Privacy

Last updated 15 August 2026

What we collect, why, where it lives, and how to get it back or have it deleted. Written to be read, not to be survived.

The short version. Steward never sees a card number. Your members, their orders and their saved payment methods stay in your own Shopify admin — we hold a roster, a schedule and a record of what we charged and when. If you leave, you take everything and there is nothing of yours left with us to ask for.

1 · Who we are

Steward is a Shopify application for winery clubs, allocations and release-day billing, operated by Steward, Bangalore, India. You can reach a human at hari@steward.wine.

2 · Our two roles

We handle two different kinds of information and our responsibility differs for each.

Your account with us. Here we are the controller. This is the winery's name, the contact details of the people who use Steward, and our billing relationship through Shopify.
Your members' information. Here we are a processor. The winery is the controller. We only handle member information to run the club you configured, and only on your instructions.

3 · What we collect

From the winery

Shop domain, store settings, currency and time zone
Names and email addresses of staff who use Steward
An encrypted Shopify access token so the app can act on your behalf

From your Shopify store, on your instruction

Member identity — name, email, phone and delivery addresses
Club membership — tier, join date, cadence, fulfilment preference, pause and cancellation state
Order and charge history for releases we ran, including what failed and why
A payment method reference only — card brand, last four digits, expiry month and year, and Shopify's identifier for it

From this website

Anonymous, cookieless page analytics through Plausible. No cookies, no cross-site tracking, nothing stored on your device, no consent banner needed
Anything you type into a form on the site, which goes to our form provider and to us

4 · What we never collect

Full card numbers, CVV codes, or anything that could be used to charge a card outside Shopify. Card details are held by Shopify and your payment gateway. Steward asks Shopify to attempt a charge; Shopify performs it. We never receive, store or transmit the number.

We also never collect tax identifiers, age-verification records or licensing documents. Those are deliberately outside what Steward does.

5 · Why we hold it, and on what basis

What	Why	Basis
Member roster and club settings	To run the releases you schedule	Performance of our contract with the winery
Charge ledger and failure reasons	So you can prove every member was charged once, and recover the ones that failed	Contract, and our legitimate interest in an auditable record
Card brand, last four, expiry	To warn you which cards expire before release day	Contract
Staff contact details	Support, and telling you when something breaks	Contract, legitimate interest
Site analytics	To see which pages are read	Legitimate interest — anonymous and cookieless

6 · Where it lives, and who else touches it

Application data is stored in Sydney, Australia. We use a small number of sub-processors and no others:

Who	What for	Where
Shopify	The store, the card vault, the charges, the orders	Per Shopify's own terms
Neon	Application database	Sydney, Australia
Fly.io	Application hosting	Sydney, Australia
Postmark	Transactional email to members — failed payment, expiring card, release preview	United States
Sentry	Error reporting	United States / European Union
Better Stack	Uptime and log monitoring	European Union
Plausible	Website analytics, anonymous	European Union

We do not sell information, we do not share it for advertising, and we do not use your members' information to train anything.

7 · Transfers out of your country

We operate from India and store application data in Australia, so information may be handled outside the country you are in. Where required we rely on standard contractual clauses with our sub-processors and on the protections described above. Access tokens are encrypted at rest with AES-256-GCM and access to production data is limited to the two people who operate Steward.

8 · How long we keep it

While you are a customer — for as long as you use Steward.
When you uninstall — we stop processing immediately, and we delete your shop data within 90 days unless you ask us to delete it sooner, which we will do.
Charge records may be kept in aggregate, with no personal information attached, for accounting.
Backups roll off within 35 days.

9 · Deletion and access requests

We implement Shopify's mandatory privacy webhooks:

customers/data_request — a member asks what you hold about them. We return everything Steward holds so you can respond.
customers/redact — a member asks to be erased. We erase their personal information and keep only an anonymous charge record.
shop/redact — sent 48 hours after uninstall. We erase the shop's data.

You can also just email us. You can export your entire member list at any time, from inside the app, without asking us. That is a product feature and a written commitment.

10 · Your rights

Depending on where you or your members are, rights may include access, correction, erasure, restriction, objection, portability and complaint to a regulator. This includes the Australian Privacy Act 1988, the New Zealand Privacy Act 2020, the UK and EU GDPR, and India's Digital Personal Data Protection Act 2023.

If you are a wine club member rather than a winery, contact your winery first — they control your information and we act on their instructions. If you contact us directly we will pass your request to them and help them answer it.

11 · Security

Access tokens encrypted at rest with AES-256-GCM
All traffic over TLS
No card numbers anywhere in our systems
Production access limited to the two founders, with multi-factor authentication
Every webhook verified by HMAC before it is processed

If we ever suffer a breach affecting your data we will tell you without undue delay, and we will tell you what happened rather than what our lawyers would prefer.

12 · If Steward shuts down

We commit to 90 days' written notice and a complete export of your data in a format that imports elsewhere. This is in our terms, not just here.

13 · Changes

If we change this page materially we will email the address on your account before the change takes effect, not after.

Steward · Bangalore, India · hari@steward.wine
Questions about anything on this page get a reply from one of the two people who built Steward.