Privacy Policy

• Information you provide: name, shipping and billing address, email, phone number, order contents, gift messages, review submissions, and membership preferences.
• Payment information: we are not currently processing payments, and no card details are collected or stored on our servers. When payment processing is enabled, card details will be entered with our payment processor and never stored on our servers; we will receive only a token and the last four digits.
• Automatically collected: pages viewed, referring URL, device and browser type, and approximate location derived from IP. We also record anonymous interactions with our welcome offer (which message version was shown, sign-up clicks and completions) to measure which presentation performs best. These analytics are aggregated and are not used to build individual advertising profiles.

• To process, ship and support your orders and memberships.
• To send order confirmations, shipping notices, and service messages.
• To send marketing email where permitted — you may unsubscribe at any time.
• To prevent fraud, secure the site, and comply with legal obligations.
• To improve our products, catalog and site experience.

We use strictly necessary browser storage (cart contents, sign-in session, checkout security) and a simple first-party visit count that records the page viewed, the referring site, and a temporary identifier that is discarded when you close your browser. We do not use advertising cookies, cross-site trackers, or third-party analytics profiling. You may block or delete cookies in your browser settings; strictly necessary storage is required for the cart and checkout to function.

To stop spam and automated abuse of our forms, we count recent submissions against a short scrambled code derived from your internet address using a secret key. That code is a pseudonymous security identifier — not anonymous data — it cannot be read back as an address by anyone who obtains it, it is never used for marketing or analytics, and it is deleted within twenty-four hours.

Cellar List letters are marketing email and are sent only to people who asked for them. Every marketing letter carries a one-click unsubscribe link that works without signing in, and you may also simply reply to any letter and we will remove you by hand. Unsubscribing never affects order confirmations, shipping notices or account emails, which we must send to service your purchases.

We share information only with service providers acting on our behalf: payment processors, shipping and cold-chain carriers, email and analytics platforms, and fraud-prevention services. We may disclose information where required by law or in connection with a merger or sale of assets. We do not sell your personal information.

We keep order records as long as needed for warranty, accounting and tax purposes, typically seven years, marketing data until you opt out, and abuse-prevention codes for up to twenty-four hours. We use encryption in transit, access controls and vendor review, though no method of transmission is perfectly secure.

California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and opt out of any sale or sharing of personal information. We will not discriminate against you for exercising these rights. Requests may be submitted using the contact details below and will be verified before fulfilment.

If you are in the EEA, UK or Switzerland, you have the right to access, rectify, erase, restrict or port your data, to object to processing, and to withdraw consent at any time. Our legal bases are contract performance (orders), legitimate interests (fraud prevention, service improvement), consent (marketing, non-essential cookies) and legal obligation. You may lodge a complaint with your supervisory authority.

• Account: signed-in members can view and correct their saved name, addresses and preferences at any time under My Account.
• Marketing: mailing-list membership is optional and separate from your account. Unsubscribe from My Account, from the email preferences page, or from the link in any letter. Order and delivery notices are service messages and are always sent.
• Access: download a machine-readable copy of your account, preferences and order history from My Account.
• Erasure: delete your account from My Account. This removes your login, saved details and mailing-list record immediately. Order records are retained where tax and accounting law requires, with your personal details removed from them.
• Payment details: we never store full card numbers. No card data is currently collected; when payments open, card data will be handled entirely by our payment processor.

Our store is not directed to children under 16, and we do not knowingly collect their personal information.

We may update this policy; material changes will be posted here with a new date. For privacy requests, write to bj@aeternusflavor.com with the subject "Privacy Request". We respond within 30 days.