Privacy Policy

This Privacy Policy (“Policy”) applies to Pour Luxury, LLC (“Pour Luxury,” “we,” “us,” or “our”) and governs the collection, use, disclosure, and protection of personal information obtained through the Pour Luxury website, mobile applications, Taste DNA quiz, Founder's Box subscription service, and all related products and services (collectively, the “Platform”).

This Policy applies to all visitors, registered users, quiz participants, subscribers, and any other person who accesses or interacts with the Platform. It does not apply to third-party websites or services that may be linked from our Platform.

This Policy is incorporated into and forms part of our Terms & Conditions. By accepting those Terms, you also accept this Policy.

We collect the following categories of personal information depending on how you interact with the Platform:

2.1 Account Information

When you create a Pour Luxury account we collect your full name, email address, password (stored in hashed form), and date of birth (required for age verification in connection with alcohol sales). You may optionally provide a profile photo or display name.

2.2 Taste DNA Quiz Responses

The Taste DNA quiz collects your self-reported flavor preferences, sensory affinities (e.g., sweetness, acidity, tannin tolerance), aroma and texture preferences, and lifestyle context. This data is used to build your personalized sensory profile and power our AI recommendation engine. Quiz responses are treated as preference data and stored in association with your account.

2.3 Shipping & Billing Address

To fulfill orders we collect your shipping and billing address, including street address, city, state, postal code, and country. This information is used solely for order fulfillment, shipping logistics, tax calculation, and fraud prevention.

2.4 Payment Information

By submitting payment information you agree to Stripe's Privacy Policy. Pour Luxury is not responsible for Stripe's independent data practices.

2.5 Device, Browser & Usage Analytics

We automatically collect certain technical data when you access the Platform, including:

• IP address and approximate geolocation (city/region level);
• Browser type, version, and operating system;
• Device type and screen resolution;
• Referring URL and exit pages;
• Pages viewed, time spent, and click-path data; and
• Performance metrics collected via Vercel Analytics and Google Analytics.

2.6 AI Interaction Data

We collect data about how you engage with our AI recommendation features, including which recommendations you view, click, dismiss, or purchase; feedback you provide on recommendations (e.g., ratings or thumbs up/down); and subsequent quiz retakes or preference updates. This behavioral data is used to improve recommendation accuracy over time.

2.7 Communications

If you contact us by email, live chat, or web form, we retain a record of that correspondence — including your contact details and the content of your inquiry — for support, quality assurance, and compliance purposes.

3.1 AI Recommendation Engine

Your Taste DNA quiz responses and AI interaction data are the primary inputs to our proprietary recommendation algorithm. We use this data to generate, refine, and personalize beverage recommendations, curate Founder's Box contents, and improve match accuracy over time.

3.2 Order Fulfillment & Subscription Management

We use your account, shipping, and billing information to process and fulfill Founder's Box orders, manage recurring subscription billing, send order confirmations and shipping notifications, and handle returns and refunds.

3.3 Age Verification & Alcohol Shipping Compliance

Your date of birth and, where required, government-issued ID information is used solely to verify that you meet the legal drinking age (21+) in your jurisdiction and to comply with applicable state alcohol shipping laws and carrier requirements.

3.4 Marketing Communications

With your consent, we may use your email address and preference data to send newsletters, promotional offers, new product announcements, and curated recommendations. You may opt out of marketing emails at any time by clicking “Unsubscribe” in any email or by contacting privacy@pourluxury.com. Opting out does not affect transactional communications (e.g., order confirmations, shipping updates).

3.5 Platform Security & Fraud Prevention

We use technical and usage data to detect, investigate, and prevent fraudulent transactions, unauthorized account access, abuse of age verification systems, and other illegal activity.

3.6 Legal Compliance

We process personal data as necessary to comply with applicable laws and regulations, including alcohol licensing requirements, tax obligations, and lawful government requests.

3.7 Analytics & Product Improvement

Aggregated and anonymized usage data helps us understand how users interact with the Platform, identify areas for improvement, measure feature effectiveness, and inform product development.

4.1 What We Use for AI Training

We may use anonymized versions of your flavor preference data, sensory profile scores, recommendation feedback, and behavioral interaction data to improve our AI models. Before any data is used for training purposes it is stripped of personally identifiable information (PII) — including name, email, shipping address, date of birth, and payment details — through a de-identification process consistent with applicable privacy standards.

4.2 What We Do Not Use

We will never use your PII directly in AI model training without your separate, explicit, opt-in consent. We do not sell identifiable personal data to AI/ML infrastructure providers or third parties for their own training purposes.

4.3 How to Opt Out of AI Training Data Use

Email privacy@pourluxury.com with subject line “Opt Out — AI Training” and the email address associated with your account. We will process your request within 30 days. Note that data already incorporated into trained models in anonymous, aggregated form cannot be retroactively removed.

4.4 Third-Party AI/ML Infrastructure

We may utilize third-party cloud and machine-learning infrastructure providers (e.g., model hosting, vector database, or inference services) in connection with our AI systems. Such providers are engaged under data processing agreements that prohibit them from using Pour Luxury data for their own training or commercial purposes.

We do not sell your personal information. We share data only in the limited circumstances described below:

5.1 Legal Disclosures

We may disclose your personal information to law enforcement, regulatory authorities, or other third parties if required by applicable law, court order, or legal process; to protect the rights, property, or safety of Pour Luxury, our users, or the public; or in connection with an investigation of suspected fraud or illegal activity.

5.2 Business Transfers

If Pour Luxury undergoes a merger, acquisition, asset sale, or other corporate restructuring, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Platform before your personal information becomes subject to a different privacy policy.

6.1 What Are Cookies

Cookies are small text files placed on your device by a website. We also use similar technologies such as web beacons, pixel tags, local storage, and session storage. Collectively we refer to all of these as “cookies” in this section.

6.2 Types of Cookies We Use

6.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse all cookies, accept only certain cookies, or delete existing cookies. Disabling strictly necessary cookies will impair Platform functionality, including the ability to sign in or complete a purchase.

To opt out of Google Analytics tracking specifically, you may install the Google Analytics Opt-out Browser Add-on.

6.4 Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. Our Platform does not currently respond to DNT signals because there is no industry-wide standard for interpreting them. We will update this section if that changes.

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and regulatory obligations:

• Account data — retained for the life of your account plus up to 3 years after closure to comply with tax, alcohol licensing, and legal requirements.
• Order and transaction records — minimum of 7 years for financial and legal compliance.
• Age verification records — retained for the period required by applicable alcohol regulatory law.
• Taste DNA quiz responses & AI interaction data — retained while your account is active and for up to 2 years after account closure, unless you request earlier deletion.
• Anonymized, aggregated data — not subject to standard retention limits and may be retained indefinitely.
• Marketing opt-out records — retained indefinitely to honor your preferences.

8.1 Your CCPA Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, business purposes, and third parties with whom we share it.
• Right to Delete: Request deletion of your personal information, subject to certain legal exceptions (e.g., data required for active business transactions or legal compliance).
• Right to Correct: Request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: We do not sell personal information. To the extent that sharing data with analytics providers could be characterized as a “sale” or “sharing” under the CCPA, you may opt out by emailing privacy@pourluxury.com with subject line “Do Not Sell or Share My Personal Information.”
• Right to Limit Sensitive Data Use: Limit our use of sensitive personal information to what is strictly necessary to provide the services you requested.
• Right to Non-Discrimination: We will not deny services, charge different prices, or provide a lower quality of service because you exercised any CCPA right.

8.2 How to Submit a CCPA Request

Submit a verifiable consumer request to privacy@pourluxury.com. We will respond within 45 days, with a possible 45-day extension where reasonably necessary. We may verify your identity against the information we hold before processing your request.

8.3 Authorized Agent

You may designate an authorized agent to submit a CCPA request on your behalf. We require written authorization signed by you (or proof of power of attorney) and may verify your identity directly.

9.1 Legal Basis for Processing

• Contract performance: Fulfilling orders, managing subscriptions, and providing requested services.
• Legitimate interests: Analytics, fraud prevention, security, and improving our AI models, where our interests are not overridden by your rights.
• Consent: Marketing communications and non-essential cookies. You may withdraw consent at any time.
• Legal obligation: Compliance with alcohol licensing, tax, and other applicable laws.

9.2 Your GDPR Rights

• Right of Access: Obtain a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): Request deletion subject to legal retention obligations.
• Right to Restriction: Request we restrict processing in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format to transmit to another controller.
• Right to Object: Object to processing based on legitimate interests, profiling, or direct marketing.
• Rights Re: Automated Decision-Making: Not be subject to decisions based solely on automated processing that produce a legally significant effect, except where you have given explicit consent or it is necessary for a contract.

9.3 International Data Transfers

Pour Luxury is based in the United States. If you are in the EEA or UK, your personal data may be transferred to and processed in the U.S. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and equivalent UK mechanisms, to ensure adequate protection for such transfers.

9.4 Supervisory Authority

If you are in the EEA or UK and believe we have not adequately addressed your privacy concern, you have the right to lodge a complaint with your local data protection supervisory authority.

Our email practices comply with the CAN-SPAM Act. Specifically:

• We do not use false or misleading header information in our emails.
• We do not use deceptive subject lines.
• Every marketing email clearly identifies itself as an advertisement where required.
• Our physical mailing address is included in every commercial email.
• Every marketing email contains a clear and conspicuous “Unsubscribe” mechanism.
• We honor opt-out requests within 10 business days of receipt.
• We do not charge a fee, require account login, or impose other burdensome conditions to opt out of marketing emails.

Transactional emails (order confirmations, shipping notifications, account security alerts, billing notices) are not subject to unsubscribe requests as they are necessary to your use of the service.

To unsubscribe from all marketing emails, click the “Unsubscribe” link in any Pour Luxury marketing email, or email privacy@pourluxury.com with subject line “Unsubscribe.”

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13. The Platform is further restricted to users who are 21 years of age or older for the purpose of purchasing alcoholic beverages (see Section 12).

If we learn that we have inadvertently collected personal information from a child under 13, we will delete such information as promptly as possible. If you believe we have mistakenly collected information from a minor, please contact us immediately at privacy@pourluxury.com.

Pour Luxury uses a third-party age verification service to confirm that users who purchase alcoholic beverages meet the minimum legal drinking age in their jurisdiction. Age verification data is:

• Collected and processed by our verification provider under strict data processing agreements;
• Used solely for the purpose of confirming legal drinking age and complying with alcohol shipping regulations; and
• Retained for the period required by applicable alcohol licensing and regulatory law.

We do not share age verification data beyond what is required for verification and regulatory compliance, and we do not use date-of-birth data for marketing profiling without your separate consent.

We implement industry-standard technical, administrative, and physical safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, and destruction:

• Encryption of data in transit via TLS 1.2+ and at rest using AES-256;
• Password hashing using a strong one-way algorithm (bcrypt);
• Access controls limiting data access to authorized personnel on a need-to-know basis;
• PCI DSS Level 1 compliant payment processing via Stripe (we do not handle raw card data);
• Regular security assessments and vulnerability scanning; and
• Employee security training and confidentiality obligations.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and will not be liable for breaches outside our reasonable control. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

Regardless of your jurisdiction, you have the following choices at any time:

• Access & Correction: Log in to your account dashboard to view and update your profile information, Taste DNA preferences, and communication settings.
• Marketing Opt-Out: Unsubscribe via the link in any Pour Luxury email, or email privacy@pourluxury.com.
• AI Training Opt-Out: Email privacy@pourluxury.com with subject “Opt Out — AI Training.”
• Do Not Sell / Share (CCPA): Email privacy@pourluxury.com with subject “Do Not Sell or Share My Personal Information.”
• Account Deletion: Request closure of your account and deletion of your personal data (subject to legal retention requirements) by emailing privacy@pourluxury.com.
• Cookie Management: Manage cookie preferences through your browser settings or the Google Analytics Opt-out Add-on.
• GDPR / UK GDPR Requests: Submit data access, rectification, erasure, portability, or objection requests to privacy@pourluxury.com. We will respond within 30 days.

We will not discriminate against you for exercising any of these rights.

We reserve the right to update this Policy at any time. When we make material changes, we will provide at least 30 days' advance notice to registered users via email and by posting a prominent notice on the Platform.

Non-material changes (e.g., typographical corrections or clarifications that do not alter rights or obligations) may be posted without advance notice and are effective upon posting. The “Last Updated” date at the top of this page reflects the most recent revision.

Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy. If you do not agree to the revised Policy, you must discontinue use of the Platform and, if applicable, cancel your subscription before the effective date.

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Privacy Team:

We aim to respond to all privacy requests within 30 days. For CCPA verifiable consumer requests, our response window is 45 days (extendable by a further 45 days with notice). For GDPR / UK GDPR requests, we respond within 30 days (extendable by a further 60 days where requests are complex or numerous).

To help us locate and verify your account, please include the email address associated with your Pour Luxury account in any privacy request.