Privacy Policy

Crush Suite Corporation ("CrushSuite," "we," "us") is a Delaware corporation that builds Shopify apps for wineries, cideries, breweries and other alcohol producers that sell direct to consumers. Our apps are CrushSuite Compliance and CrushSuite Clubs (the "Apps").

Mailing address: 1400 Hi Line Drive, Dallas, TX 75207. Contact: admin@crushsuite.com.

We deal with two groups of people:

• Merchants (Shopify store owners and their staff) who install our Apps, and people who contact us through our website. For their data, we are the business that decides how it's used (a "controller" or "business").
• Your customers who shop at your store. For their data, you are the controller and we are your processor or service provider. We process their data only on your instructions, under our Data Processing Addendum ("DPA"). We have no direct relationship with your customers and don't use their data for our own purposes.

We use information only to:

• Run the Apps: enforce state shipping rules, calculate compliance fees, verify age, validate addresses, sync with the compliance partners you enable, and manage club memberships, releases and billing
• Generate the compliance and club reports you request
• Manage your account and subscription, and send billing and service notices
• Provide support and onboarding, and reply to messages sent through our website
• Keep the Apps secure, and prevent fraud and abuse
• Improve the Apps, using only aggregated or de-identified data (see section 5.3)
• Meet legal obligations and enforce our Terms of Service

We may email merchants about new features. You can unsubscribe at any time. We never market to your customers.

We use technical and organizational safeguards appropriate to the data we handle:

• Encryption in transit (TLS) for all data
• Additional encryption for compliance-partner credentials
• Access limited to authorized personnel with a business need
• Secrets kept out of code, in managed environment settings
• Contracts with subprocessors that require equivalent protection

No system is perfectly secure. If we confirm a breach affecting your data, we'll notify you without undue delay and within the time the law requires. The notice will describe what happened, what data was involved and what we're doing about it. To report a security issue, email admin@crushsuite.com with the subject "Security Report."

• While you're subscribed: we keep data as long as needed to run the Apps.
• After you uninstall: we delete or anonymize your store's personal data after receiving Shopify's shop/redact request, within the time Shopify requires.
• Compliance records: state alcohol and tax laws require some records to be kept for years. We keep age-verification, shipped-volume and tax records for as long as those laws require, up to 7 years. They're used only to meet those legal obligations, such as responding to a regulatory audit.
• Website form submissions: as long as we're in touch with you, or until you ask us to delete them.
• Logs: for a limited time, then deleted.

We support Shopify's mandatory privacy webhooks:

• customers/data_request: we provide the merchant with the customer's data we hold, within the time Shopify requires.
• customers/redact: we delete or anonymize that customer's data within the time Shopify requires, except compliance records under section 7.
• shop/redact: we delete the store's data as described in section 7.

Customers who want to access, correct or delete their data should contact the store they bought from. If they contact us, we'll forward the request to the merchant and help the merchant respond.

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, and to correct or delete it. You may also have the right to opt out of sale, targeted advertising and profiling. We don't do any of these.

• U.S. residents: this includes rights under California law (CCPA/CPRA) and the privacy laws of other states. We won't discriminate against you for using these rights.
• EEA, UK and Swiss residents: you also have the right to restrict or object to processing, to data portability, and to complain to your data protection authority. For merchant data, our legal bases are performance of our contract, legal obligations, and legitimate interests in running and securing the Apps.

To make a request, email admin@crushsuite.com with the subject "Privacy Request." We'll verify your identity and respond within 45 days (or the time your law requires). You may appeal a denial by replying to our response. An authorized agent can make a request for you with written permission.

We and our subprocessors store and process data in the United States. Where the law requires, we use Standard Contractual Clauses or another approved transfer mechanism.

The Apps run inside Shopify's admin and use Shopify's session authentication. They don't set tracking cookies on your customers. Our website uses only strictly necessary cookies and cookieless analytics, so there is nothing to opt out of. If we ever add non-essential cookies, we'll ask for consent where required and update this policy first. We honor Global Privacy Control signals.

The Apps are business tools and aren't directed at anyone under 18. Because the age gate exists to stop underage purchases, someone under the legal drinking age may enter a birth date. We use it only to deny the purchase. We never use age data for marketing, analytics or profiling.

We'll post updates here and change the Effective Date. For material changes, we'll give merchants at least 30 days' notice by email or in the app.