Privacy Policy for Winery Hotels

1. Information We Collect

1.1 Personal Data

We collect the following personal information from you:

• Name: We collect your name to personalize your experience and communicate with you effectively.
• Email: We collect your email address to send you important information regarding your account, newsletter updates, and communications.
• Bookmarks: We store your saved winery hotels and vineyard accommodations to provide you with personalized recommendations.
• Authentication Information: We use secure authentication through Supabase to protect your account.

1.2 Non-Personal Data

We may use web cookies and similar technologies to collect non-personal information such as:

• IP address and approximate location
• Browser type and version
• Device information and operating system
• Pages visited and time spent on pages
• Referring website or source
• Search queries and filter selections
• Interaction patterns (clicks, scrolls, bookmarks)

This information helps us enhance your browsing experience, analyze trends, and improve our services.

2. Purpose of Data Collection

We collect and use your personal data for the following purposes:

• Managing your account and saved bookmarks
• Providing personalized winery hotel recommendations
• Sending service updates, newsletters, and communications
• Improving our platform and user experience
• Analytics to understand how users interact with our directory
• A/B testing to optimize website features and content
• Customer support via live chat
• Fraud prevention and security

3. Analytics and Tracking

We use the following analytics services to improve our website:

4. Third-Party Services

We use the following third-party services to operate our platform:

5. Data Sharing

We do not sell, trade, or rent your personal information to others. We may share your information only in the following circumstances:

• With service providers who help us operate our platform (listed in Section 4)
• When required by law or to protect our rights
• With third-party booking platforms when you choose to book accommodations (you will be redirected to their sites)
• In the event of a merger, acquisition, or sale of assets (with prior notice)

6. Third-Party Booking Links

Our website provides links to third-party booking platforms (such as Expedia, Booking.com, Trip.com, etc.). When you click these links, you will be redirected to their websites, which have their own privacy policies. We are not responsible for the privacy practices of these third-party sites. We recommend reviewing their privacy policies before providing any personal information.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. Our service providers are located in various countries, including the United States.

When we transfer personal data outside of the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or reliance on the service provider's certification under recognized frameworks.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Account data: Until you request deletion of your account
• Newsletter subscriptions: Until you unsubscribe
• Bookmarks: Until you delete them or your account
• Analytics data: Typically retained for 12-24 months, then anonymized or deleted
• Support conversations: Retained for 2 years for quality and training purposes

9. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of processing your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing of your data for certain purposes
• Right to Withdraw Consent: Withdraw consent at any time where we rely on consent

To exercise any of these rights, please contact us at hello@winery-hotels.com. We will respond to your request within 30 days.

10. Lawful Basis for Processing (GDPR)

We process your personal data based on the following lawful bases:

• Consent: For newsletter subscriptions, marketing communications, and non-essential cookies (analytics, functional, marketing)
• Contract Performance: To provide our services when you create an account or use our features
• Legitimate Interests: For security, fraud prevention, improving our services, and essential analytics
• Legal Obligation: When required to comply with applicable laws

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected and how it's used
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising your rights

We do not sell your personal information. To exercise your rights, contact us at hello@winery-hotels.com.

12. Children's Privacy

Winery Hotels is not intended for children under the age of 16. We do not knowingly collect personal information from children. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at the email address provided below, and we will take steps to delete such information.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction:

• SSL/TLS encryption for data in transit
• Encrypted storage through our service providers
• Regular security assessments
• Access controls and authentication
• Secure password hashing

14. Cookies

We use cookies and similar technologies to improve your experience on our website. You can manage your cookie preferences through our cookie consent banner or your browser settings.

For detailed information about the cookies we use, please see our Cookie Policy.

15. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Any updates will be posted on this page with an updated "Last Updated" date. For significant changes, we may notify you via email or through a notice on our website.

16. Contact Information

If you have any questions, concerns, or requests related to this Privacy Policy or how we handle your data, you can contact us at: