Privacy Policy

1. Introduction

Smolrun LLC DBA Smolrun Spirits Club ("we," "us," or "our") operates the Smolrun Spirits Club website and blockchain-based membership platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site or use our services.

2. Information We Collect

2.1 Personal Information You Provide

We collect information that you voluntarily provide to us:

• Email Address: For authentication and account access via magic link
• Name: First and last name for order fulfillment
• Shipping Address: Street address, city, state, and ZIP code for product delivery
• Clothing Sizes: T-shirt and hoodie sizes for membership benefits
• Blockchain Wallet Address: Cryptocurrency wallet address linked to your account

2.2 Automatically Collected Information

We automatically collect certain information when you visit our website:

• Log Data: IP address, browser type, operating system, pages visited, time spent on pages
• Cookies: See our Cookie Policy for details
• Analytics Data: Usage patterns, user interactions, and website performance metrics (via Google Analytics)

2.3 Blockchain Information

Blockchain transactions are public by nature. When you link your wallet or purchase NFTs, your wallet address and transaction history on the Avalanche C-Chain blockchain are publicly visible. We do not control blockchain data.

3. How We Use Your Information

We use the information we collect to:

• Authenticate your account and provide secure access to our platform
• Process and fulfill your NFT membership purchases
• Ship membership benefits (spirits, merchandise) to your provided address
• Link your blockchain wallet to your account using SIWE (Sign-In with Ethereum) protocol
• Verify age requirements (21+) and state shipping restrictions
• Communicate with you about your account, orders, and membership
• Improve our website, services, and user experience
• Analyze usage patterns and website performance (via Google Analytics)
• Comply with legal obligations and enforce our Terms of Service
• Prevent fraud and unauthorized access

4. How We Share Your Information

We may share your information with:

4.1 Service Providers

• Supabase: Database hosting and authentication services
• Stripe: Payment processing for credit card transactions (PCI DSS compliant)
• Google Analytics: Website analytics and performance monitoring (only if you consent)
• WalletConnect: Blockchain wallet connection infrastructure
• Shipping Carriers: Name and address for order fulfillment
• Email Service Provider: For sending authentication magic links and transactional emails

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, law enforcement).

4.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website.

4.4 With Your Consent

We may share your information for any other purpose with your explicit consent.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information:

• Database encryption at rest (via Supabase)
• Row-Level Security (RLS) policies to restrict data access
• HTTPS/TLS encryption for data in transit
• Passwordless authentication via magic links (no passwords to store or leak)
• SIWE cryptographic signatures for wallet ownership verification
• Secure session management with httpOnly cookies

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

5.1 Payment Processing

Credit card payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. We do not store your full credit card number. Stripe handles all payment data in compliance with PCI DSS requirements. See Stripe's privacy policy at https://stripe.com/privacy.

6. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

6.1 Rights for All Users

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information in your profile
• Deletion: Request deletion of your account and associated data
• Opt-Out of Analytics: Decline analytics cookies via our cookie consent banner

6.2 California Residents (CCPA/CPRA)

California residents have additional rights:

• Know what personal information is collected, used, shared, or sold
• Delete personal information held by us
• Opt-out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

6.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at the information provided in the "Contact Us" section below. We will respond to your request within 30 days.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. When you delete your account, we will delete or anonymize your personal information within 90 days, except where we are legally required to retain certain information (e.g., transaction records for tax purposes).

8. Children's Privacy

Our services are not directed to individuals under the age of 21. We do not knowingly collect personal information from anyone under 21. If you are under 21, do not use our services or provide any information to us. If we learn we have collected information from someone under 21, we will delete that information immediately.

9. Third-Party Links

Our website may contain links to third-party websites (e.g., social media, Discord, wallet providers). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information to them.

10. International Users

Our services are based in the United States. If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers and service providers are located. By using our services, you consent to this transfer.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date at the top of this policy. Continued use of our services after changes constitutes acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy, or to exercise your privacy rights, please contact us: