Privacy Policy

1Introduction

Table & Town LLC, doing business as Downtown Pour Collective ("DPC," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the DPC mobile application (the "App"), website at www.downtownpourcollective.com (the "Site"), and related services (collectively, the "Service").

By using our Service, you consent to the data practices described herein.

1.1 Definitions for this Policy

For purposes of this Privacy Policy, the following terms have the meanings set forth below. Capitalized terms used but not defined in this Policy have the meanings given to them in the DPC Member Terms of Service.

"App" means DPC's mobile application or other DPC-authorized digital interface through which Members access, manage, and redeem Membership Pours.

"Boost Mission" means a DPC-administered campaign in which Members may complete a defined activity (including, where applicable, uploading a Receipt Image) at participating Partner Venues during a defined window.

"Check-In" means the optional in-app action by which a Member confirms arrival at a Partner Venue. A Check-In is verified using device location captured at the moment the Member taps to check in. Check-In is a separate action from Pour redemption and does not require a Member to redeem a Membership Pour.

"Member" means an individual enrolled in DPC's membership program who is eligible to receive and redeem Membership Pours under DPC's Member Terms of Service and related Member-facing policies.

"Membership Circle" or "Circle" means one of DPC's membership tiers: Tap, Cellar, or Reserve. Eligible beverage selections for each Circle are described in Section 4.5 of the Terms of Service.

"Membership Pour" or "Pour" means the non-monetary, time-limited, experiential membership entitlement issued to Members under DPC's Member Terms of Service and redeemable for Eligible Pours at participating Partner Venues, subject to DPC program rules, venue availability, and Partner Venue service discretion.

"Monthly Entitlement Period" means, for each Member, the calendar-month period during which DPC issues a fixed allocation of Membership Pours to that Member. Each Monthly Entitlement Period begins on the Member's monthly issuance date and ends at the close of the calendar day immediately preceding the next monthly issuance date.

"Partner Venue" means a venue participating in the DPC program pursuant to a Partner Venue Agreement with DPC. Partner Venues are independently owned and operated.

"Pause-State" means a Member account state, initiated by the Member through the App, during which no membership fees are charged and no Membership Pours are issued, in accordance with the Member Terms of Service.

"Receipt Image" means an image of a transaction receipt uploaded by a Member to the App for the purpose of Boost Mission verification.

"Service" means, collectively, the App, the Site, and the related services provided by DPC.

"Site" means the website located at www.downtownpourcollective.com.

"Verification Record" means the minimized, derived record DPC creates when a Check-In or a Pour redemption is verified. A Verification Record contains the Member identifier, the Partner Venue, the date and time, and whether the location check passed or failed. It does not contain raw location coordinates.

2Information We Collect

2.1 Information You Provide Directly

• Full name, email address, phone number.
• Date of birth (age verification and birthday perks).
• Mailing address (Welcome Kit and membership card fulfillment).
• Payment information (processed and stored by our third-party payment processor. DPC does not store full payment credentials).
• Membership Circle selection and preferences.
• Pause status and Pause-related preferences (start date, reason category, expected resume date if provided).
• Support tickets and communications with DPC.
• Receipt images uploaded for Boost Mission verification (containing purchase amounts, items, venue, and timestamps).
• User-generated content submitted to DPC (Pour Stories, Coaster Passport content, social media posts tagged to DPC, testimonials, reviews) subject to the UGC license set forth in DPC's Member Terms of Service.
• If you introduce a non-member guest through The Introduction (Section 11 of the Member Terms of Service): the guest's name and email address that you provide so we can send a one-time code and, after the visit, a single invitation to join. If you are that guest, this is the information the introducing Member provides about you.

2.2 Information Collected Automatically

• Device information (device type, operating system, unique identifiers).
• Precise geolocation data, collected only at two moments, and only while the App is open and in the foreground. The first is when you tap to check in at a Partner Venue. The second is when you redeem a Membership Pour, including an Introduction Pour, which includes the device venue verification step. Location is not collected in the background, is not collected continuously, and is not tracked between these moments. See Section 6.
• Check-In records (Partner Venue, date, time, and whether the location check passed or failed).
• App usage data (screens viewed, features used, redemption history, Check-In history, Pour status per Circle, Monthly Entitlement Period state, venue assignment history, Pause and resume events, Rewards Points balance and earning history).
• Log data (IP address, browser type, access times, pages viewed).
• Push notification interaction data.

2.3 Information from Third Parties

• Payment processors (transaction confirmations, payment status, fraud signals).
• Partner venues (POS transaction records used for settlement reconciliation, partner-reported dispute information regarding specific redemptions, and sponsor or mission verification inputs when applicable).
• Sponsors and partner venues participating in Boost Missions (mission completion verification data, where applicable, processed under the B2B marketing services structure described in Section 4).
• Analytics providers (aggregated usage patterns).

3How We Use Your Information

3.1 Service Delivery

• Process membership enrollment, billing, renewals, and Pause requests.
• Issue, track, and manage Membership Pours and venue assignments per Circle.
• Confirm Member identity and venue selection during Pour redemption (device verification), including location signals where available.
• Verify Member arrival at a Partner Venue when a Member chooses to check in.
• Administer Coaster Passport, milestones, birthday perks, The Introduction, Boost Missions, DPC Rewards Points, and referral programs.
• Deliver Welcome Kits and physical membership cards.
• Process Founding Slot Deposits and manage conversion windows.
• Verify Boost Mission completion using uploaded receipt images.
• Process Pause initiation, cap tracking, resume actions, and cancellation-during-pause forfeit handling.

3.2 Program Administration and Partner Settlement

DPC uses verified Check-In records to administer the DPC program and to bill and settle with Partner Venues. Specifically:

• Count the number of unique Member arrivals at a Partner Venue on a given calendar day, for purposes of the service fees a Partner Venue owes DPC under its Partner Venue Agreement. A Partner Venue is shown counts and totals only. Partner Venues are not shown which individual Members generated those counts through the Check-In billing record, and they are not shown your location data.
• Reconcile Check-In and redemption records, produce weekly settlement statements, and resolve Partner Venue disputes.
• Calculate aggregate totals used for DPC's community giving commitments. Any DPC donation tied to verified Check-In activity is funded entirely by DPC. It is not tied to any purchase, order, redemption, or sale of any item at a Partner Venue, and no Member payment or Partner Venue payment funds it.

These fees compensate DPC for member routing, program administration, arrival verification, reconciliation, reporting, and partner support. They are not calculated by reference to anything a Member buys, orders, redeems, or consumes.

3.3 Communications

• Transactional emails and notifications (venue assignments, Pour reset reminders, Pour expiry warnings (Day 25 and Day 28 of each Monthly Entitlement Period), blackout windows, billing, Pause confirmations and cap-approaching alerts, renewal reminders).
• Marketing communications (event invitations, program updates, new venues).
• A one-time code email and a single post-visit invitation to join DPC, sent to the email address provided for a non-Member guest introduced through The Introduction.
• Support request responses.

3.4 Program Integrity and Fraud Prevention

• Venue-confirmation signals at redemption and at Check-In (including location signals where available) to reduce wrong-venue records, support fraud review, and provide support context.
• Detection of account sharing, screenshot attempts, location spoofing, and misuse.
• Rate limiting enforcement (1 redemption per Member per venue per 30 minutes cross-Circle, 1 per same-Circle per venue per calendar day). A Member may generate no more than one counted Check-In at the same Partner Venue on the same calendar day.
• Audit of Pour adjustments, Check-In records, and DPC support-resolved redemption issues.

3.5 Analytics and Improvement

• Understand usage patterns to improve features and experience.
• Generate aggregated, de-identified analytics for internal reporting.
• Provide aggregated performance reporting to partner venues and sponsors (no personally identifiable Member data is shared with venues or sponsors in standard reports).

3.6 Legal Compliance

• Comply with applicable laws and legal processes.
• Enforce our Member Terms of Service.

4How We Share Your Information

We do not sell your personal information.

4.1 Partner Venues (Standard Operations)

During a standard Pour redemption, venue staff see the Member's first name and last initial on the live redemption screen, plus the venue name displayed for device verification. No additional personal information (full last name, email, phone number, address, or payment details) is shared with venue staff during standard operations. Venues do not process backup verifications or exception-lane approvals. All redemption issue resolution is handled by DPC support. DPC may share aggregated, de-identified data with venues for performance reporting.

4.2 Partner Venues (Check-In and Settlement)

A Partner Venue is shown its running count of verified Check-Ins and the resulting fee it owes DPC. Raw location coordinates are never shared with a Partner Venue. Where a Partner Venue raises a billing dispute under its Partner Venue Agreement, DPC may share the minimum information necessary to resolve that specific dispute, which may include the date and time of a disputed Check-In and whether the location check passed. Partner Venues are bound by the Partner Data Processing Addendum (Exhibit A to the Partner Venue Agreement) and may not retain, copy, or repurpose that information after the dispute is resolved.

4.3 Partner Venues (Boost Mission Receipt Verification)

When a Member uploads a receipt for Boost Mission verification, the receipt image and associated mission data may be shared with the applicable Partner Venue solely for verification of qualifying transactions. Receipt verification data may not be retained, copied, or repurposed by the Partner Venue after verification is complete. Partner Venues participating in partner-funded Boost Missions are bound by the Partner Data Processing Addendum (Exhibit A to the Partner Venue Agreement). Boost Mission Campaign Management Fees are B2B marketing services payments and do not include any sale or transfer of Member personal information.

4.4 Sponsors

DPC provides sponsors with aggregated, de-identified reporting only (impression counts, verified action counts, completion rates). No personally identifiable Member data is shared with sponsors under any circumstances. DPC's sponsor program operates as a media-services and association-rights model under which Sponsor payments compensate DPC for DPC-rendered promotional services (including in-app media placement, editorial content production, and brand association rights). No portion of any Sponsor payment flows to any Partner Venue. Sponsor payments are business-to-business marketing services payments and do not include any sale or transfer of Member personal information.

4.5 Charitable Recipients

Where DPC makes a donation calculated from aggregate verified Check-In activity, DPC shares only the aggregate total with the recipient organization. No Member personal information, no individual Check-In record, and no location data is shared with any charitable recipient.

4.6 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment processing (e.g., Stripe). Processes and stores payment credentials. Contractually restricted to payment-related use only.
• Email and push notification delivery. Receives Member contact information for message delivery only.
• Cloud hosting and data storage. Hosts application data under encryption-at-rest and access controls.
• Analytics and performance monitoring. Receives anonymized or pseudonymized usage data.
• Customer support tools. Receives support ticket data for issue resolution.

All service providers are contractually obligated to use information only as necessary to perform the services we request, maintain reasonable security, and are prohibited from using DPC Member data for their own unrelated marketing purposes.

4.7 User-Generated Content

User-generated content submitted to DPC (Pour Stories, Coaster Passport content, social media posts tagged to DPC, testimonials, reviews, and DPC event photography in which Member appears) is governed by the UGC license set forth in the DPC Member Terms of Service §20.3. Members grant DPC a broad license to use such content for DPC business purpose, with attribution at DPC's option. The scope of the license, including its perpetual, irrevocable, worldwide, sublicensable, and transferable character, the full list of authorized uses, takedown procedures, and member representations, is set forth in the Member Terms of Service §20.3.

4.8 Legal Obligations

We may disclose information if required by law, in response to valid legal process, or to protect rights, safety, or investigate fraud.

4.9 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal information may be transferred. We will notify you prior to your information being subject to a different privacy policy.

4.10 Advertising Partners

DPC uses cookies, pixels, and similar technologies on our Site that collect online activity data (such as device and browser identifiers, IP address, and pages viewed) and share it with third-party advertising partners to measure our advertising and to show DPC ads to people who have visited our Site. Under California law this activity is considered sharing for cross-context behavioral advertising purposes. This sharing is limited to data collected through the Site. It does not include the precise geolocation data, Check-In records, Membership Pour redemption data, or any other App-collected data described in Sections 3.2 and 6, which DPC does not share for advertising. DPC does not receive monetary payment from any third-party advertising partner in exchange for this sharing. You may opt out of this sharing at any time as described in Section 12.5.

5Pause-State Data Handling

When you initiate a Membership Pause through the App:

• We collect and process pause start date and (optionally) the reason you select from the pre-set categories (travel or personal reasons).
• No membership fees are charged during a Pause. No new Pours are issued. Any Pours issued for the then-current Monthly Entitlement Period that remain unused at the time the pause takes effect are forfeited in accordance with Member Terms of Service §4 and §13.3(a)(iii).
• Geolocation data is not collected during a Pause. Check-In and Pour redemption are unavailable while an account is paused, and those are the only two moments at which the App collects location.
• Pause cap counter (cumulative pause days in the trailing twelve-month period for monthly members, or per annual term for annual members) is maintained for cap enforcement.
• Pause history is retained as part of account history. Pause reason categories are not shared with venues, sponsors, or service providers beyond aggregated, de-identified reporting.
• If you cancel during a Pause, cancellation takes effect immediately. Any unused pause days are forfeited and, for annual memberships, no refund or credit is issued for any remaining portion of the prepaid annual term, except where required by applicable law. No Pours are issued for any future period.

6Geolocation Data

Geolocation data is considered sensitive personal information under applicable California law. We treat it that way.

6.1 When We Collect It

The App collects precise geolocation data at two moments only:

• Check-In. When you tap to check in at a Partner Venue, the App captures your device location at that moment and uses it to confirm you are physically present at the venue, within a defined radius of the venue (currently 150 feet).
• Pour redemption. When you redeem a Membership Pour, including an Introduction Pour, the App uses location as part of the device venue verification step, within the same radius.

Location is collected only while the App is open and in the foreground. It is not collected in the background. It is not collected continuously. We do not track your movements between these moments, and we do not build a location history of you.

6.2 Permission

The App asks for location permission in context, at the point you first try to check in or redeem. You can decline, and you can change the permission at any time in your device settings.

6.3 What Happens If You Decline

Declining location permission does not affect your membership, your Pours, your billing, or any other App feature. If you decline, the App simply cannot verify your arrival, so that visit is not recorded as a verified Check-In. There is no penalty to you. A Partner Venue is never charged for a visit that was not verified.

6.4 How It Is Used

Use of geolocation data is strictly limited to service performance (Check-In arrival verification, Pour redemption verification including device verification and venue confirmation, and redemption of an Introduction Pour), Partner Venue settlement and reconciliation as described in Section 3.2, and fraud prevention. We do not use geolocation data for advertising, and we do not sell or share it for cross-context behavioral advertising.

6.5 What We Keep

Raw location coordinates are kept only as long as they are needed to verify the event and to support any dispute, fraud review, chargeback, audit, or legal hold. Otherwise they are deleted on the schedule in Section 10. What we keep past that point is the Verification Record, which is a minimized record of the venue, the date and time, and whether the check passed. The Verification Record does not contain raw coordinates.

7Receipt Data from Boost Missions

When Members upload receipt photographs for Boost Mission verification, those images may contain purchase details, venue information, transaction amounts, and timestamps. DPC collects this data solely for mission verification and reward processing. Receipt images may be shared with the applicable Partner Venue for verification under the Partner Data Processing Addendum. Receipt data may be manually reviewed by DPC support staff for verification purposes. DPC does not use receipt images for analytics, model training, or marketing. Receipt images are deleted within ninety (90) days after the mission verification window closes unless retention is required for an active dispute or audit.

8DPC Rewards Points Data

DPC Rewards Points are non-monetary program benefits. We track Points balance, earning events (source activity, points awarded), and redemption events (catalog item, points used, fulfillment status). Points data is used solely for program administration. Points balance is not displayed alongside any dollar value in any Member-facing surface. Points expire on a schedule established by DPC and forfeit upon cancellation or termination of membership.

9Data Minimization

• Member-facing screens display first name and last initial only.
• All Pour operations are server-authoritative and audit-logged with minimal PII.
• Check-In is a one-tap action. We capture the location reading needed to verify presence, and nothing more.
• Fraud detection uses system-level identifiers rather than exposing Member data to venue staff.
• Venue staff have no access to Member personal information beyond what is displayed on the live redemption screen and the venue name for device verification. Introduction redemptions occur on the member's device; venue staff verify the guest's photo identification at the point of service as they would for any patron.
• Partner Venue settlement surfaces show counts and totals. They do not show Member identity or location data.
• Schedule A reimbursement rates and per-Pour dollar values are partner-facing settlement data only and are not exposed in any Member-facing surface.
• Non-member guest lead records are minimized to the name and email needed to send the one-time code, attribute the introduction, send a single post-visit invitation, and prevent abuse.

10Data Retention

We retain personal information as follows:

• Account and profile data: retained as long as account is active. Retained for twenty-four (24) months after account cancellation effective date, then deleted or anonymized. Pours expire monthly and forfeit on cancellation under the Pour architecture, so account data is not retained beyond the cancellation date for Pour-balance reasons.
• Payment transaction records: retained for seven (7) years per tax and financial record-keeping requirements.
• Support ticket records: retained for three (3) years after resolution.
• Pour redemption log records: retained for three (3) years for audit and dispute resolution.
• Raw geolocation coordinates (Check-In and Pour redemption): deleted within ninety (90) days after the event, unless retained for an active dispute, fraud review, chargeback, audit, or legal hold, in which case they are deleted when that matter closes.
• Verification Records (Check-In and Pour redemption: Member identifier, Partner Venue, date and time, and whether the location check passed): retained for four (4) years, then deleted or de-identified. These records support Partner Venue settlement, billing disputes, and sales and use tax recordkeeping.
• Monthly Entitlement Period close records (issued, redeemed, expired counts per Member per Circle per period): retained for three (3) years.
• Pause history: retained for three (3) years for cap enforcement and audit.
• Receipt images (Boost Missions): retained for ninety (90) days after mission verification closes.
• DPC Rewards Points ledger and event history: retained for three (3) years after Member account closure for audit.
• User-generated content: retained per the UGC license terms in the Member Terms of Service.
• Fraud and audit investigation logs: retained for five (5) years or as required by law.
• Aggregated, de-identified data: may be retained indefinitely for analytics and business planning.
• Guest lead data (non-member guests introduced through The Introduction who do not become members): retained for twelve (12) months after the Introduction is extended, then deleted or anonymized. If the guest becomes a member, standard account retention applies.

11Data Security

We implement reasonable administrative, technical, and physical security measures including encryption in transit, secure access controls, and regular security reviews. No transmission method is 100% secure. We cannot guarantee absolute security.

11.1 Breach Notification

If we become aware of a breach of the security of the system that compromises the security, confidentiality, or integrity of your personal information, we will notify you and any applicable California authorities as required by California Civil Code Section 1798.82. We will provide that notice in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Where required, the notice will describe the categories of personal information involved and the steps you can take to help protect yourself.

12Your California Privacy Rights

12.1 Right to Know

You may request disclosure of the categories and specific pieces of personal information collected, sources, purposes, and third-party recipients.

12.2 Right to Delete

You may request deletion of personal information, subject to legal exceptions (e.g., information necessary to complete a transaction, detect fraud, or comply with legal obligations). Verification Records used for Partner Venue settlement and tax recordkeeping are subject to those exceptions and are retained on the schedule in Section 10.

12.3 Right to Correct

You may request correction of inaccurate personal information.

12.4 Right to Opt Out of Sale or Sharing

DPC does not sell your personal information. DPC does not receive monetary payments from any third-party advertising partner in exchange for the sharing described in this Section. DPC does share certain online activity data collected through our Site (such as device and browser identifiers, IP address, and pages viewed) with third-party advertising partners for cross-context behavioral advertising, as defined under the California Consumer Privacy Act. This sharing is limited to Site-collected data. DPC does not share your precise geolocation data, your Check-In records, your Membership Pour redemption data, or any other information collected through the App, for cross-context behavioral advertising. You have the right to opt out of this sharing at any time, as described in Section 12.5.

12.5 How to Opt Out of Sharing for Cross-Context Behavioral Advertising

You may opt out of DPC's sharing of your personal information for cross-context behavioral advertising by either of the following methods:

(a) Clicking the "Do Not Sell or Share My Personal Information" link located in the footer of our Site; or

(b) Enabling the Global Privacy Control ("GPC") signal in your browser.

DPC honors GPC as a valid opt-out preference signal. When you opt out through either method, DPC will suppress advertising tools that share your online activity data with third-party advertising partners for the browser or device from which you exercised the opt-out.

Your opt-out preference applies to the specific browser or device on which it was exercised. If you use multiple browsers or devices, you may need to opt out on each one or enable GPC in each browser. Where technically possible, DPC remembers your opt-out preference across future sessions using an opt-out cookie. Clearing your browser cookies may reset your opt-out preference, in which case you may need to opt out again.

12.6 Right to Non-Discrimination

We will not discriminate against you for exercising privacy rights, though exercising certain rights may affect service functionality.

12.7 Right to Limit Use and Disclosure of Sensitive Personal Information

You may request that DPC limit the use and disclosure of your sensitive personal information (including precise geolocation data and any other sensitive personal information as defined under California law) to uses necessary to perform the services you have requested and other purposes authorized by California law. You may also simply decline or withdraw location permission on your device, as described in Section 6.

12.8 How to Exercise Your Rights

To submit a privacy rights request, you may:

• Email: privacy@downtownpourcollective.com
• Submit a request through the App (Settings > Privacy > Submit Request)
• Mail: Table & Town LLC, 2601 Horseshoe Ct, Livermore, CA 94551

We will verify your identity before fulfilling requests using information already on file (email, phone, account details). You may designate an authorized agent to submit a request on your behalf with proper written authorization.

We will respond to verified requests within forty-five (45) calendar days. If additional time is needed, we will notify you of the extension and the reason. If a request is denied in whole or in part, we will explain the basis for the denial and inform you of your right to appeal by contacting us at the address above.

13Children's Privacy

The Service is not directed to children. The DPC membership program is restricted to individuals who are at least twenty-one (21) years of age and legally permitted to purchase and consume alcoholic beverages in the State of California, as set forth in the Member Terms of Service. We do not knowingly collect personal information from anyone under the age of thirteen (13), and we do not knowingly collect personal information from anyone under the age of twenty-one (21). If we learn that we have collected personal information from a child under thirteen (13), or from any individual under twenty-one (21), we will delete that information promptly.

14Third-Party Links and Browser Privacy Signals

The App and Site may link to third-party services. We are not responsible for their privacy practices.

DPC does not respond to Do Not Track (DNT) browser signals because no uniform standard for those signals has been established. DPC does honor the Global Privacy Control (GPC) browser signal as a valid opt-out preference signal, as described in Section 12.5.

15Changes to This Privacy Policy

Material changes will be communicated at least fourteen (14) days before the effective date. Continued use constitutes acceptance. Where program changes occur in connection with discontinuation or wind-down of the DPC program, notice and timing follow the Member Terms of Service §19 (Program Discontinuation and Wind-Down).

16Contact Information

Operator: Table & Town LLC

DBA: Downtown Pour Collective

Address: 2601 Horseshoe Ct, Livermore, CA 94551

Website: www.downtownpourcollective.com

Privacy Inquiries: privacy@downtownpourcollective.com

Support: support@downtownpourcollective.com