Data Protection

Good Morrow Tavern is committed to protecting the personal data of our merchants. This Data Protection statement explains the technical and organizational measures we take to keep your information secure and your rights under applicable data protection laws.

We process your personal data on the basis of the contract to provide wholesale services, our legitimate interests in operating the Guild, your consent where given, and legal obligations such as tax and record-keeping requirements.

We collect only the information necessary to review applications, manage memberships, process orders, and fulfill legal obligations. We do not collect sensitive personal data such as health, biometric, or racial information.

All data is encrypted in transit using TLS and at rest within our hosted infrastructure. Payment data is tokenized and stored by Stripe, a PCI-DSS compliant provider; full card numbers are never stored on Guild servers.

Access to personal data is restricted to authorized personnel and services on a least-privilege basis. Administrative actions are logged and reviewed. Merchant passwords are hashed and never stored in plain text.

We share data only with trusted processors bound by written agreements: Stripe (payments), AfterShip and carriers (shipping), and our email provider (notifications). Each processor is limited to the data necessary for its function.

Your data may be processed in the United States and by international carriers for shipments originating in Japan. Where data crosses borders, we rely on appropriate safeguards and the legal bases described above.

You have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing or withdraw consent. To exercise these rights, contact the Tavern Masters through your account or the support channels provided.

In the event of a personal data breach likely to result in a risk to your rights, we will notify affected merchants and the relevant authorities without undue delay, in accordance with applicable law.

We retain personal data only as long as necessary for the purposes described, including legal, tax, and accounting obligations. Upon request and where permitted, we will delete your data or anonymize it.

The portal uses essential cookies for authentication and session management. We do not use advertising cookies. Analytics, where used, is aggregated and does not identify individuals.

Where you provide a mobile number, we process it on the basis of your consent, recorded at account creation and stored on your merchant profile alongside your verification status. It is used only for the messaging purposes described in our Terms of Service and Privacy Policy.

Messages are delivered through Twilio, acting as our processor under a written agreement, and carriers process routing data as part of delivery. Consent records and opt-out requests (STOP) are retained so we can demonstrate compliance; opt-out is honored promptly and consent can be withdrawn at any time by replying STOP or by contacting the Tavern Masters.

For data protection inquiries or to exercise your rights, contact the Tavern Masters through the support channels available in your account.