Draft. This document is pending legal review. Items in [BRACKETS] are still to be filled in.
Privacy Policy
1. Who we are
[COMPANY LEGAL NAME] ("Herf", "we", "us") provides software that helps cigar lounges manage events, RSVPs, memberships and special offers, and keep members informed. This policy explains what personal information we handle, why, and the choices you have. It applies to the Herf website and service (the "Service"). Questions: [email protected].
2. Two roles
- As a service provider to lounges. A lounge owner enters, or asks guests to enter, information about the lounge's members and guests. The lounge decides why that information is collected and how it is used; we handle it on the lounge's behalf. If you are a member or guest and want to see, correct or delete your information, contact the lounge first.
- On our own account. We decide how we handle information about the lounge owners who sign up for Herf, and about visitors to our website.
3. Information we handle
Lounge owners
- Name, email address, phone number, date of birth (used to confirm you are old enough to hold an account), and password (stored only in scrambled form).
- Your lounge's details (name, address, phone, email, logo and cover image) and the events, special offers and flyers you create.
- Subscription and billing status. Card details are handled by Stripe; we receive a customer reference and plan status, not your card number.
- When you agreed to the Terms of Service and Privacy Policy, and which version.
- Requests you send through the Help page.
Members and guests (entered by a lounge, or by you when you register)
- Name, email address and phone number; RSVP answers and guest counts; event registrations.
- Records the lounge keeps in the Service about permission to contact you: email unsubscribes and resubscribes, text-message consent (how and when you agreed) and STOP replies, and the lounge's record that your age was verified (the date and method, never your date of birth). When you register for an event as a guest you also confirm you are of legal age.
Technical information
- Standard server logs (IP address, browser type, pages requested and time) and error reports, used to keep the Service secure and working.
- Cookies. We use only the cookie that keeps you signed in. We do not use advertising or analytics cookies or trackers, so there is no cookie banner.
4. How we use information
- To run the Service: accounts, subscriptions, events, RSVPs, memberships and offers.
- To send messages: emails to members on a lounge's behalf (each with an unsubscribe link), account and security emails to owners, and replies to Help requests. Text messages are not currently offered.
- To keep proof that people agreed to be contacted, were age-verified, or opted out, as the law and our email and text providers require.
- To protect the Service, prevent abuse and fraud, fix problems, and meet legal obligations.
We do not sell personal information, and we do not use it for third-party advertising.
5. Who we share it with
Only with providers that help us run the Service, under their own privacy terms, and when the law requires:
- Stripe for payments and billing.
- SendGrid to deliver email.
- Twilio to deliver text messages, if and when texting is enabled.
- Railway for hosting and database, and Amazon S3 for uploaded images and flyers.
- Sentry for error monitoring.
- Authorities or advisers, where required by law or to protect rights and safety; and a successor, if the business is sold or merged.
A lounge can see the information about its own members and guests. Event details and offers a lounge marks as public appear on our public Explore pages.
6. Email and text choices
- Email: every member email has an unsubscribe link. It stops emails sent through Herf to that address from all lounges, and a Resubscribe button on the same page undoes it. A lounge can also record that you asked it to resubscribe you.
- Texts: reply STOP to any text to opt out and START to opt back in. Message and data rates may apply.
7. How long we keep information
We keep account and lounge information while the account is active and for 90 days afterward. Records of consent, age verification and opt-outs are kept for four years because the law and our providers require us to be able to prove them. Backups are overwritten on a regular cycle. We then delete or de-identify the information.
8. Security
We use reasonable safeguards, including encrypted connections, hashed passwords, and access controls that keep each lounge's data separate. No system is perfectly secure; tell us at [email protected] if you think your account has been compromised.
9. Your choices and rights
Depending on where you live (for example, California), you may have the right to know what we hold, get a copy, correct it, delete it, and not be discriminated against for using these rights. To use them for information we hold on our own account (owners and website visitors), contact [email protected]. For member or guest information entered by a lounge, contact the lounge; we will help the lounge respond. We may need to verify your identity, and some records must be kept by law. If you are not satisfied, you may complain to your state attorney general or privacy regulator.
10. Children
The Service involves tobacco-related businesses and is for adults. It is not intended for anyone under 21, and we do not knowingly collect information from them. If you believe we have, contact us and we will delete it.
11. Where information is handled
The Service is operated from the United States, and information is processed and stored there.
12. Changes to this policy
We may update this policy. We will change the version and date above and, for material changes, tell lounge owners by email or in the Service.
13. Contact
[COMPANY LEGAL NAME]
[MAILING ADDRESS]
[email protected]