We collect the following categories of information when you register or use the Portal:

• Account information: name, business email address, phone number, and role (for example, customer, staff, or driver).
• Business information: company name, billing address, DC ABRA license number, payment terms, credit limit, and outstanding balance.
• Order and transaction data: products ordered, quantities, order status, invoice amounts, and payment records.
• Delivery information: delivery addresses, geolocation coordinates used for route planning, and stop completion timestamps.
• Communication data: SMS messages sent through the Portal and email notifications delivered via our service providers.
• Usage data: pages visited, actions taken within the Portal, browser type, IP address, user agent, and timestamps.
• Lead form submissions: business name, email address, mobile number, SMS opt-in preference, and submission metadata collected through our wholesale account request form.
• Payment data: payment intent identifiers from Stripe. We do not store full card numbers or bank account credentials on our servers.

We use the information collected to:

• Authenticate users and maintain account security.
• Process and fulfill product orders and generate invoices.
• Plan and track delivery routes and update stop statuses.
• Respond to wholesale account requests and onboard approved customers.
• Send transactional notifications and requested SMS updates about account setup, orders, invoices, and deliveries.
• Sync account and contact data with HubSpot for CRM purposes.
• Process payments securely through Stripe.
• Monitor Portal usage to improve functionality and security.
• Comply with applicable federal, state, and local laws, including alcohol beverage control regulations.

We do not sell your personal information. We may share data with the following categories of third parties only as necessary to operate the Portal:

• Stripe - payment processing (subject to Stripe's Privacy Policy).
• Resend - transactional email delivery.
• Telnyx - SMS notification delivery.
• HubSpot - CRM and contact management.
• Google Cloud Storage - secure document and image storage.
• Neon (PostgreSQL) - cloud database hosting.
• Vercel - application hosting and serverless compute.
• Google Maps - geocoding and delivery route visualization.

Mobile phone numbers and SMS opt-in data are not shared, sold, rented, or disclosed to third parties or affiliates for their marketing or promotional purposes.

We may also disclose information when required by law, court order, or governmental authority, or to protect the rights, safety, or property of AHAWC or others.

We retain account, lead, and transaction records for as long as needed to operate the Portal and as required by applicable law, including record-keeping obligations under alcohol beverage control regulations. You may request deletion of your personal account data by contacting us at the address below; certain business records may still be retained to satisfy legal obligations.

We implement industry-standard safeguards including encrypted connections (TLS/HTTPS), hashed password storage (bcrypt), JWT-based session authentication with expiry, and role-based access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate data.
• Request deletion of your personal data, subject to legal retention requirements.
• Withdraw consent for optional communications such as SMS notifications.

To exercise any of these rights, please contact us using the information in Section 10.

The Portal uses session cookies and JWT tokens for authentication. We do not use third-party advertising cookies or tracking pixels. Usage data is collected solely to operate and improve the Portal.

The Portal is a business-to-business platform intended solely for licensed commercial entities and their authorized employees. It is not directed to individuals under the age of 21. We do not knowingly collect personal information from minors.

We may update this Privacy Policy periodically. When we do, we will revise the "Last updated" date at the top of this page. Continued use of the Portal after changes are posted constitutes acceptance of the updated policy.

If you have questions or requests regarding this Privacy Policy, please contact: