Privacy.

Valmont is operated by Collecta Technologies Limited, a company registered in England and Wales (company number 17022135), with its registered office at 105 Piccadilly, London, W1J 7NJ. In this policy, "we", "us", and "Valmont" refer to that entity.

For any question about your data, write to hello@valmont.app.

What you give us directly

• Your name and email address.
• Optionally, your Instagram handle.
• Anything you choose to send us when you contact us.

What your browser tells us automatically

• Anonymised traffic data (page views, referrer, country, approximate device type), only if you accept analytics cookies.
• Standard request logs (IP address, user-agent, timestamp) kept short-term by our hosting provider for security and abuse prevention. We also derive a one-way hash of your IP address to rate-limit form submissions; it is stored only briefly by our database processor (Supabase).

What we do not collect

• No cross-site advertising identifiers.
• No precise location data.
• No data about where and what you drink, unless you enter it into the app yourself.

• Waitlist. To contact you when your seat opens, and to decide whether to open it.
• Product. To run Valmont, fix bugs, and keep the service secure.
• Measurement.To understand what's working, in aggregate, and only if you've consented.

• Contacting you about the waitlist, your consent, given when you submit the form (Art. 6(1)(a)).
• Keeping the service secure and debuggable, our legitimate interests (Art. 6(1)(f)).
• Analytics, your consent, given via the cookie banner (Art. 6(1)(a)). Withdrawable at any time.

We share your data with the following processors only, each under a written data-processing agreement:

• Klaviyo (klaviyo.com), to send you waitlist and membership messages by email.
• Supabase (supabase.com), database hosting where your waitlist request and account data are stored (EU region).
• Vercel Inc. (vercel.com), hosting, CDN, and analytics.
• Google LLC (Google Analytics 4), aggregated traffic analytics, only with your consent.
• Meta Platforms, Inc. (Meta Pixel), campaign attribution, only with your consent.

We do not sell personal data. We do not share it with data brokers or any advertising network beyond the campaign attribution listed above.

Our processors may process your data in the United States. Transfers from the UK and the EEA are protected by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, as applicable, together with any supplementary measures required by the UK ICO's guidance.

• Waitlist entries, until you ask us to delete them, or three years after our last contact with you, whichever is sooner.
• Server logs, 30 days.
• Aggregated analytics, 26 months (the Google Analytics 4 minimum).

Under UK and EU GDPR, you can, at any time:

• Access a copy of the personal data we hold about you.
• Rectify anything that is inaccurate.
• Erase your data (subject to the narrow exceptions the law permits).
• Restrict processing in certain circumstances.
• Portability, receive your data in a commonly used, machine-readable format.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, for anything given by consent (including switching analytics off via the cookie banner).

To exercise any of these, write to hello@valmont.app. We will respond within 30 days.

If you believe we have mishandled your data, you can complain to the UK Information Commissioner's Office or your local supervisory authority in the EEA.

Before you accept, the only data stored in your browser is a preference flag that remembers your choice. Analytics (Vercel, Google Analytics 4, Meta Pixel) load only after you click "Accept" on the cookie banner. You can revisit the decision by clearing the valmont-consententry from your browser's local storage.

No third-party cookies are set without your consent.

Valmont is not directed at anyone under 18 and we do not knowingly collect data from children. If you are under 18, do not submit information to the service.

All traffic is encrypted in transit with TLS. We limit processor selection to vendors with SOC 2 Type II or equivalent assurance. No security is absolute, in the event of a confirmed personal data breach, we will notify affected users and the UK ICO within 72 hours, as the law requires.

We update this policy when the service or the law changes. The "Last updated" date at the top reflects the current version. Material changes will be notified by email to waitlist members.

hello@valmont.app