Privacy Policy

Adval (“Adval”, “we”, “us”) operates adval.wine. The winery shops on this site are templates. They show what a shop will look like. They do not take paid orders. Adval does not hold US state alcohol licences yet. Adval does not have a US warehouse yet. Adval gets the licences and the warehouse after wineries sign up. No paid order ships until both are in place. The licence Adval gets is a Washington, DC Class B Internet Retailer licence: wine and beer only, internet sales only, no public-facing premises, sealed-container delivery between 7am and midnight. The District of Columbia's local government changed its law. A brand that is not already sold in the United States can sell wine and beer directly to the customer.

We are the controller of the personal information described below, except where this policy says otherwise.

Questions about this document, or any request described in it, go to ops@adval.wine. Please allow one business day for acknowledgement.

We collect only what the service needs to function. There is no advertising network, no data broker, and no profile built about you beyond your own orders.

• If you buy wine. Your email address, delivery address, order contents, the state you are shipping to, your 21+ age attestation, and your marketing preference if you gave one. We need these to take payment, to confirm we may lawfully ship to your state, and to deliver the wine. Payment card details go directly to Stripe and never reach our systems.
• If you work for a winery on Adval. Your name, email address, sign-in credentials, and your role at that winery. We need these to give you access to your winery's portal and to keep one winery's data separate from another's.
• If you apply to sell on Adval. Your name, your winery's name, region, country, website, email address, anything you write in the message field, and a salted one-way hash of your IP address. The hash exists only to rate-limit the form against automated abuse; we never store the address itself. We treat the hash as personal information regardless, because it is pseudonymised rather than anonymous.
• If you join a waitlist. Your email address and the state you asked about, so we can tell you if we start shipping there.
• Administrative records. When Adval staff or winery staff make a change that matters — creating a winery, sending an invitation, approving an application, changing a shipping rule — we record who did it and what changed. See “Audit records” below, which is the one place our retention rules differ.

For readers in the UK, EU or EEA, our grounds under the UK/EU GDPR are:

• Performance of a contract — order information, and winery portal accounts. We cannot sell you wine or run your storefront without these.
• Legal obligation — age attestation, destination-state eligibility checks, per-customer volume records, and tax and alcohol-sales records we are required to keep.
• Legitimate interests — preventing abuse of our public forms (the hashed IP), securing the service, and keeping administrative records of who changed what. We have weighed these against your interests and consider the impact minimal, because the data is limited and is never used to make decisions about you personally.
• Consent — marketing email only. It is never pre-ticked, and you can withdraw it at any time without affecting anything else.

At checkout you may opt in to hear from the winery whose wine you bought. That box is never ticked for you.

That consent is to the winery's own list. Adval sends the mail on the winery's behalf and acts as its processor for that purpose. We do not maintain a separate Adval-wide marketing list, and we do not add you to one.

Every marketing message carries an unsubscribe link. Transactional messages about an order you actually placed — confirmation, shipping, delivery — are not marketing and are sent regardless.

We use a small number of service providers. Each is bound by a data processing agreement and may use your information only to provide their service to us.

• Supabase — database, authentication and file storage.
• Vercel — application hosting and content delivery.
• Stripe — payment processing and winery payouts. Stripe is an independent controller of payment data under its own privacy policy.
• Resend — transactional and marketing email delivery.

We publish changes to this list before a new provider begins processing. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Our infrastructure is hosted in the United States. If you are in the UK, EU or EEA, your information is therefore transferred outside your home jurisdiction.

We rely on the EU–US Data Privacy Framework where a provider is certified under it, and we additionally put Standard Contractual Clauses in place with each provider as a fallback. We do this deliberately rather than relying on the Framework alone, because its adequacy decision is currently under appeal to the Court of Justice of the European Union.

• Order records — for as long as alcohol-sales, tax and accounting rules require, which is typically several years after the order.
• Winery portal accounts — for the life of the winery's relationship with Adval, then deleted.
• Applications to sell on Adval — up to 24 months from submission; rejected applications are deleted sooner.
• Waitlist entries — until we open the state you asked about, or until you unsubscribe.
• Hashed IP addresses from public forms — 90 days.
• Audit records — see below.

We keep an append-only record of administrative actions: who created a winery, who sent an invitation, who approved an application, who changed a compliance rule, and how each order was cleared for shipping.

We keep these even after the related account is deleted, and they are the one category we will not erase on request. We rely on legal obligation and on our legitimate interest in being able to demonstrate to a regulator how a specific alcohol shipment was authorised. Deleting your account removes your access and your profile; it does not remove the record that a documented action took place.

Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to ops@adval.wine.

If you are in the UK, EU or EEA you also have the right to object to or restrict processing, the right to data portability, and the right to withdraw consent at any time. You may complain to your local supervisory authority; we would rather you came to us first.

If you are a California resident you have the rights to know, delete, correct and to limit use of sensitive information under the CCPA as amended. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising any right.

We respond within one month. We will tell you if we need longer, and why.

We set cookies to keep you signed in and to keep your shopping basket during a visit. Without those, the service does not work, so they are not optional and we do not ask for consent to them. On adval.wine we also store the language you chose, so a later visit opens in that language.

We run no analytics, no advertising pixels, and no third-party trackers of any kind. If that ever changes we will say so here first, and we will ask for consent where consent is required.

Each winery's data is isolated at the database level, not merely in application code, so one winery cannot read another's orders, customers or catalogue. Access to production systems is limited to staff who need it. Payment card details never touch our servers.

No system is perfect. If a breach affects your personal information and presents a real risk to you, we will tell you and the relevant regulator without undue delay and within 72 hours of becoming aware where the law requires it.

If we make a material change we will update the date at the top and, where the change affects you meaningfully, tell you directly.

Questions about this document, or any request described in it, go to ops@adval.wine. Please allow one business day for acknowledgement.