This Privacy Policy ("Policy") explains how Pinnacle Promotions USA LLC ("Pinnacle Promotions," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use our services. It also explains the choices and rights you have. Please read it carefully.

This Policy covers the public website at pinnacle-promotions.com (the "Site"), the client and brand-ambassador web portal at app.pinnacle-promotions.com (the "Portal"), and the Pinnacle Promotions mobile app for iOS and Android (the "App") — together, the "Services." Brand ambassadors and client companies also sign separate agreements during onboarding; where one of those agreements addresses a specific use of information, it applies alongside this Policy.

Who we are

Pinnacle Promotions USA LLC is a Texas limited liability company that plans, staffs, and runs in-store liquor, beer, and wine tastings and other promotional beverage events for beverage suppliers and distributors across Southeast Texas. Events are run by TABC-certified brand ambassadors who work with us as independent contractors. Pinnacle Promotions is the party responsible for the personal information described in this Policy. You can reach us using the details in "Contact us".

Who this Policy covers

Site visitors — anyone browsing the Site, using the contact form, or applying for a brand-ambassador role.
Brand ambassadors — independent contractors who onboard with us and run tastings through the App.
Client users — people who use the Portal or App on behalf of a supplier or distributor that books tastings with us.
Tasting attendees — members of the public who sample a product at an event. We do not collect attendees' names or contact details; see "Tasting attendees".

Information we collect

From Site visitors and applicants

Contact and inquiry details. Your name, company, email address, phone number, the markets you are interested in, and the contents of your message.
Application details. If you apply to be a brand ambassador: your name and contact details, date of birth (to confirm you are 21 or older, as Texas law requires for alcohol tastings), mailing address, work authorization, TABC certification status, transportation and availability, experience, and any photo, résumé, or documents you choose to upload.
Technical data. IP address, general (city- or region-level) location, browser and device type, referring page, and the pages you view, recorded by our hosting and security provider, Cloudflare, to keep the Site secure and reliable and to count page views in aggregate with Cloudflare Web Analytics, which uses no cookies.
Cookies. Strictly necessary cookies only, by default. See our Cookie Policy.

From brand ambassadors

Profile and contact details. Name, email address, phone number, mailing address, date of birth, and a profile photo.
Onboarding and compliance records. Your TABC certification (including a photo of the card, which we read automatically to capture your name, certificate number, and issue and expiry dates), the voided check you upload for direct deposit, your availability and the area you are willing to travel, and the documents you sign electronically — the Independent Contractor Agreement, IRS Form W-9, direct-deposit authorization, Card Use Agreement, notification consent, and, if you receive a purchasing card, the cardholder terms — together with the record of each signature (name, IP address, browser or device details, and time).
Tax and payment details. Your IRS Form W-9, including your Social Security or Employer Identification Number, and the voided-check image that shows the bank account for your direct deposit. The taxpayer number is stored encrypted. The taxpayer number, your signed W-9 (which shows it), and the voided-check image are sent to our accounting provider when your payee record is created there, and are then erased from our systems.
Purchasing-card details. If you are issued a Pinnacle purchasing card, we share your name, date of birth, address, email, and phone number with Stripe, which runs our card program with its issuing bank, Cross River Bank, to create the card. We keep only Stripe's reference identifiers for the cardholder and card; the card number and security code never pass through our servers.
Work activity. The tastings you are offered, accept, or decline; your check-in and check-out times and precise locations at the venue; your odometer readings and, when you ask for a driving route, your starting point, for mileage records; setup, event, and receipt photos; the anonymous guest entries described below; recap notes; and the ratings and performance notes our team records about the events you run, which only our team sees.
Messages. Messages you exchange with our team or a client through the App.
Device and diagnostic data. Push-notification token, installation identifier, device model and operating system, App version, and crash and performance diagnostics.
Sign-in and security records. For each sign-in and security-relevant action: the IP address, browser or device, and the approximate (city-level) location we derive from the IP address.

From client users

Account and business details. Your name, work email address, phone number, role, profile photo, and the name, address, and billing contact of the company you represent.
Bookings and catalog. The tastings you request, the venues and dates, the products and recipes you list, and your notes and preferences.
Billing. Invoices, payment history, and your chosen payment method. Card and bank details are entered directly with Stripe, our payment processor; we do not store card numbers.
Signed agreements and consents. Your billing agreement and, if you give it, your consent for us to reference your brand in our marketing.
Location, if you choose to use it. If you use "Find near me" in the App to search for venues, your approximate location is used for that search.
Device, technical, and sign-in data. As described above for the Portal and App.

Tasting attendees

Brand ambassadors log each guest who samples a product as an anonymous entry: the guest's approximate age range (21–34, 35–49, or 50+) and gender as observed by the ambassador, the products the guest tried, whether they liked them, and how many they bought. We do not collect attendees' names, contact details, photos, or any other identifier, and an entry cannot be linked back to a person. Clients see these entries only as totals in their event report. Event photos are meant to show the setup and product, and ambassadors are asked not to photograph identifiable customers.

Where information comes from

Most information comes directly from you or from the company you represent. Some is generated by your use of the Services (check-ins, photos, messages) or collected by your device with your permission (location, camera). We also receive limited information from our service providers — for example, payment status from Stripe — and we use public government data about licensed venues (not about people) to place events.

How we use information

To run tastings. Scheduling, staffing, and confirming events; matching brand ambassadors to events by distance, availability, and experience (our team makes the final assignment); recording check-in and check-out locations so our team can confirm the ambassador was on site; recaps and client reports.
To onboard and pay brand ambassadors. Verifying TABC certification, collecting tax forms, issuing purchasing cards, calculating pay and mileage, and paying by direct deposit.
To bill clients. Preparing quotes and invoices, charging authorized payment methods, sending receipts and reminders, and keeping accounting records.
To read documents automatically. We use optical character recognition — on your device or through our cloud provider, Microsoft Azure — to capture text from receipt photos and TABC cards so it does not have to be typed. A person reviews the result before it is relied on.
To frame profile photos. When you upload a profile photo, software on our own servers detects where a face is in the image so the photo can be cropped and centered consistently; a photo with no face in it is rejected. The positions of a few points on the face are used for a moment to level and crop the image and are then discarded — only the cropped photo is kept. This step does not identify anyone or compare faces, and we do not create or store a facial template or any other biometric identifier.
To communicate. Sending event assignments, reminders, invoices, security notices, and replies to your messages; and, only with your consent, promotional messages.
To keep the Services secure and working. Authentication, fraud and abuse prevention, audit logging, crash and performance monitoring, and troubleshooting.
To meet legal obligations. Tax reporting, alcoholic-beverage regulatory recordkeeping, responding to lawful requests, and enforcing our agreements.

We do not sell personal information, we do not use it for targeted advertising, and we do not make decisions about you by automated means alone that have legal or similarly significant effects.

Legal bases

Where the law requires a legal basis, we process personal information to perform our agreements with you or the company you represent; with your consent, where we ask for it; to comply with legal obligations; and for our legitimate interests in operating, securing, and improving the Services, provided those interests are not overridden by your rights.

How we share information

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as described here.

Service providers who process information on our behalf under contract and only to provide services to us: Microsoft Azure (application hosting, database, secure key storage, reading text from receipt photos and TABC cards, and generating recipe and product suggestions from the product details clients enter — no personal information is used for suggestions), Cloudflare (website and Portal hosting, security, bot protection, cookieless page-view analytics, and file storage), Stripe (client payments and invoicing, and brand-ambassador purchasing cards), Intuit QuickBooks (accounting, invoicing, brand-ambassador payee records and payments, and tax reporting), Google Firebase (Android push notifications, and crash reporting and performance monitoring in the App), Apple (iOS push notifications), Mapbox (maps, address lookup, and driving routes), InMotion Hosting (our email service, which sends the notices, invoices, and documents we email you and delivers brand-ambassador applications to our team), and Resend (delivering Site contact-form messages to us). We require these providers to protect personal information with safeguards at least as protective as those described in this Policy and to use it only to provide their services to us.
Public mapping and lookup services. To turn addresses into map coordinates, we send them — including a brand ambassador's home address — to OpenStreetMap's Nominatim service. To estimate the city a sign-in came from, we send its IP address to freeipapi.com. Maps on the Site and in the App load map images from OpenFreeMap and CARTO, which receive your IP address as any website you load does. These services act under their own terms and privacy policies.
Stripe and Cross River Bank, as card program manager and issuer. When a purchasing card is issued, Stripe and Cross River Bank, the bank that issues the card, also process the cardholder's information for their own identity-verification and regulatory purposes under their own privacy policies.
Clients and brand ambassadors, to each other. A client sees limited information about the brand ambassador assigned to its event — typically name and photo — and the event report. A brand ambassador sees the event details a client provides, including venue and contact information needed to run the event.
Between brands and their distributors. When a brand gives a distributor access to some of its products, the distributor can see those products and book tastings for them, and the brand can see which distributors it has given access to.
Apple Wallet and Google Wallet, if you choose to add your purchasing card to your phone's wallet.
Legal and safety. When we believe in good faith that disclosure is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our agreements; or to protect the rights, property, or safety of Pinnacle Promotions, our users, or the public.
Business transfers. As part of a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy.
With your direction or consent.

Location information

The App uses your phone's location only while the App is open — never in the background — and explains why before it asks for permission. Brand ambassadors need location permission to use the App for tastings. The App records your precise location when you check in and check out at a venue, to confirm you were on site. It uses an approximate fix (to within about 100 meters) to show how far tasting offers are from you — that distance is calculated on your phone and is not sent to us — and, when you ask for a driving route for your mileage log, it sends your starting point to our servers and our mapping provider to calculate the route. We also keep the home-base location derived from the address you give us, to match you with nearby events. Client users can choose "Find near me" to search for venues near their approximate location. You can withdraw location permission in your phone's settings at any time, but brand ambassadors cannot run tastings in the App without it.

Photos and camera

Brand ambassadors use the camera or photo library to capture the event setup, the tasting in progress, receipts, onboarding documents, and a profile photo. Client users can upload product images and videos, logos, and a profile photo. These images verify that the event took place, support client reports, and substantiate purchases and mileage. Photos are stored privately, and links to them are time-limited.

Cookies, local storage, and similar technologies

The Site uses only strictly necessary cookies unless you opt in to more; see the Cookie Policy; the Site also uses Cloudflare Web Analytics, which sets no cookies. The Portal uses a secure session cookie to keep you signed in and browser storage to remember your preferences and basic details of your signed-in profile. Stripe's payment software, which the Portal loads so clients can pay securely, sets its own cookies to prevent fraud. The App stores your work data on the device in an encrypted database so you can keep working without signal; it is erased when you sign out, except work that has not yet uploaded, which stays on the device until it can be sent. None of the Services use advertising or cross-site tracking cookies.

Communications and notifications

We send service messages — event assignments and reminders, schedule changes, invoices and receipts, onboarding and document notices, and security alerts — by push notification, in-app alert, and email. You can control push notifications in your phone's settings and adjust many notification preferences in the App or Portal; service messages needed to run an event or settle an account will still be sent. We send promotional email only with your consent, and every promotional message includes an unsubscribe link. We do not currently send text messages.

Data retention

We keep personal information for as long as your account is active and as needed for the purposes above. When an account is deleted — in the App under Settings, or as described on our account deletion page — profile and contact details are removed immediately. Some records must be kept after that: signed agreements, invoices, payment and tax records, and event records (including check-in and check-out locations, photos, and receipts) are kept to meet federal tax and Texas Alcoholic Beverage Commission recordkeeping rules; messages exchanged about events are kept with those records; and anonymous guest entries, which never identified anyone, are kept. We may delete these records one year after they are created, and we may keep archived copies in secure storage for as long as the law requires or our business reasonably needs them. Security and session records are purged automatically on a rolling schedule — by default, about one year for security logs and 90 days for ended sign-in sessions. Site inquiries and applications are delivered to our team by email; the copy of an application our systems hold while sending it is erased about 30 days later, and the emails are kept for a limited period consistent with our business needs unless the law requires longer. See our account deletion page for exactly what is removed and kept.

Security

We protect personal information with administrative, technical, and organizational safeguards designed for the sensitivity of the data we hold. All connections use TLS encryption. Tax identification numbers are encrypted at rest and erased once no longer needed; the App's on-device database is encrypted; access is role-based and logged; sessions can be revoked; and sensitive screens in the App — such as signed agreements, tax details, and card details — block screenshots and screen recording on Android, and hide their contents from screen recording and the app switcher on iOS. No system is perfectly secure, so we cannot guarantee absolute security. Keep your sign-in details confidential and tell us at once if you suspect your account has been compromised.

Your rights and choices

Depending on where you live, you may have the right to:

Access — confirm whether we process your personal information and obtain a copy of it.
Correct — fix inaccurate information. Most profile details can be updated directly in the App or Portal.
Delete — have your personal information deleted, subject to the retention obligations above.
Portability — receive a copy of information you provided in a portable format.
Opt out — of the sale of personal information, targeted advertising, or profiling that produces legal or similarly significant effects. We do not do any of these.
Withdraw consent — where we rely on it, without affecting processing that already occurred.
Appeal — ask us to reconsider a decision about your request.
Non-discrimination — exercise these rights without being treated differently for it.

To exercise a right, use the controls in the App or Portal, our contact form, or the email address below. We will verify your request — usually by confirming details associated with your account or inquiry — and respond within the time the law requires (45 days for Texas residents, which may be extended once where permitted). You may use an authorized agent where the law allows; we may ask the agent to prove their authority. If we deny a request, we will tell you why and how to appeal.

U.S. state privacy rights

Texas residents. The Texas Data Privacy and Security Act gives Texas residents the rights listed above. We do not sell personal data or engage in targeted advertising, and we do not process sensitive data without the consent the law requires. To appeal a decision we make about your request, reply to our response or contact us again and state that you are appealing. We will respond to an appeal in writing within 60 days, and if we deny it we will tell you how to submit a complaint to the Texas Attorney General.

California residents. Under the California Consumer Privacy Act, we do not sell or share personal information and have not done so in the preceding twelve months. In that period we may have collected the categories described in "Information we collect" — identifiers, professional and employment-related information, financial information, government identifiers, geolocation, visual information (photos), internet activity, and inferences drawn for event reports — for the business purposes described in this Policy. You have the rights to know, delete, correct, and limit, and the right not to be discriminated against for exercising them.

Residents of other states with comprehensive privacy laws have comparable rights, which we honor as described above.

Do Not Track and opt-out preference signals

Because we do not track you across other websites and do not sell or share personal information, our practices are consistent with browser "Do Not Track" settings and Global Privacy Control signals. Where the law requires us to treat such a signal as an opt-out request, we honor it.

Children

The Services are for adults. Brand ambassadors and anyone who samples alcohol at an event must be 21 or older; Portal and App users must be at least 18. The Services are not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

Third-party services and links

The Services link to and work with services we do not control — Stripe's payment and card interfaces, Apple Wallet and Google Wallet, Mapbox, OpenFreeMap, and CARTO maps, YouTube and Vimeo product videos that clients add, the Apple App Store and Google Play, and third-party websites. Their privacy practices are governed by their own policies, which we encourage you to read.

International visitors

The Services are operated from the United States and intended for people in the United States. If you use them from elsewhere, your information will be processed in the United States, where data-protection laws may differ from those in your country.

Changes to this Policy

We may update this Policy as our Services, practices, or the law change. We will revise the "Last updated" date and, for material changes, notify you through the App or Portal or by email before they take effect. Continued use of the Services after a change takes effect means you accept the revised Policy.

Contact us

Questions about this Policy, or a request to exercise a privacy right, can be sent to:

Entity: Pinnacle Promotions USA LLC
Privacy: privacy@pinnacle-promotions.com
Email: support@pinnacle-promotions.com
Online: Contact form · Account deletion
Region: Southeast Texas, United States