Privacy Policy

Effective date: August 18, 2026

This policy describes how Heirloom Vine Institute ("we", "us") handles personal information in connection with HeirloomOS (the "Service").

1. Information we collect

Account information: name, email address, and password credentials (stored as salted hashes, never in plain text) when you create an account.
Organization content: the records your organization enters into its workspaces (members, courses, inventory, decisions, messages, and similar). This content is controlled by your organization; we process it only to operate the Service.
Billing information: handled by our payment processor, Stripe. Card numbers never touch our servers; we store only the subscription status and invoice records Stripe reports to us.
Operational logs: standard technical logs (IP address, request timing, errors) kept for security and reliability.

2. How we use information

We use information solely to provide, secure, support, and bill for the Service. We do not sell personal information. We do not use your organization's content for advertising, and we do not train machine learning models on it.

3. Sharing

We share information only with the service providers required to run the Service: hosting infrastructure, our database provider, and Stripe for payments. Each is bound to use it only on our behalf. We disclose information beyond that only if required by law, and we will notify affected customers unless legally prevented.

4. Data within your organization

What members of your organization can see is controlled by your organization's administrators and the Service's permission model (for example, direct message history visibility is chosen at invitation time). Questions about how your organization uses the data it holds about you should go to your organization's administrators.

5. Security

All traffic to the Service is encrypted in transit (TLS). Passwords are stored as salted hashes. Access to production systems is limited to the people who operate the Service. Backups are maintained so your organization's records survive hardware failure.

6. Retention and deletion

We retain your information while your account is active. After account closure, we delete or irreversibly anonymize personal information and organization content within 90 days, except where law requires longer retention (for example, invoice records).

7. Your rights

You may access, correct, export, or delete your personal information. Most of this is available directly in the Service (including full data export); for anything else, email us and we will respond within 30 days.

8. Changes

If we materially change this policy, we will notify account administrators by email at least 14 days before the change takes effect.

9. Contact

Heirloom Vine Institute · subscriptions@heirloomvineinstitute.com