Privacy Policy

[Legal entity name — to be confirmed], trading as Hightower, is responsible for the information described here. Written enquiries can be sent to [Legal contact email — to be confirmed] or [Business mailing address — to be confirmed].

Hightower is a business-to-business marketplace. Most of the information we hold is business information — a company, its coffees, its stated location and a work contact — rather than personal information about private individuals.

Only the categories the application actually uses:

• Account identity and contact information: name, work email address, password credentials held by our authentication provider, and sign-in method.
• Business and profile information: business name, business type, how you use Hightower, country, region, city, website and description you choose to provide.
• Listings: the coffees, prices, quantities, availability, origin details, certifications and images a seller publishes.
• Sourcing requests: what a buyer is looking for, and the criteria used to match it.
• Connections and messages: connection requests, introduction requests, conversations and message content between members.
• Saved items and saved searches you create.
• Billing identifiers and subscription state: the Stripe customer and subscription identifiers, plan, billing cadence, status, period dates, connection credits and boost records.
• Waitlist and supplier enquiries: email address, stated interests, and the date of the original submission where a record was imported from Hightower's earlier site.
• Security, session and technical data: authentication session data, cookies and local storage needed to keep you signed in and to remember interface preferences, plus server and error logs containing request details.

Hightower does not receive or store your card number, expiry date or security code. Card details are entered directly with Stripe.

Hightower does not currently run third-party advertising or behavioural analytics on the public site. If that changes, this policy and its version will be updated first.

• to create and operate your account and business profile
• to publish listings you choose to publish, and to show buyers relevant results
• to let members connect and message each other, and to apply plan allowances fairly
• to take payment for subscriptions, connection packs and boosts, and to keep an accurate record of what was purchased and accepted
• to keep records of policy acceptance, which we are required to be able to evidence
• to secure the service, prevent misuse and investigate fraudulent or misleading listings
• to answer enquiries and provide support
• to comply with legal obligations

Listings and business profile details you publish are public by design — that is the point of a marketplace. Your messages are visible only to the businesses in that conversation. Billing details, connection credits, sourcing-request contents, saved items and acceptance records are not published.

Where Hightower reports numbers to its own team for oversight, it reports aggregates, not individual member records.

Hightower uses a small number of processors to run the service:

• Stripe — payment processing, subscription billing, invoices and the customer billing portal.
• Supabase — database, authentication and file storage for Marketplace data.
• Lovable — application hosting and delivery of the website and its server functions.
• Mailgun — delivery of transactional email for the notification subdomain, where email is sent.
• The public Hightower OS coffee feed — a Hightower system that supplies published seller and coffee information to the Marketplace.

These providers process information on Hightower's instructions in order to provide their service. Hightower does not sell personal information and does not share it for cross-context behavioural advertising.

Hightower and its providers operate infrastructure in more than one country, so information may be processed outside the country you are in. Where required, transfers rely on the protections offered by the relevant provider's data-processing terms.

• Account, business, listing, connection and message records are kept while your account exists, and afterwards only as long as needed for legal, accounting, security or dispute purposes.
• Billing records and policy-acceptance records are kept as long as required for tax, accounting and evidentiary purposes.
• Waitlist records are kept until you ask to be removed.
• Server and error logs are kept for a short operational period.

Cancelling a subscription does not delete your listings, connections, messages or history. See the Billing, Cancellation & Refund Policy.

Access to Marketplace data is protected by authentication and by database-level row rules, so a member can only reach their own business's private records. Payment secrets are held only on the server and never reach the browser. Payment notifications from Stripe are cryptographically verified before any access is granted. No system is perfectly secure, and Hightower cannot guarantee absolute security.

You can ask Hightower to access, correct, export or delete information we hold about you, and to stop sending you non-essential email. Write to [Legal contact email — to be confirmed] and we will respond within the period required by applicable law.

Depending on where you live, you may have additional rights — for example, under California, other US state, or UK and EU privacy law — including rights to access, correct, delete, obtain a portable copy, or object to certain processing, and a right not to be discriminated against for exercising them. Hightower does not claim that any particular regime applies to you; whichever rights apply to you, exercise them at the address above.

Hightower is a business service and is not directed to children. We do not knowingly collect information from anyone under 18.

This policy carries a version and effective date. Material changes will be notified in the product, and acceptance records always reference the exact version accepted.