Skip to main content
CaskStack
Terms of Use Back to Home
Data Protection

Privacy Policy

Last Updated: July 30, 2026

CASKSTACK PRIVACY POLICY

Last Updated: July 30, 2026

CaskStack, LLC ("CaskStack", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you visit https://caskstack.com, use our Direct-to-Consumer (DTC) CRM, marketing automation interfaces, and compliance technical guardrails (the "Services"), or interact with us.

SECTION 1: INFORMATION WE COLLECT

We collect personal information in connection with our B2B SaaS platform and services:

  • (a) Account & Contact Information: Name, business email address, phone number, company/winery name, billing address, and account credentials when you register for an account or request a demo.
  • (b) Payment Information: Payment card details, billing addresses, and transaction histories processed securely via our third-party payment processor, Stripe, Inc. CaskStack does not store raw credit card numbers on our servers.
  • (c) Tenant Subscriber & Customer Data: Customer records, email addresses, phone numbers, date-of-birth records (for 21+ Legal Drinking Age verification), and purchase histories uploaded or synchronized by Tenant organizations using our platform.
  • (d) Automated Technical & Usage Data: IP address, browser type, operating system, referrer URLs, page view metrics, and system performance logs collected via first-party local storage and session tokens.

SECTION 2: HOW WE USE YOUR INFORMATION

We use personal information to operate, improve, and secure our services:

  • (a) Service Provision: Managing tenant workspaces, processing subscription payments via Stripe, and powering marketing automation, CRM workflows, and tasting room attribution.
  • (b) Regulatory & Compliance Automation: Validating 21+ Legal Drinking Age (LDA) demographic ratios (73.8% threshold), executing dry-county geographic checks (FIPS precinct matching), and verifying TTB advertising disclosures.
  • (c) Communication: Dispatched service alerts, billing notifications, customer support responses, and product updates.
  • (d) Security & Fraud Prevention: Detecting unauthorized access, enforcing multi-tenant isolation guardrails (X-Cask-Tenant), and preventing abuse.

SECTION 3: DATA SHARING & THIRD-PARTY DISCLOSURES

We do not sell personal data. We disclose personal information only in the following circumstances:

  • (a) Service Providers & Delivery Nodes: Third-party vendors providing infrastructure, email/SMS delivery, and payment processing (e.g., Stripe for payment processing, Mailgun/Postmark for transactional email delivery, Telnyx for 10DLC SMS dispatch).
  • (b) Point-of-Sale (POS) & Integration Partners: Integrations authorized by the Tenant (such as Vinoshipper, Commerce7, WineDirect, and Shopify POS) to synchronize compliance ledgers and subscriber preferences.
  • (c) Statutory Legal Compliance: When required by applicable federal, state, or local law, subpoena, or regulatory audit (including TTB, FTC, or state ABC inquiries).

SECTION 4: DATA RETENTION & STATUTORY LEGAL EXCEPTIONS

  • (a) Standard Retention: We retain account information and tenant subscriber profiles for as long as your account remains active or as needed to provide services.
  • (b) Federal & State Record Retention Mandates (27 CFR § 24.300): Wine, spirits, and beer DTC sales ledgers, excise tax documentation, and 21+ Legal Drinking Age verification logs are retained for a minimum of three (3) years to comply with federal TTB and state alcoholic beverage control recordkeeping laws.
  • (c) Deletion & Account Closure: Upon account closure, non-statutory marketing profiles are deleted in accordance with our data retention schedule, while legally mandated compliance logs enter a read-only archived state until statutory retention windows expire.

SECTION 5: YOUR PRIVACY RIGHTS (CCPA / CPRA / GDPR)

Depending on your jurisdiction, you may have rights regarding your personal information:

  • (a) Access & Portability: Request a copy of the personal information we maintain about you in a structured CSV/JSON format.
  • (b) Correction & Deletion: Request correction of inaccurate data or deletion of non-statutory personal information ("Right to be Forgotten").
  • (c) Opt-Out of Marketing: Unsubscribe from promotional communications at any time using the one-click unsubscribe link in our emails or by replying STOP to SMS messages.
  • (d) Exercise Rights: To exercise any privacy rights, contact us at [email protected].

SECTION 6: COOKIES & LOCAL STORAGE TRANSPARENCY

We use first-party local storage and session cookies to:

  • Verify 21+ age compliance and store session state.
  • Validate state shipping regulation parameters and dry-county geo-checks.
  • Secure administrative sessions and analyze platform performance.

We do not sell personal data or track users across third-party websites.

SECTION 7: CONTACT US

For questions or concerns regarding this Privacy Policy, please contact:

CaskStack, LLC
Attn: Privacy Officer
455 Market St Ste 1940 • PMB 465367
San Francisco, CA 94105-2448
Email: [email protected]