Privacy Policy

1. Introduction

Wink Water LLC, a wholly owned subsidiary of Clearline Group LLC ("Wink Water," "we," "us," or "our"), is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit winkwater.store (the "Site"), create an account, add funds to your wallet, place orders, or otherwise interact with our services.

This policy complies with applicable data protection laws, including the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and the General Data Protection Regulation (GDPR) where applicable to EEA and UK residents. By using the Site, you consent to the collection, use, and processing of your information as described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address and password (hashed) when you register.
• Identity Verification Data: Government-issued ID images and selfie photographs submitted through Stripe Identity for verification purposes.
• Wallet & Transaction Data: Wallet balance, top-up amounts, purchase history, peer-to-peer transfer records, and payment method metadata.
• Shipping Information: Recipient name, shipping address, and contact details provided at checkout.
• Referral Information: Your referral code and referral relationships (referrer and referred users).

2.2 Information Collected Automatically

• Usage Data: IP address, browser type and version, device type and identifier, operating system, referring page, pages visited, timestamps, and interaction data.
• Analytics Data: Aggregate and individual session data collected through Google Analytics 4, including page views, events, and ecommerce metrics.
• Cookie Data: Session tokens, preferences, and tracking identifiers. See our Cookie Policy for details.

3. How We Use Your Information

We use your personal information for the following purposes:

• Processing wallet top-ups, orders, and peer-to-peer transfers
• Fulfilling and shipping orders, including address verification
• Verifying your identity through Stripe Identity to prevent fraud and ensure compliance
• Sending transactional emails (order confirmations, receipts, support responses)
• Administering the referral program and crediting referral rewards
• Detecting, preventing, and investigating fraud and abuse
• Analyzing Site usage to improve functionality, security, and user experience
• Complying with legal, regulatory, and law enforcement obligations
• Maintaining records for accounting, audit, and tax compliance purposes

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area and the United Kingdom, we process your personal information under the following legal bases:

• Contractual necessity: Processing your data to fulfill our contractual obligations, including order processing, wallet management, and shipping.
• Legal obligation: Complying with applicable laws, including identity verification, record-keeping, and law enforcement requests.
• Legitimate interests: Preventing fraud, securing the Site, improving services, and administering the referral program, where our interests are not overridden by your rights.
• Consent: Processing data for analytics, cookies, and optional marketing communications, which you may withdraw at any time.

5. Information Sharing & Disclosure

We do not sell your personal information. We may share your information with the following categories of recipients:

• Payment processors: Stripe processes wallet top-up payments and identity verification.
• Email service providers: Resend delivers transactional emails on our behalf.
• Analytics providers: Google Analytics 4 collects aggregate usage data.
• Shipping carriers: Delivery services receive shipping address information for fulfillment.
• Legal authorities: When required by law, court order, or to protect our rights and safety.
• Business transfers: In connection with a merger, acquisition, or asset sale, subject to confidentiality obligations.

6. Third-Party Service Providers

We engage the following third-party providers who process personal data on our behalf. Each provider is bound by contractual obligations of confidentiality and data protection:

• Stripe: Payment processing (PCI-DSS compliant) and identity verification. See Stripe's Privacy Policy.
• Google Analytics: Website analytics. See Google's Privacy Policy.
• Resend: Transactional email delivery.

7. Data Security & Breach Notification

We implement industry-standard technical, administrative, and physical security measures designed to protect your personal information. These measures include TLS/SSL encryption for data in transit, encrypted storage for sensitive data, access controls, regular security reviews, and secure session management.

No method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and the relevant supervisory authority in accordance with applicable data protection laws, typically within 72 hours of becoming aware of the breach.

8. Data Retention

We retain your personal information for as long as your account is active and as necessary to provide our services. After account closure, we retain certain data for the following periods:

• Transaction records: 7 years for tax and accounting compliance
• Identity verification records: 5 years for fraud prevention and regulatory compliance
• Usage and analytics data: 26 months, after which it is aggregated or deleted
• Account credentials: Deleted within 30 days of account closure

9. Your Privacy Rights

9.1 GDPR Rights (EEA & UK)

If you are a resident of the EEA or UK, you have the right to:

• Access your personal data and receive a copy of it
• Rectify inaccurate or incomplete personal data
• Erase your personal data ("right to be forgotten"), subject to legal retention obligations
• Restrict or object to processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent for consent-based processing at any time
• Lodge a complaint with your local data protection authority

9.2 CCPA/CPRA Rights (California)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of your personal information
• Limit use of sensitive personal information
• Not be discriminated against for exercising your privacy rights

To exercise any of these rights, contact us at help@clearlinegroupllc.com with the subject line "Privacy Rights Request." We will verify your identity before processing your request and respond within 45 days.

10. Cookies & Tracking Technologies

We use cookies and similar tracking technologies (web beacons, pixels) to maintain sessions, remember preferences, analyze traffic, and detect fraud. Detailed information about the cookies we use and how to manage them is available in our Cookie Policy.

11. Children's Privacy

The Site is not intended for individuals under 21 years of age. We do not knowingly collect personal information from anyone under 21. If you believe we have inadvertently collected data from a person under 21, please contact us immediately at help@clearlinegroupllc.com and we will take steps to delete such information.

12. International Data Transfers

Your personal information may be transferred to and processed in countries other than your country of residence, including the United States. When transferring data from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards as approved by the relevant authorities. By using the Site, you acknowledge and consent to these international transfers.

13. Do Not Sell My Personal Information

We do not sell your personal information as defined under the CCPA. We also do not share your personal information for cross-context behavioral advertising. If our practices change in the future, we will provide notice and an opt-out mechanism as required by law. You may opt out of any future sharing by contacting help@clearlinegroupllc.com.

14. Changes to This Privacy Policy

We may update this Privacy Policy at any time to reflect changes in our practices, legal obligations, or operational requirements. The "Last Updated" date indicates the most recent revision. If we make material changes, we will provide notice through the Site or via email. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

15. Contact Information

For privacy questions, data requests, or to exercise your rights, contact our Data Protection representative:

• Email: help@clearlinegroupllc.com
• Legal: legal@clearlinegroupllc.com
• Entity: Wink Water LLC, a subsidiary of Clearline Group LLC