Privacy Policy

Effective date: August 18, 2026

This policy describes how Heirloom Vine Institute ("we", "us") handles personal information in connection with HeirloomOS (the "Service").

1. Information we collect

Account information: name, email address, and password credentials (stored as salted hashes, never in plain text) when you create an account.
Organization content: the records your organization enters into its workspaces (members, courses, inventory, decisions, messages, and similar). This content is controlled by your organization; we process it only to operate the Service.
Billing information: handled by our payment processor, Stripe. Card numbers never touch our servers; we store only the subscription status and invoice records Stripe reports to us.
Operational logs: standard technical logs (IP address, request timing, errors) kept for security and reliability.

2. How we use information

We use information solely to provide, secure, support, and bill for the Service. We do not sell personal information. We do not use your organization's content for advertising, and we do not train machine learning models on it.

3. Sharing

We share information only with the service providers required to run the Service: hosting infrastructure, our database provider, and Stripe for payments. Each is bound to use it only on our behalf. We disclose information beyond that only if required by law, and we will notify affected customers unless legally prevented.

4. Data within your organization

What members of your organization can see is controlled by your organization's administrators and the Service's permission model (for example, direct message history visibility is chosen at invitation time). Questions about how your organization uses the data it holds about you should go to your organization's administrators.

5. Security

All traffic to the Service is encrypted in transit (TLS). Passwords are stored as salted hashes. Access to production systems is limited to the people who operate the Service. Backups are maintained so your organization's records survive hardware failure.

6. Retention and deletion

We retain your information while your account is active.

After account closure, you can request deletion of your organization's content by emailing privacy@heirloomos.app, and we will respond within 30 days with what we are able to delete and what we are required to keep. Records we are legally required to retain, such as invoices, tax records, payment disputes and records subject to a legal hold, are kept for as long as the law requires and are not deleted on request.

We are building automated deletion that will act on these rules directly. Until that is in place, deletion is handled by a person rather than by a scheduled job, which is why the request goes to the address above rather than happening on a fixed timetable. We would rather describe this accurately than promise a schedule we do not yet keep.

7. Your rights

You may access, correct, export, or delete your personal information. Some of this you can do directly in the Service, which exports identity packages and websites as complete bundles today. For anything else, including a full copy of your organization's records, email privacy@heirloomos.app and we will respond within 30 days.

8. Changes

If we materially change this policy, we will notify account administrators by email at least 14 days before the change takes effect.

9. Contact

HeirloomOS is operated by Heirloom Vine Institute.

Privacy and data requests, including access, deletion and correction: privacy@heirloomos.app
Everything else: support@heirloomos.app