for cart state. We do not use third-party advertising cookies.
• Conversion events— when a winery has connected their own analytics integration (Google Analytics, Meta Pixel, etc.), reservation events are forwarded to that winery’s account on their behalf. The winery is the controller of that data once it lands in their tool; you should consult their privacy notice for further detail.

Information from wineries and partners

Wineries may import a guest list (with name, email, phone, or visit history) into their VineSeat account. If your information was shared with us this way, you can request access, correction, or deletion using the contacts below.

• To process and confirm your reservation, including sending booking confirmations, reminders, and any post-visit follow-ups.
• To share the relevant booking details with the winery you booked with, so they can host your visit.
• To process payments through Stripe, calculate platform fees and taxes, and pay the winery.
• To respond to your support requests and communicate about your account.
• To improve VineSeat — measure how features perform, debug problems, prevent fraud, and keep the platform secure.
• To send you marketing about VineSeat or recommended experiences, only where you have opted in. You can opt out at any time using the unsubscribe link in any marketing email.
• To meet legal, tax, and accounting obligations.

We rely on the lawful bases of performance of a contract (to deliver your booking), legitimate interest (to keep VineSeat running, secure, and improving), consent (for optional marketing), and legal obligation (for tax and recordkeeping).

The winery you booked with

When you book an experience, we share the details that the winery needs to host your visit — your name, email, phone, party size, any dietary or accessibility notes, and your answers to their custom questions. The winery is the controller of that information for its own purposes; you should consult their privacy notice if you want detail on how they handle it.

Service providers

We use a small set of trusted vendors to run VineSeat. They process your information only on our instructions and only to deliver the services we’ve hired them for:

• Stripe — payment processing and partner payouts.
• Supabase — database and authentication.
• Resend — transactional email delivery.
• Vercel — hosting and analytics.
• Google Maps — addresses and static maps in confirmations.

Affiliate and channel partners

If you reached VineSeat through an affiliate link or a referral channel, we may share that the booking happened (and which channel sent you) with that partner so they can be credited for the referral. We do not share your contact information for marketing purposes.

Legal and safety

We may disclose information when we believe in good faith that it is necessary to comply with a law or legal process, to enforce our terms, or to protect the rights, property, or safety of VineSeat, our users, or the public.

What we don’t do

We do not sell your personal information. We do not share your information with advertising networks for cross-context behavioral advertising. We do not rent your contact list to third parties.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information; to object to or restrict certain uses; and to withdraw consent. Specific rights include:

• Access & portability — request a copy of the personal information we hold about you.
• Correction— fix anything that’s wrong or outdated.
• Deletion — ask us to erase your account and associated data, subject to legal retention requirements (booking and tax records, for example, must be kept for a statutory period).
• Marketing opt-out — unsubscribe from any marketing email at any time, free of charge. Transactional emails (booking confirmations, reminders, receipts) will continue while you have an active reservation.
• California residents— under the CCPA/CPRA you have additional rights to know what we’ve collected, to limit use of sensitive personal information, and to opt out of any “sale” or “share” (we don’t do either).
• EU/UK residents — under the GDPR you may lodge a complaint with your local data-protection authority.

To exercise any of these rights, email privacy@vineseat.comfrom the address on file. We’ll verify your identity and respond within 30 days.

We keep your information for as long as your account is active and for as long as we need it to provide our services and meet legal obligations. Booking and payment records are retained for at least seven years to comply with tax and accounting rules. After that, we delete or anonymize the data.

We use encryption in transit (TLS) and at rest, role-based access controls, audit logging, and regular vulnerability scans. We are building VineSeat to SOC 2 standards from day one. No system is perfectly secure — if you suspect that your account has been compromised, contact support@vineseat.com right away.

VineSeat is operated from the United States, and our service providers may process data in the United States or other jurisdictions. Where applicable, we rely on Standard Contractual Clauses or other valid transfer mechanisms to protect personal information that crosses borders.

VineSeat is intended for adults of legal drinking age in the jurisdiction of the experience being booked. We do not knowingly collect information from anyone under 16. If you believe a child has provided us with information, please email privacy@vineseat.com so we can delete it.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, if appropriate, notify you by email. Your continued use of VineSeat after the change takes effect means you accept the updated policy.

For privacy questions or to exercise any of your rights:

• Email privacy@vineseat.com
• General support: support@vineseat.com
• Mail: VineSeat LLC, PO Box 0000, Napa, CA 94558 (placeholder)