LEGAL

Privacy Policy

Version 1.0 · Effective 8 Sept 2026

Version 1.0 · Effective date: 2026-09-08 · Last updated: 2026-09-08

This Privacy Policy explains how Bansky ("Bansky", "we", "us", "our") collects, uses, shares and protects personal data when you visit bansky.app, use the web application at beta.bansky.app or any related sub-domain, application or API (together, the "Platform"), communicate with us, or attend an event connected with us. It also explains your rights and how to exercise them.

Beta notice. The Platform is currently a beta test environment. Balances, casks, prices, loans and other records shown on it are simulated (see our Terms of Service, Section 3). We may reset or delete Beta data, including your account data, at any time and at the end of the Beta Program.

If you do not agree with this Policy, please do not use the Platform. Capitalised terms not defined here have the meaning given in our Terms of Service (bansky.app/terms).

1. Who is responsible for your data

The data controller (and, for Israeli law, the "database owner") is Bansky, Tel Aviv, Israel. You can contact us about privacy at privacy@bansky.app.

Where we are required to appoint a data protection officer or a representative in the EEA, UK or elsewhere, their details will be published here: Not currently required..

2. What data we collect

We collect data in three ways: data you give us, data we collect automatically, and data we receive from third parties.

2.1 Data you give us

Account data: name, email address, password (stored only in hashed form), display name, profile picture, country, language and time-zone preferences.
Identity and eligibility data (if and when we introduce verification): date of birth, nationality, government-issued ID documents, selfie or liveness data, proof of address, tax identification number, investor-accreditation or professional-status information, source-of-funds information, and sanctions/PEP screening results. During the Beta Program we do not collect ID documents; if this changes we will update this Policy and tell you before collection.
Financial and transaction data: records of simulated (and, in future, real) deposits, orders, holdings, loans, options, fees and ledger entries associated with your account; in future, bank account or payment-method details needed to process real transactions (card numbers, if ever used, would be processed by a payment provider and not stored by us).
Partner and distillery data: if you use the partner portal, your business name, role, contact details, cask data, documents you upload, proposals, messages and event details.
Deal Room data: your name, organisation, role, the invitation you accepted, your acceptance of confidentiality terms, and your activity in the Deal Room.
Communications: messages you send us or other users through the Platform, support requests, survey responses, feedback and bug reports, and event registrations.
Marketing preferences: your choices about receiving communications.

2.2 Data we collect automatically

Device and technical data: IP address, approximate location derived from IP, browser type and version, operating system, device identifiers, screen size, language, referring URL, and time-zone.
Usage data: pages and screens viewed, features used, buttons clicked, searches, time spent, scroll depth, session recordings or heatmaps (only if we enable an analytics tool that does this — see Section 8), errors and performance data, and, in the Deal Room, which materials you opened, for how long and whether you downloaded them.
Log and security data: authentication events, sign-in method, timestamps, failed login attempts, and records of your acceptance of legal documents (version, timestamp, IP address, user agent).
Cookies and similar technologies: see Section 8.

2.3 Data we receive from third parties

Google Sign-In: if you sign in with Google, Google sends us your name, email address, profile picture and a unique Google account identifier, as permitted by the permissions you grant on Google's consent screen. We do not receive your Google password. We do not request access to your Gmail, Drive, Calendar or Contacts.
Identity-verification and screening providers (future): verification results, document authenticity checks, sanctions and politically-exposed-person screening outcomes and fraud signals.
Distillery partners: confirmation of club tiers, allocations, event attendance or bottling requests relating to you (only where you have engaged with that distillery through the Platform).
Referrals and invitations: if someone invites you to the Platform or the Deal Room, we receive your name and email from them.
Public and commercial sources: company registries, professional networks and similar sources, to verify business partners or investors.

We do not intentionally collect special categories of personal data (such as health, religion, political opinions, sexual orientation or biometric data for identification) except that identity-verification providers may process biometric data (facial recognition on ID documents) on our behalf if and when verification is introduced, on the basis described in Section 4.

3. How we use your data

We use personal data to:

Provide the Platform — create and manage your account, authenticate you, display your simulated (and, in future, real) holdings and records, operate the ledger, send service notifications, provide support, and run the partner portal and Deal Room.
Run the Beta Program — test features, measure performance, fix bugs, understand how the product is used, and collect feedback.
Verify identity, eligibility and compliance (when introduced) — perform KYC, age, sanctions, anti-money-laundering, counter-terrorist-financing, fraud-prevention and investor-eligibility checks, and comply with securities, tax and other laws.
Protect the Platform and users — detect, prevent and investigate security incidents, abuse, fraud and breaches of our Terms; enforce our Terms and Deal Room confidentiality.
Communicate with you — respond to enquiries, send transactional and service messages, and (with your consent or where permitted by law) send newsletters, product updates, event invitations and marketing, from which you can opt out at any time.
Improve and develop products — analyse usage, run analytics, conduct research, and develop new features. Where we use data to train or evaluate models, we use aggregated or de-identified data wherever reasonably possible.
Manage relationships with partners and investors — evaluate distilleries, investors and partners, manage Deal Room access and track engagement with Confidential Materials.
Comply with law and protect rights — meet legal and regulatory obligations, respond to lawful requests, establish, exercise or defend legal claims, and enforce our agreements.
Business operations — corporate transactions, audits, accounting, insurance and governance.

We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects on you without human review, except where required for compliance screening (in which case you may request human review).

4. Legal bases (EEA, UK and similar jurisdictions)

Where the GDPR, UK GDPR or similar laws apply, we rely on the following legal bases:

Purpose	Legal basis
Providing the Platform, account, support, Beta Program	Performance of a contract (our Terms) and steps at your request before entering into a contract
Identity, eligibility, AML/sanctions checks	Legal obligation; where not strictly required by law, legitimate interests in preventing fraud and complying with regulatory expectations; for biometric checks, your explicit consent
Security, fraud prevention, enforcement of Terms	Legitimate interests in protecting the Platform, users and our business
Analytics and product improvement	Legitimate interests in understanding and improving the product; consent for non-essential cookies where required
Marketing communications	Consent, or legitimate interests where permitted by law for existing customers (with opt-out)
Deal Room tracking	Legitimate interests in protecting Confidential Materials and evaluating partnerships; performance of the Deal Room terms you accept
Legal claims and compliance	Legal obligation; legitimate interests in establishing, exercising or defending claims

Where we rely on legitimate interests, we have balanced those interests against your rights. You may object at any time (Section 10).

We share personal data only as described below, and we require recipients to protect it.

Service providers (processors) who act on our instructions: cloud hosting, database and authentication infrastructure (currently including Lovable and Supabase), email delivery, customer support tooling, analytics (Section 8), error monitoring, identity-verification and screening providers (when introduced), payment providers (when introduced), document-signing and PDF services, and professional advisers.
Google, when you use Google Sign-In, as an independent controller under Google's Privacy Policy.
Distillery partners and event organisers, limited to what is necessary for a feature you use — for example, confirming your club tier for an allocation, registering you for a tasting, or processing a bottling request. We do not share your full holdings or financial data with distilleries unless you ask us to or a feature requires it and we tell you.
Issuing vehicles, administrators, custodians, insurers, auditors and regulators (future), if real-money features are introduced and the law or the product structure requires it.
Investors and advisers of Bansky, in aggregated or de-identified form for business reporting; identifiable data only where necessary (for example, Deal Room participant lists for a specific financing).
Authorities and other parties for legal reasons, where we believe disclosure is required by law, regulation, legal process or governmental request, or is necessary to protect the rights, property or safety of Bansky, our users or the public, or to enforce our Terms.
Corporate transactions: a buyer, investor, merger partner or successor in connection with a financing, merger, acquisition, reorganisation, sale of assets or insolvency, subject to confidentiality and to this Policy.
With your consent or at your direction.

6. International transfers

We operate from Israel and use infrastructure and providers in the United States, the European Union and other countries. Your data may therefore be transferred to, stored in and processed in countries whose laws differ from those of your country. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), adequacy decisions (including the EU–US Data Privacy Framework where a recipient is certified, and the EU adequacy decision for Israel), or your explicit consent. You may request a copy of the relevant safeguards at privacy@bansky.app.

7. How long we keep data

We keep personal data only as long as needed for the purposes described above, and then delete or anonymise it. In general:

Account and usage data: for as long as your account is active, and then up to 24 months, unless a longer period is required below.
Beta data: may be deleted at any time and will be deleted or anonymised at the end of the Beta Program, except records we must keep.
Identity, KYC, AML and transaction records (if introduced): typically 5 to 7 years after the end of the relationship, as required by anti-money-laundering, securities and tax laws.
Legal-acceptance records (which version of the Terms and this Policy you accepted, when and from where): for the life of the account plus the applicable limitation period.
Deal Room access logs: 3 years after access ends, matching the confidentiality period.
Marketing preferences and opt-outs: indefinitely, so that we can honour them.
Communications and support records: up to 3 years.
Backups: deleted data may persist in encrypted backups for up to 90 days.

We may keep data longer where required by law or where reasonably necessary for legal claims.

8. Cookies and analytics

We use cookies and similar technologies (local storage, session storage, pixels) for:

Strictly necessary purposes — authentication, session management, security, load balancing, remembering your consent choices. These cannot be switched off.
Preferences — remembering your language, theme and settings.
Analytics and performance — understanding how the Platform is used and how it performs. We currently do not load third-party analytics or advertising trackers; we rely on server logs and first-party usage events stored in our own database..
Marketing — we do not currently use advertising or marketing cookies. If this changes we will ask for your consent where required.

Where the law requires it, we ask for your consent to non-essential cookies through a banner and you can change your choice at any time via the cookie settings link in the footer. You can also control cookies through your browser settings; blocking necessary cookies may prevent the Platform from working. We currently do not respond to "Do Not Track" signals, but we honour Global Privacy Control signals where required by law.

9. Security

We implement technical and organisational measures designed to protect personal data, including encryption in transit (TLS) and at rest, hashed passwords, role-based access control and row-level security on our database, least-privilege access, audit logging, environment separation between demo and production data, and regular review of our providers. No system is completely secure; you are responsible for keeping your credentials confidential and for using a secure device. If we become aware of a breach affecting your personal data we will notify you and the relevant authorities where required by law.

10. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

Access — obtain confirmation that we process your data and a copy of it.
Rectification — correct inaccurate or incomplete data.
Erasure — ask us to delete your data, subject to legal retention obligations.
Restriction — ask us to limit processing in certain circumstances.
Portability — receive data you provided in a structured, machine-readable format.
Objection — object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent — where processing is based on consent, without affecting prior processing.
Not to be subject to solely automated decisions with legal or similarly significant effects, except where permitted by law.
Complain to a supervisory authority — for example, the Israeli Privacy Protection Authority, an EU data-protection authority, the UK Information Commissioner's Office, or your local regulator.

Israel. If you are in Israel, you have rights of access and correction under the Protection of Privacy Law, 5741-1981 and its regulations (as amended, including Amendment 13). You may also request to be removed from any direct-mailing list.

California and other U.S. states. If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of "sale" or "sharing" of personal information and of targeted advertising (we do not sell or share personal information for cross-context behavioural advertising); to limit the use of sensitive personal information; and not to be discriminated against for exercising your rights. You may designate an authorised agent to submit requests on your behalf.

How to exercise your rights. Email privacy@bansky.app or use the account settings on the Platform. We may need to verify your identity before acting. We will respond within the time required by law (generally within 30 days, extendable where permitted). We will not charge a fee unless a request is manifestly unfounded or excessive.

11. Google user data and Limited Use

Bansky's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use the Google account information you share with us (name, email address, profile picture and account identifier) only to create and secure your account, to identify you within the Platform, and to communicate with you. We do not use it for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, to comply with law, or for internal operations where the data has been aggregated or anonymised. You can revoke Bansky's access at any time at myaccount.google.com/permissions.

12. Children

The Platform is not directed to, and we do not knowingly collect personal data from, anyone under 18 (or the age of majority in their jurisdiction, if higher). If you believe a minor has provided us with personal data, contact us at privacy@bansky.app and we will delete it.

13. Third-party links and services

The Platform may link to third-party websites, distilleries, event pages and services. This Policy does not apply to them; please read their privacy policies. Google Sign-In is governed by Google's Privacy Policy.

14. Distillery partners, investors and business contacts

If you interact with us as a representative of a distillery, investor, adviser or other business, we process your business contact data (name, role, employer, work email and phone, correspondence and meeting notes) on the basis of our legitimate interests in operating and developing our business, or the performance of the agreement between us and your organisation. The rights in Section 10 apply to you.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Platform with a new effective date and, for material changes, notify you by email or in-app notice, or ask you to re-accept it. Continued use after the effective date constitutes acceptance to the extent permitted by law.

16. Contact

Bansky · Tel Aviv, Israel Privacy: privacy@bansky.app · General: hello@bansky.app

Questions? legal@bansky.app