Privacy Policy

PlugVine serves two groups of people, and this Policy applies to both:

• Businesses (“Clients”) — the local businesses that create an account to run referral campaigns and view analytics.
• Customers (“Consumers”) — the customers of those businesses who claim a PlugPass, refer a neighbor, or redeem an offer.

A Client is the controller of its own customer relationships; PlugVine processes Consumer information both to provide analytics to that Client and to operate the cross-business referral network described below.

From Businesses. When a Client signs up we collect the business name, the owner’s authentication identity (managed by our sign-in provider), business address, ZIP code, phone number, website, average transaction value, and the referral offer(s) they configure. For paid plans, our payment processor collects billing details on our behalf (see “Payments”).

From Consumers. When a Consumer claims or redeems a pass we collect:

• Phone number — used to verify the person and to link referrals. It is immediately hashed (see “How we protect phone numbers”); we do not store the raw number.
• First name (only if provided) and the last four digits of the phone number — kept so the business can recognize a returning customer.
• Referral activity — which pass was claimed, who referred whom, whether a visit converted, the transaction amount the business enters, ZIP/zone, and the resulting reputation score (“PlugScore”).

Automatically. Like most web services, we collect limited technical data needed to operate and secure the Service — IP address, device/browser information, and interaction events (for example, a QR scan, a check-in, or a share). We use cookies and local storage for sign-in sessions and referral attribution (see “Cookies”).

A phone number is the one piece of sensitive identity we handle, so we treat it carefully. When a number enters our system it is converted, on our server, into a one-way cryptographic hash(HMAC-SHA256 with a secret key). We store only that hash, plus — for the business’s convenience — the first name and the last four digits.

The hash cannot be reversed back into the phone number. It lets us recognize the same person across referrals without keeping a directory of phone numbers. The raw number exists only in transit long enough to verify and hash it, and is then discarded.

• Provide, operate, and improve the Service and its analytics.
• Verify a Consumer’s phone number and prevent duplicate or fraudulent claims.
• Attribute referrals, calculate conversions, revenue, and PlugScore, and power the network’s density and reputation features.
• Process Client subscription payments.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Communicate with Clients about their account, and send Consumers one-time verification codes.
• Comply with legal obligations and enforce our terms.

We do not use personal information for third-party advertising, and we do not build advertising profiles.

We share information only in these limited ways:

• With the Consumer’s business. A Client can see its own customers’ first name, last four digits, referral relationships, and redemption/transaction activity — the information needed to recognize customers and reward advocates. Clients do not receive raw phone numbers.
• Service providers (subprocessors). We use trusted vendors to run the Service, listed below.
• Legal and safety. When required by law, subpoena, or to protect the rights, safety, and security of PlugVine, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell personal information, and we do not process it for targeted advertising.

The only text messages PlugVine sends are one-time verification codes, delivered through our sign-in provider (Google Firebase) so a Consumer can confirm their phone number.

Referral messages (“here’s a pass for you”) are composed and sent by a Consumer from their own phone and messaging app — PlugVine provides the link, but the Consumer decides whether and to whom to send it. PlugVine does not send marketing or promotional texts, and we do not message a Consumer’s contacts on their behalf. Standard carrier message and data rates may apply to messages you choose to send.

We use a small number of first-party cookies and browser local storage:

• Session cookie — keeps a signed-in Client authenticated.
• Referral attribution cookie — remembers which pass link a Consumer arrived from, so a referral is credited to the right person.
• Local storage — stores non-sensitive interface state (for example, a saved pass or a dismissed prompt) on your device.

We do not use third-party advertising or cross-site tracking cookies. Our bot-protection service (Google reCAPTCHA) may set its own cookies and is governed by Google’s privacy policy. You can block or delete cookies in your browser, though parts of the Service may not function without the essential ones.

We keep Client account information for as long as the account is active and as needed to provide the Service, then for the period required to meet legal, tax, and accounting obligations. Hashed Consumer identifiers and referral records are retained while they remain part of a Client’s active referral graph, and are anonymized or deleted on a valid deletion request as described below. We may retain limited records where necessary to resolve disputes, prevent abuse, or comply with law.

Under the Texas Data Privacy and Security Act (TDPSA), and depending on your circumstances, you may have the right to:

• Confirm whether we process your personal information and access it.
• Correct inaccurate personal information.
• Delete your personal information.
• Obtain a portable copy of information you provided.
• Opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects — none of which PlugVine engages in.

We will not discriminate against you for exercising these rights. If we decline a request, you may appeal by replying to our decision; we will respond within the timeframe required by applicable law.

How to exercise your rights. Email privacy@plugvine.com. Because we store phone numbers only as an irreversible hash, a Consumer deletion request works by you giving us the phone number to verify: we hash it with the same method, locate any matching records, delete the associated identity and reputation score, and anonymize the referral edges so the network’s aggregate history remains but can no longer be tied to you. We keep a minimal audit log (the hash and time of deletion) to prove the request was honored. Authorized agents may submit requests with proof of authorization.

We protect information with measures including one-way hashing of phone numbers, encryption of data in transit (HTTPS/TLS), access controls, and reputable cloud infrastructure. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information and to respond promptly to any incident.

The Service is intended for adults and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a minor has provided us information, contact us and we will delete it.

PlugVine is operated in the United States and intended for use in the United States. If you access the Service from elsewhere, you understand your information will be processed in the United States, where privacy laws may differ from those in your location.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice. Your continued use of the Service after an update means you accept the revised Policy.

Questions, requests, or complaints about privacy? Reach us at privacy@plugvine.com.

PlugVine is operated by Henry Ashu, a sole proprietor, located at 2229 Preston Lane, McKinney, TX 75071.