1. What we collect
When you create an account and use Staveform, we collect:
- Account information — email address and password (hashed, never stored in plaintext)
- Facility profile — facility name, type (distillery/brewery/winery), TTB permit number, address, and phone number that you provide during onboarding
- Production logs — the production data you enter (dates, operation types, volumes, product names, notes)
- Filing data — TTB report data generated by or entered into the platform
- Usage data — feature usage, AI token counts, and error logs for service improvement and billing
- Payment information — processed by Stripe; we store only your Stripe customer ID and subscription status, not raw card data
2. How we use your data
We use your data to:
- Provide and operate the Staveform service
- Generate AI-assisted TTB reports from your production logs
- Send deadline reminder emails for upcoming filings
- Process payments and manage subscriptions
- Diagnose errors and improve the platform
- Communicate service updates or security notices
We do not sell your data, share it with advertisers, or use your production data to train AI models.
3. Third-party services
Staveform uses the following sub-processors:
- Supabase — database and authentication (SOC 2 Type II certified)
- Anthropic — AI report generation (your production data is sent to Claude to populate TTB form fields; Anthropic's API does not use API data for model training by default)
- Stripe — payment processing (PCI DSS Level 1 certified)
- Resend — transactional email delivery
- Vercel — hosting and edge infrastructure
4. Data retention
Your account data and production records are retained for as long as your account is active. If you cancel your subscription, your data remains accessible for 90 days, after which it is deleted from our systems. You may request immediate deletion by contacting us.
5. Security
All data is encrypted in transit (TLS) and at rest (AES-256). Access to production systems is restricted to authorized personnel. We do not store TTB credentials or Pay.gov passwords.
6. Your rights
You may at any time:
- Export your production logs and filing data from the dashboard
- Update or correct your facility profile in Settings
- Delete your account and all associated data by contacting us
7. Cookies
Staveform uses a single session cookie for authentication (set by Supabase Auth). We do not use tracking or advertising cookies.