Privacy Policy

1. Overview

This Privacy Policy explains how CellarTraks, operated by CellarTraks, Ltd., collects, uses, stores, shares, and protects information when you use our production and compliance management software. It applies to the CellarTraks web application and related services.

2. Information we collect

Account information. When you create an account, we collect your name, email address, and authentication details. Authentication is handled by Clerk, a third-party identity provider; passwords are managed by Clerk and are not stored by CellarTraks.

Business and production data. Information you enter into the service, including facility and license details, lots, batches, vessels, raw materials and ingredients, recipes, production logs, gravity and temperature readings, transfers, inventory quantities, and compliance figures.

Integration data. When you connect a third-party service, we receive data from that service within the scope you authorize. Depending on the integration, this may include accounting records, customers, vendors, invoices, bills, sales transactions, product and order information, and related identifiers.

Contact information for notifications. Email addresses and phone numbers you provide so the service can send you alerts and notifications.

Technical and usage information. Standard server and application logs, including IP address, browser and device type, pages accessed, timestamps, and error diagnostics.

3. How we use information

We use the information we collect to:

• Provide, operate, secure, and maintain the service
• Authenticate you and manage access permissions
• Generate reports, calculations, and compliance recordkeeping outputs at your request
• Synchronize data with third-party services you have connected
• Send operational notifications, alerts, and service communications you have configured
• Diagnose errors, monitor performance, and improve reliability and features
• Detect, prevent, and investigate fraud, abuse, or security incidents
• Comply with legal obligations

We do not sell your personal information. We do not share your information with advertisers. We do not use your business or production data to train machine learning models.

4. QuickBooks and Intuit data

If you connect CellarTraks to QuickBooks Online, we access your QuickBooks company data only under the authorization you grant through Intuit's OAuth 2.0 consent flow, and only within the accounting scope you approve.

What we access. Company information, and accounting records relevant to synchronizing your production and sales activity — which may include customers, vendors, items, invoices, and bills.

Why. Solely to synchronize records between CellarTraks and your accounting system at your direction.

Credential handling. OAuth access and refresh tokens, and your QuickBooks company identifier (realmId), are stored server-side in our encrypted database. Tokens are never exposed to the browser, never included in URLs, and never shared with any third party.

Disclosure. We do not sell, rent, or disclose your QuickBooks data to third parties. It is used only to operate the integration for you.

Revoking access. You may disconnect at any time from within CellarTraks, or from QuickBooks Online under Apps → Connected Apps. On disconnection we delete the stored tokens. Previously synchronized records already written into CellarTraks remain unless you also delete them.

5. Service providers

We rely on third-party providers to operate CellarTraks. Each processes only the data needed for its function:

• Clerk — user authentication and identity management
• Neon — managed PostgreSQL database hosting
• Render — application hosting and infrastructure
• SendGrid — transactional and notification email delivery
• Twilio — SMS notification delivery
• Intuit / QuickBooks Online — accounting synchronization, where you have connected it
• Toast — point-of-sale data, where you have connected it
• Shopify — e-commerce order and product data, where you have connected it
• AI providers — where you use optional AI-assisted features, the relevant inputs are transmitted to process your request

These providers are bound by their own terms and privacy commitments. We do not authorize them to use your information for their own independent purposes.

6. Other disclosures

We may disclose information when required by law, subpoena, or valid legal process; when necessary to protect our rights, safety, or property, or that of our users or the public; to investigate suspected fraud or security incidents; or in connection with a merger, acquisition, or sale of assets, in which case we will provide notice before your information becomes subject to a different privacy policy.

7. Data retention

We retain your account and business data for as long as your account is active. Because alcohol beverage production records are subject to federal and state retention requirements, we retain production and compliance records for the duration of your account so they remain available to you. Server logs are retained for a limited period for security and diagnostic purposes.

On account deletion, we remove your data within a reasonable period, except where retention is required by law. You may request export or deletion at any time by contacting support@cellartraks.com.

8. Security

We protect your information using encryption in transit (TLS) and at rest, role-based access controls, third-party managed authentication, and server-side-only storage of integration credentials. Access to production systems is limited to personnel who need it.

No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for safeguarding your own login credentials.

9. Your choices and rights

You may:

• Access and correct your account information within the application
• Request a copy of your data in a portable format
• Request deletion of your account and associated data
• Disconnect any third-party integration at any time
• Opt out of non-essential notifications through your notification settings

Depending on where you live, you may have additional rights under laws such as the Massachusetts data protection statutes, the California Consumer Privacy Act, or the GDPR, including rights of access, correction, deletion, portability, and objection. To exercise any right, contact support@cellartraks.com. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising these rights.

10. Cookies and similar technologies

We use cookies and equivalent browser storage that are necessary for the service to function, primarily to maintain your authenticated session and remember interface preferences. We do not use advertising or cross-site tracking cookies. Blocking essential cookies will prevent you from signing in.

11. Data location and transfers

CellarTraks is operated in the United States, and your information is processed and stored there. If you access the service from outside the United States, you consent to this transfer and processing.

12. Children's privacy

CellarTraks is business software intended for adults engaged in commercial alcohol production. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

13. Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected in the effective date above, and we will provide reasonable notice through the service or by email. We encourage you to review this page periodically.

14. Contact

Questions, requests, or concerns about privacy:

CellarTraks, Ltd.
100 Wattaquadock Hill Road, Bolton, MA 01740
support@cellartraks.com