Block 55 for Shopify — Privacy Policy

1. Who We Are

Block 55 is a reservation, experience and event platform for wineries, operated by Weinnotes, Inc. ("Block 55," "we," "us," or "our"). This policy describes how the Block 55 app for Shopify (the "App") collects, uses, stores and deletes information when a winery installs it on their Shopify store.

This policy applies to the App specifically. Our general privacy practices for the Block 55 platform are described in our Terms of Use and Privacy Policy.

2. Who This Policy Covers

The App handles information about two groups of people:

• Merchants — the winery that installs the App on their Shopify store and the staff who use it.
• Guests — people who make reservations or buy event tickets through Block 55 and who are, or become, customers of the merchant's Shopify store.

For guest information, the merchant is the data controller and Block 55 acts as a data processor on the merchant's behalf. Guests who have questions about how a specific winery uses their information should contact that winery directly.

3. Information We Collect From Merchants

When a merchant installs and connects the App, we collect:

• Store identity — the store's myshopify.com domain.
• Access credentials — the access token Shopify issues to the App, which allows the App to act on the store within the permissions the merchant approved. Tokens are stored encrypted at rest and are never sent to third parties.
• Account link — the association between the store and the merchant's Block 55 winery account.
• Contact details — if a merchant who does not yet have a Block 55 account asks us to set one up, we collect the winery name, a contact name, an email address and a phone number so that we can reach them.

4. Information We Access About Guests

When a guest makes a reservation or buys an event ticket through Block 55, the App may:

• Look up an existing customer in the merchant's Shopify store by email address or phone number, to avoid creating a duplicate record.
• Create a customer in the merchant's Shopify store using the guest's first name, last name, email address and phone number as provided at booking, tagged "Block 55" so the merchant can identify guests who came through reservations.
• Read customer tags so that wine club members can be recognised at booking, for example to apply member pricing or admit them to members-only experiences.
• Read customer notes and timeline comments, when winery staff open a guest's record in Block 55, so that staff can see notes the winery has already kept in Shopify.
• Read lifetime spend and order count, when winery staff open a guest's record, so that staff can recognise a valued guest.

Marketing consent is only recorded in Shopify when a guest has explicitly opted in at booking. The App never marks a guest as subscribed on its own.

The App does not read order contents, payment details, addresses beyond what the guest supplies at booking, or any customer information unrelated to the guest making a reservation.

5. Information We Write to the Merchant's Store

To let merchants add booking to their storefront without configuration, the App writes the following into the merchant's own Shopify store, where it remains under the merchant's control:

• The merchant's Block 55 winery identifier and brand colour, as app metafields, so the booking block can render correctly.
• The merchant's experiences and events, as metaobject entries, so they can be selected by name in the Shopify theme editor. These contain only the name, a short summary, an identifier, and (for events) an image link. They are refreshed when the merchant asks, and entries for experiences that are no longer active or events that have passed are removed.

This is the merchant's own business information, not personal information about guests.

6. How We Use Information

We use the information described above only to provide the App's functionality to the merchant:

• Matching reservation guests to the merchant's existing Shopify customers
• Adding new guests to the merchant's Shopify customer list
• Recognising wine club members at the time of booking
• Showing winery staff relevant context about a guest
• Publishing the merchant's experiences and events to their theme editor
• Contacting a merchant who has asked us to set up a Block 55 account
• Notifying us when a merchant installs or removes the App, so we can support them

We do not sell personal information. We do not use guest information for our own marketing, for advertising, to build profiles across merchants, or for any purpose other than delivering the service to the merchant whose store it came from.

7. Protected Customer Data

Shopify classifies customer names, email addresses and phone numbers as protected customer data. The App requests access to this data only because reservations cannot be matched to customers without it.

We apply the following practices:

• Minimisation — the App requests only the fields needed for each operation and does not retrieve a customer's order history, addresses or other information it does not use.
• Purpose limitation — customer data is used solely for the purposes in Section 6.
• Limited retention — see Section 8. We do not keep a copy of the merchant's customer records.
• Access control — customer data is accessible only to Block 55 systems and staff who need it to operate the service, and access tokens never leave our servers.
• Encryption — data is encrypted in transit, and access credentials are encrypted at rest.

8. What We Retain, and For How Long

Block 55 keeps the minimum needed to make the integration work:

• Store connection — the store domain, access token and account link, for as long as the App is installed.
• Customer mapping — for each guest matched or created, we may keep the Shopify customer identifier, the guest's club status, and the date it was last checked, so that later lookups are fast and accurate. We do not store the customer's Shopify record itself.
• Merchant contact details — provided during onboarding, for as long as we have a business relationship with the winery.

Customer lookups, notes and spend information are retrieved from Shopify when needed and are not stored by the App.

Reservation records, guest contact details provided at booking, and guest notes kept by winery staff are part of the Block 55 platform, collected by the winery under its own agreement with us. They are governed by our general privacy policy and retained according to the winery's account, independent of the App.

9. Uninstalling and Deletion

When a merchant uninstalls the App, we immediately deactivate the integration and discard the store's access token. The merchant's Block 55 account, reservations and settings are not affected — the App is one way of using Block 55, not the account itself. A merchant who reinstalls picks up where they left off.

Forty-eight hours after uninstall, in response to Shopify's shop/redact request, we permanently delete the store connection, any customer mapping created for that store, and any onboarding contact details collected through the App.

When a merchant or their customer requests deletion of a customer's data via Shopify (customers/redact), we delete any mapping we hold for that customer for that store.

When a customer requests a copy of their data via Shopify (customers/data_request), we provide what the App holds for that customer within 30 days.

A winery that wishes to close its Block 55 account entirely can contact us at the address in Section 14. Some records may be retained where we are legally required to keep them.

10. Who We Share Information With

We share information only with service providers who help us operate Block 55, under agreements that restrict their use of it:

• Shopify — the platform the App runs on, and the source and destination of customer records.
• Hosting providers — the infrastructure on which the App and the Block 55 platform run.
• Communications providers — email and text messaging services used to send reservation confirmations and to contact merchants.

We may also disclose information where required by law, to protect our legal rights, or in connection with a merger, acquisition or sale of assets, in which case merchants will be notified.

We do not share guest information between merchants, and we do not sell, rent or license personal information to anyone.

11. Merchant Responsibilities

Merchants are responsible for ensuring they have an appropriate legal basis to share their customers' information with Block 55, for maintaining their own privacy policy that covers the use of reservation and booking tools, and for responding to their customers' privacy requests. We will assist merchants with such requests as described in Section 9.

12. Security

We implement administrative, technical and physical safeguards appropriate to the sensitivity of the information we handle, including encryption in transit, encrypted storage of access credentials, and access controls on our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting merchant or guest information, we will notify affected merchants without undue delay.

13. Children's Privacy

Block 55 serves wineries and their adult guests. The App is not directed at anyone under 21, and we do not knowingly collect information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it.

14. Contact Us

For questions about this policy, to make a privacy request, or to close a Block 55 account:

Block 55 (Weinnotes, Inc.)

Email: hospitality@block55.app

Website: block55.app

15. Changes to This Policy

We may update this policy as the App changes. Material changes will be reflected in the "Last Updated" date above and, where appropriate, communicated to merchants through the App or by email. Continued use of the App after a change constitutes acceptance of the updated policy.