How Vincino handles information

1. Scope, operator, and privacy roles

This policy applies to vincino.org, the Vincino web application, related emails, and support interactions (collectively, “Vincino”). “Vincino,” “we,” and “us” refer to Vincino, the operator of the service. You can reach the operator at support@vincino.org or through the contact form.

Vincino is the controller or “business” for account administration, direct billing, security, support, and Vincino marketing data. A customer organization generally controls the prospect, lead, and team data its users place in a workspace; for that data, Vincino acts as the customer's service provider or processor and uses it only to provide, secure, and support the service or as required by law. Workspace owners are responsible for providing any notice and obtaining any lawful basis or consent required for the data they upload or use.

2. Information we collect

Vincino does not receive or store your full payment-card number. Stripe hosts checkout and payment management. Passwords and reset codes are not stored in readable form. Browser geolocation is optional; you can deny or revoke it in your browser or device settings.

Business listing data may identify a sole proprietor or other individual. It may come from Google Places or from a customer, not directly from that person. Customers must not use Vincino to store special-category, highly sensitive, health, government-identifier, precise financial-account, or children's data.

3. Google sign-in, Google Maps, and device calling

If you choose Google sign-in, Vincino requests only the OpenID, email, and basic profile scopes needed to identify your account. Google sends Vincino your Google account subject identifier, name, email address, and whether the email is verified. Vincino does not receive your Google password, Google Drive files, contacts, or other Google account content. We keep the subject identifier so the same Google account can be linked safely on later sign-ins.

Map and place features use Google Maps Platform. Google may receive the API project identifier, IP address, search or map requests, browser/device details, and location needed to return the requested map or place result. Google handles that information under the Google Privacy Policy. Use of Google Maps features is also governed by the Google Maps/Google Earth Additional Terms.

When you select “Call with this device,” Vincino opens the phone-handler configured on your device. Vincino does not provide the telephone network, record call audio, or listen to the call. Users may log outcomes and notes in the workspace.

4. How we use information and our legal bases

We use the information above to:

• provide accounts, maps, CRM, team, reporting, calling handoff, billing, and support features;
• authenticate users, enforce plan and rate limits, investigate fraud or abuse, and protect Vincino and its users;
• process requested transactions and communicate about accounts, security, purchases, support, and service changes;
• send newsletters only after an affirmative opt-in and maintain a suppression record after an unsubscribe;
• comply with law, enforce our terms, resolve disputes, and establish or defend legal claims; and
• analyze service reliability and improve features using limited, necessary operational data.
• when you affirmatively opt in for a particular rating, combine that color rating with other paid-workspace ratings for the same business in Community Signals. Each workspace contributes no more than one combined signal per business.

Where the GDPR or UK GDPR applies, the legal bases are performance of our contract for core account and service functions; legitimate interests in security, support, fraud prevention, and product reliability, balanced against individual rights; consent for optional browser location and newsletters; and compliance with legal obligations for required records. You may withdraw consent at any time without affecting prior lawful processing.

Vincino does not use personal information for solely automated decisions that produce legal or similarly significant effects.

Community Signals is optional and off by default. A user can return a rating to team-only visibility by editing and saving the review with public contribution disabled. The public aggregate does not display the contributor's identity, workspace, email, or written note. Because business listings can sometimes identify an individual or sole proprietor, users must contribute ratings lawfully and must not use the feature for harassment, discrimination, defamation, or sensitive profiling.

5. When information is disclosed

We may disclose information to:

• authorized members of your workspace, according to their role;
• Google Identity Services for optional Google sign-in, Google Maps Platform for map and place requests, Stripe for checkout and subscription management, Resend for transactional and opted-in email, Vercel for application hosting and request delivery, and Turso/libSQL for application database hosting;
• professional advisers or authorities when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish or defend claims; and
• a successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and notice requirements.

We do not sell personal information for money, share it for cross-context behavioral advertising, or use it for targeted advertising. We have not done so during the twelve months preceding this policy's effective date. We do not knowingly sell or share personal information of anyone under 18.

Paid Vincino users may view aggregated Community Signals for public business listings. Vincino stores the Place ID, Green/Yellow/Red distribution, number of contributing workspaces, and most recent update time. Current business names, categories, addresses, and listing links load from Google Maps at viewing time rather than being copied into the Community Signals aggregate. The feature does not disclose contributor identities or private written review text. An opted-in color rating may appear in the aggregate immediately after it is saved.

6. Cookies and similar technology

Vincino uses a strictly necessary, secure session cookie to keep users signed in and protect access to workspaces. If you use Switch account, this cookie may hold secure references for up to eight remembered Vincino sessions on that browser. It does not contain passwords, and Log out all accounts removes those browser sessions. When you start Google sign-in, Vincino also uses a short-lived, secure cookie to validate the request, prevent cross-site request forgery, and complete the account flow. We do not currently use third-party advertising cookies or behavioral advertising trackers. Hosting and security providers may process request logs needed to deliver and protect the service. If we add non-essential analytics or advertising technology, we will update this notice and provide any consent controls required by law before activating it.

7. Retention

We keep account and workspace information while the account is active and for a limited period afterward when needed to complete deletion, maintain security, resolve disputes, enforce agreements, or satisfy tax, accounting, and legal duties. CRM content remains under the workspace's control until deleted, the workspace closes, or retention is otherwise required. Short-lived sessions, reset codes, and rate-limit data expire according to their security purpose. Contact and administrative records are kept only as long as reasonably needed to respond, document action taken, and meet legal or security needs. Newsletter data is kept until unsubscribe; afterward, a minimal suppression record may be retained so we honor the opt-out.

Retention may be extended for a legal hold, active dispute, chargeback, fraud investigation, or binding legal requirement. Backups and provider logs may remain for a limited rolling period before deletion or overwriting.

8. International transfers

Vincino and its providers may process information in the United States and other countries where they operate. When a restricted international transfer requires safeguards, the relevant controller will use an approved legal mechanism, such as an adequacy decision or applicable standard contractual clauses, and supplementary measures where required.

9. Security

Vincino uses measures designed to protect information, including salted password hashing, hashed session and reset tokens, secure cookies, same-origin checks for sensitive requests, role and workspace authorization, optional authenticator app protection, encrypted authenticator secrets, one-time recovery codes, rate limits, audit records, encrypted transport, and restricted server-side secrets. No internet service is perfectly secure. Please use a unique password and report a suspected incident using the “Security report” contact topic.

10. Your privacy choices and rights

Depending on where you live and subject to lawful exceptions, you may request access, correction, deletion, portability, restriction, or objection; withdraw consent; opt out of marketing; or appeal a denied request. California residents may also request the categories, sources, purposes, and recipients of covered information and may exercise applicable rights without discrimination. Because Vincino does not sell or share personal information for cross-context behavioral advertising, there is no sale or sharing to opt out of at this time.

Signed-in users can open “Privacy and account data” from the dashboard account menu to automatically receive a portable JSON copy of information tied to their identity or begin permanent account deletion with an email verification code. You may also submit a request through the contact form using “Privacy rights request.” We may verify identity and authority, apply lawful exceptions, and respond within the period required by applicable law. An authorized agent may submit a request, but we may require proof of authorization and direct identity confirmation where permitted. If Vincino processes CRM data only for your employer or another customer, we may direct the request to that customer.

EEA, UK, and Swiss individuals may complain to their local data protection authority. California residents may contact the California Privacy Protection Agency or Attorney General.

11. Children

Vincino is a business service for adults and is not directed to children. You must be at least 18 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child provided information, contact us so we can investigate and delete it where required.

12. Changes to this policy

We may update this policy as Vincino, its providers, or applicable law changes. We will post the new effective date and provide additional notice before a material change when required. We will request new consent when a change requires it.

13. Contact

For privacy questions or rights requests, email support@vincino.org or use the Vincino contact form and select “Privacy rights request.”