Privacy policy

Who we are

SB Wine List (sbwinelist.com) is a guide to Santa Barbara County wine: its AVAs, wineries, tasting rooms and events. "We", "us" and "our" mean the SB Wine List team.

What we collect

Only what the site needs to work and to tell us how it is used. By what you do:

• Creating an account: your email address, your password (stored only as a bcrypt hash, never as the password itself), your language, your role (visitor or winery), whether you verified your email, your email choices, and a name if you give one.
• Joining the weekly email: your email address, your language, the page where you joined, when you joined and confirmed, and a private unsubscribe link. If you arrived from a tagged link or an ad, we note the campaign tags with the signup (see the next section).
• Planning a wine day: the wineries and events you add. They stay in your browser's storage; when you are signed in we keep a copy with your account so it follows you to other devices.
• Sending a winery a request: your name, email, party size, preferred date and message. We pass them to that winery so it can answer you.
• Wineries that claim a listing or become members: the name, email, phone and role given to us, the listing managed, the plan, and a record of each payment (amount, date and Stripe's reference). Card details go to Stripe; we never see or store them.
• Submitting an event: the event details and the email address you post them with.
• Reporting a problem: what you write, an email address if you add one, the page, your language and your browser's user-agent string.

Our own visit counts

We count visits ourselves, in our own database, so the numbers we show wineries are honest. When a page loads, your browser tells us the page address, your language and the site that sent you (the referrer). It also tells us when you click a winery's website, phone, directions or booking link, add a stop to your day, filter by who is open, or finish our taste quiz (the styles and area you picked).

If you arrived through a link with campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), we record those tags with your first page view and with an email signup. We note whether the visit came from a Meta ad click, but not the click's identifier.

To group the pages of one visitor, we set a cookie named sbwl_sid that holds a random identifier, lasts one year and can be read only by our server. These records do not hold your name, email address or IP address. One kind is linked to your account: a request you send a winery while signed in. Our own test tools and known crawlers are not counted.

Cookies and browser storage

• sbwl_sid: our anonymous visit counter, described above.
• Sign-in cookies set by Auth.js, only when you sign in, to keep you signed in.
• Local storage for your wine day plan and your taste quiz answers.
• Session storage, for the rest of a visit, for the campaign tags you arrived with.
• sbwl_ads_optout (a cookie and local storage) when you turn ad measurement off.
• Meta's own cookies (such as _fbp and _fbc), only when the Meta Pixel runs (next section).

Meta ad measurement

We advertise SB Wine List on Facebook and Instagram. To learn whether those ads work, our public pages can load the Meta Pixel, a script from Meta Platforms, Inc. When it runs, Meta receives the address of the page you view, that the page was viewed and, if you join our email list, that a signup happened. Meta's script also receives your IP address and browser details and sets its own cookies, and Meta may link this to a Facebook or Instagram account you have. We turn off the pixel's automatic reading of buttons and forms.

When you join the email list, our server also reports the signup to Meta through Meta's Conversions API: your email address turned into a one-way SHA-256 code (a hash), your IP address and browser, the page, and Meta's browser cookies. Meta uses the hash to match the signup to someone who saw an ad; it does not receive your email in readable form, but matching is the purpose, so we treat it as personal information. This happens only for new signups.

The pixel never loads in signed-in areas (your account, the winery dashboard, admin) or on sign-in pages. Neither the pixel nor the Conversions API runs if you have opted out or your browser sends Global Privacy Control. Meta reports results to us in totals; Meta's own use of the data is covered by Meta's privacy policy.

Why we use it

• To run the site and your account.
• To send the emails you asked for (the weekly email, event reminders) and account notices such as payments and approvals.
• To pass your request to the winery you wrote to.
• To count visits and actions honestly, for wineries and for us.
• To measure whether our own ads bring people to the email list.
• To keep the site safe: signup attempts are counted per IP address in memory for a few minutes to slow down spam, and not saved.
• To meet legal duties, such as tax records for payments.

Who helps us run the site

These companies handle data for us to provide their service:

• Vercel hosts the site and serves our pages and images; like any web host, it handles your IP address and browser details in its request logs. Vercel Blob stores the photos, logos and flyers that wineries and organisers send us.
• Neon hosts our database.
• Resend delivers our emails, so it receives your email address and the message.
• Stripe runs wineries' payments on its own checkout pages and the billing portal.
• Mapbox draws our maps and drive times. Your browser loads map tiles from Mapbox directly, so Mapbox receives your IP address, browser details and the part of the map you view, and its map library reports map loads to Mapbox. When you plan a day, the stops' coordinates go to Mapbox to work out the drive; we do not store its answers.
• Google: listing facts such as hours, ratings and some photos come from Google's Places service. That is data about businesses, not about you. We serve those photos through our own image service; if it falters, your browser may load one straight from Google.
• Meta, for ad measurement as described above. Meta also uses the data for its own purposes, which is why California law treats it as sharing (next section).

Our fonts are served from our own site. Member wineries see counts of visitors and actions on their listing, never your name or email, except in a request you choose to send them.

Selling and sharing

We do not sell personal information for money, and we never sell or rent our email list. Under California law, letting Meta's pixel and Conversions API measure our ads can count as "sharing" personal information for cross-context behavioral advertising, and some read it as a "sale". You can opt out at any time on Your privacy choices.

Global Privacy Control: if your browser or an extension sends the GPC signal, we treat it as an opt-out for that browser automatically. No click needed.

Your choices

• Every weekly email has an unsubscribe link; using it deletes your address from the list.
• Signed in, you can change your email choices on your account page.
• You can delete your account on your account page. That deletes the account, your saved wine day and your list entry. Payment records, and requests you sent to wineries, stay on file without the link to your account.
• You can turn off Meta ad measurement for your browser on Your privacy choices, or send Global Privacy Control.
• You can clear our cookies and storage in your browser settings at any time.

California privacy rights

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you these rights:

• To know: the categories and specific pieces of personal information we hold about you, where they came from, why we use them and who we disclose them to.
• To delete personal information we collected from you, with the exceptions the law allows (such as payment records we must keep).
• To correct personal information that is wrong.
• To opt out of the sale or sharing of your personal information, on Your privacy choices or with Global Privacy Control.
• To limit the use of sensitive personal information. We do not collect sensitive personal information as the law defines it, so there is nothing to limit.
• To equal treatment: we will not treat you differently for using any of these rights.

What we have collected in the last 12 months: identifiers (email address, name, IP address, cookie identifiers); customer records (for wineries, phone numbers and payment records); commercial information (wineries' plans and payments); internet activity on our site (pages viewed and the clicks described above); and the wine preferences you give our taste quiz. They come from you, your browser, and for wineries, Stripe. We disclose them to the service providers listed above for the purposes above, and we share identifiers and internet activity with Meta for ad measurement unless you opt out.

To make a request, contact us as shown below. We confirm a request within 10 business days and answer within 45 days. To protect you, we ask you to confirm from the email address we hold. An authorized agent may ask on your behalf with your signed permission. We do not knowingly sell or share the personal information of anyone under 16.

How long we keep it

• Your account, until you delete it.
• Your place on the email list, until you unsubscribe or delete your account.
• Visit records, problem reports, requests to wineries and winery records: we do not yet delete these on a fixed schedule. Visit records hold no name or email. When we set a schedule, we will publish it here.
• Payment records, as long as tax law requires.

Age

SB Wine List is about wine and is meant for adults 21 and over. We do not knowingly collect personal information from anyone under 21. If you believe someone underage gave us their details, tell us and we will delete them.

Security

Passwords are stored as bcrypt hashes, every connection uses HTTPS, and access to our database is limited to our team. No system is perfect; if a breach affects your information, we will tell you as the law requires.

Changes to this policy

When we change this policy, we update the date at the top. For a change that matters, we also say so on the site, or by email to the list.

Contact us

Questions, or a request about your information: write to hello@sbwinelist.com.

The SB Wine List team