Privacy Policy

Cacao Craft is a software-as-a-service platform for bean-to-bar chocolate makers. We collect information to operate, improve, and secure the Services; to communicate with customers and prospects; and to comply with legal obligations. We do not sell your personal information in the traditional sense, and we do not use your Customer Data to train generalized machine-learning models without your express opt-in.

Information you provide

• Account information. When you create an account, join the waitlist, or contact us, we collect your name, email address, company name, role, and (if applicable) billing address and payment information.
• Customer Data. When you use the Services, you may submit data such as recipes, batch records, origin documentation, wholesale account information, customer contact lists, brand assets, and other business content. You retain ownership of Customer Data, as described in the Terms of Service.
• Payment information. Payment details (card number, expiration, billing address) are collected and processed by our payment processor, Stripe. We do not store full card numbers on our servers.
• Support communications. When you contact us for support, we retain the content of your communications and any attachments.

Information collected automatically

• Log and device data. IP address, browser type and version, operating system, device identifiers, pages viewed, referring URL, and timestamps.
• Usage data. Features used, actions taken within the Services, performance metrics, and error reports.
• Cookies and similar technologies. See Section 12 for details on how we use cookies.

We use the information we collect to:

• Provide, operate, maintain, and improve the Services;
• Process payments, send invoices, and manage subscriptions;
• Personalize your experience and deliver features you request;
• Communicate with you about your account, product updates, and support requests;
• Send marketing communications about the Services (with your consent where required, and with an easy unsubscribe option);
• Detect, prevent, and respond to fraud, abuse, security incidents, or illegal activity;
• Comply with legal obligations, respond to lawful requests, and enforce our agreements; and
• Perform analytics on aggregated, de-identified data to understand usage patterns and improve the Services.

Where required by law (including the GDPR), our legal bases for processing are: (a) performance of a contract with you, (b) our legitimate interests in operating and improving the Services, (c) your consent, and (d) compliance with legal obligations.

We do not sell your personal information in exchange for monetary compensation. We share information only in the following circumstances:

• With service providers who process information on our behalf under contractual obligations (see Section 5);
• At your direction, including when you choose to connect third-party integrations (such as Shopify, QuickBooks, Faire, Square, or PayPal) or share public lot pages or sell sheets;
• For legal reasons, including to comply with law, respond to subpoenas or lawful requests, protect the rights or safety of Cacao Craft or others, or in connection with a government investigation; and
• In connection with a business transaction, such as a merger, acquisition, or sale of assets — in which case we will notify you and honor the commitments in this Privacy Policy.

We work with a limited set of third-party service providers who process data on our behalf under contractual obligations. Current providers include:

• Vercel — hosting and delivery of the website and application.
• Supabase — database, authentication, and file storage.
• Stripe — payment processing for subscription fees.
• Resend — transactional and marketing email delivery.
• Anthropic — AI model provider for generating tasting notes, label copy, and other AI-assisted features. Anthropic processes the inputs and outputs of specific AI requests but does not use them to train its models in its default API configuration.

We do not transfer data to these providers beyond what is needed to deliver the Services to you, and we evaluate providers' data protection practices before and during our engagement with them.

We retain personal information and Customer Data for as long as your account is active, as necessary to provide the Services, and as required by law. After account termination, we retain Customer Data for up to 30 days to allow for export, after which we will delete or anonymize it in the ordinary course of our backup and retention practices, except where a longer retention period is required by law (for example, for tax, accounting, or regulatory compliance).

We implement administrative, technical, and organizational measures designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption in transit (TLS) and at rest, access controls, and regular security reviews. No security measures are perfect, however, and we cannot guarantee absolute security.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights regarding your personal information:

• Access — the right to request a copy of the personal information we hold about you;
• Rectification — the right to request correction of inaccurate information;
• Erasure — the right to request deletion, subject to legal retention obligations;
• Restriction — the right to request that we limit our processing;
• Portability — the right to receive a machine-readable copy of your data and transmit it to another service;
• Objection — the right to object to processing based on our legitimate interests;
• Withdraw consent — where we rely on your consent, the right to withdraw it at any time;
• Complain — the right to lodge a complaint with your local data protection authority.

To exercise these rights, contact us at privacy@cacaocraft.co. We may need to verify your identity before responding.

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to know what personal information we have collected about you, the sources, the purposes, and the third parties with which we have shared it;
• Right to delete personal information we have collected from you, subject to legal exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. Cacao Craft does not sell personal information or share it for cross-context behavioral advertising;
• Right to limit the use and disclosure of sensitive personal information. We only collect sensitive personal information (such as account credentials) for the limited purposes necessary to provide the Services;
• Right to non-discrimination for exercising your privacy rights.

To exercise your California rights, contact us at privacy@cacaocraft.co. You may designate an authorized agent to submit requests on your behalf, subject to verification. We do not charge a fee for processing requests.

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe we have collected personal information from a child under 16, please contact us and we will delete it promptly.

Cacao Craft operates from the United States, and personal information we collect may be processed in the United States and other countries where our service providers operate. If you are located outside the United States, please note that the privacy laws of those jurisdictions may differ from the laws of your home country. Where required by law (such as transfers from the European Economic Area, United Kingdom, or Switzerland), we rely on mechanisms such as Standard Contractual Clauses to legitimize international transfers.

We use cookies and similar technologies to operate the Services, remember your preferences, analyze usage, and support security. Specifically:

• Strictly necessary cookies are required for core functionality (e.g. authentication, session management);
• Functional cookies remember preferences (e.g. billing interval toggle);
• Analytics cookies help us understand how the Services are used so we can improve them. We currently use minimal first-party analytics and do not use third-party advertising trackers.

You can control cookies through your browser settings. Note that blocking strictly necessary cookies may prevent parts of the Services from functioning.

Cacao Craft does not currently respond to Do Not Track (DNT) browser signals in a standardized way because no uniform DNT standard has been adopted. We do honor the Global Privacy Control (GPC) signal for California residents as a valid opt-out of the sale or sharing of personal information, to the extent applicable.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Services at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

For privacy-related questions or to exercise your rights, contact us at:

Downs Ventures LLC
681 Frederick Cir
Flint, TX 75762
Privacy inquiries: privacy@cacaocraft.co
General inquiries: hello@cacaocraft.co