Privacy policy

1Who we are

Pinpoint Vending is a service operated by Distinctive Vending LLC. We find and sign venues for vending machine operators, and we place paying advertisers on the screens those machines carry. This policy covers pinpoint-vending.com, the operator portal, and the emails and text messages we send.

We are the controller of the personal information described here. For privacy questions, requests, or to reach the person responsible for this policy, write to privacy@pinpoint-vending.com.

2What we collect, and where it goes

Every category below is something this site or the portal actually collects, or is in the process of starting to — see the note under section 7. Nothing here is included because a template had it.

What we do not collect

We do not knowingly collect precise geolocation, biometric or genetic data, health data, racial or ethnic origin, religious beliefs, sexual orientation, union membership, immigration status, or the contents of your mail or messages. Several states treat those as sensitive and restrict their use; we avoid the question by not collecting them. We do not collect information from children — see section 12.

3Where it comes from

• From you — when you create an account, place an order, ask about hosting a machine, set an alert, email us, or reply to a text.
• From your device — automatically, through cookies and similar technologies. See section 7.
• From an advertising platform — when you arrive from one of our ads, the platform adds a click identifier to the link so that it can later tell us the ad worked. See section 7.
• From our payment processor — Stripe tells us whether a payment succeeded and returns identifiers. Never card numbers.
• From venues — when a venue we are negotiating with gives us details relevant to your placement.

4Why we use it

We use personal information to:

• open and run your account, and let you sign in;
• work your order — find venues, present locations, and place your machine;
• take payments, issue refunds, and keep the records tax and accounting law requires;
• send service messages about your order. These are not marketing, and you cannot opt out of them while an order is live;
• send marketing emails and text messages, where you have agreed to them;
• answer questions and provide support;
• keep the service secure, investigate abuse, and enforce our terms;
• measure how the site is used, so we can improve it;
• measure which of our ads produce enquiries, so that we stop paying for the ones that do not;
• show you our ads on other sites and apps, including because you have been on this one. This is the one use on the list you can switch off without leaving — section 6 says how.

We do not make decisions about you that produce legal or similarly significant effects without a person involved, and we do not profile you for that purpose.

5Who we disclose it to

We disclose personal information to the categories of recipient below, for the purposes named. We never disclose personal information in exchange for money or for any other valuable consideration.

• Service providers — hosting, database, email, messaging, analytics and payment providers, acting on our instructions and bound by contract to use the information only to provide that service.
• Advertising and measurement platforms — the platforms named in section 7 receive the online identifiers and browsing activity described there, so that we can tell which of our ads work and reach people who have visited the site. They are listed separately from the service providers above for one reason: they may use what they receive for their own purposes, not only ours. Section 6 treats that as sharing and gives you a way out of it.
• Venues — once you claim a location, the venue gets what it needs to host your machine.
• Professional advisers — lawyers, accountants and auditors, under a duty of confidence.
• Authorities — where the law requires it, or where we believe in good faith it is necessary to protect someone’s safety or our legal rights. We will tell you unless we are prohibited from doing so.
• A buyer — if the business or its assets are sold or reorganized, information may transfer with it, subject to this policy.

Mobile information and text-message consent

Your mobile number and your text-message consent are treated more strictly than anything else in this policy, and they are carved out of every category above:

In practice that means the only third parties that ever see your mobile number are the messaging provider that delivers a message you asked for and the carrier that carries it, both of which are acting on our instructions and neither of which may use it for anything else. The advertising platforms added in section 7 are not among them. Your number never reaches Google or Meta in any form — not in plain text, not hashed, not as one row of an uploaded list — and no advertising audience is ever built out of it. Section 8 sets out how consent is taken and how to withdraw it.

6Selling, sharing, and targeted advertising

We do not sell your personal information, and never have. We do not sell, rent or trade it — not for money, and not for any other valuable consideration.

We never sell or share your phone number, and we never sell or share text-message opt-in data or consent records. Those are carved out of everything in this section without exception, and the clause in section 5 states that in the plainest terms we can put it.

We do advertise to you, though, and several state laws call that “sharing”. We run the analytics and advertising tags listed in section 7. They pass cookie identifiers and browsing activity to Google and Meta, who use them for their own advertising purposes as well as ours — to work out which of our ads brought you here, and to show our ads to people who have been on this site. California calls that sharing for cross-context behavioral advertising. Colorado, Connecticut, Virginia and the states that followed them call it targeted advertising. We are not going to argue the label with you: it is what we do, you are entitled to opt out, and the opt-out is below.

What that covers is online identifiers and browsing activity — cookie and pixel identifiers, the pages you looked at, and the click identifier that tells a platform its ad worked. It does not extend to your name, your email address, your phone number, your consent to be texted, or anything you typed into a form. We do not upload customer lists or enquiry lists to advertising platforms, in plain form or hashed, and we do not build advertising audiences out of them. That rules out several things those platforms actively encourage, and we have turned them down rather than quietly widen this paragraph. If we ever change our minds, this policy changes first and the change is announced under section 15 — not discovered afterwards.

How to opt out

• Global Privacy Control. If your browser or an extension sends a GPC signal, we treat it as a valid opt-out for that browser — for the advertising tags as well as the analytics ones — and you need do nothing else. Some states require us to honour it. We honour it for everyone.
• Ask us. Email privacy@pinpoint-vending.com with the subject “Do not sell or share”. You do not need an account.
• At the platform. Google and Meta each let you turn off personalised advertising in your own account with them, which covers every site that uses them rather than only this one: My Ad Center, Meta ad preferences.

We do not sell or share the personal information of anyone we know to be under 16.

7Cookies and tracking

• Strictly necessary — sign-in and session cookies. The site cannot work without them and they are used for nothing else.
• Analytics — Google Analytics, configured with IP anonymisation. It tells us which pages are used and how people arrive.
• Advertising and measurement — tags from the platforms below. They set cookies and read the click identifier on an ad link, so that an enquiry can be matched back to the ad that produced it and so that our ads can be shown to people who have been on the site. These are the cookies section 6 is about.

A platform appears in that table from the point we begin setting it up, which may be a little before its tag actually fires. We would rather tell you about a cookie you have not met yet than meet you with a cookie we had not mentioned.

You can block or delete cookies in your browser; the strictly necessary ones cannot be refused without breaking sign-in. A Global Privacy Control signal from your browser turns off both the analytics and the advertising cookies without your having to do anything else, and the other opt-outs are in section 6.

8Text messages and email

We send texts and we send email. Each comes in two kinds — messages about an order, and marketing — and the two follow different rules. The rules for texts are stricter than the rules for email, and both are stricter than the law requires.

Service texts

Messages about an order you have placed — a location to review, a payment, an installation window. If you give us a mobile number for your order, we may text you about that order.

Marketing texts

Messages about locations, offers, or the advertising program. We send these only if you separately agreed by ticking a box that was not ticked for you. Agreeing is never a condition of buying anything from us, and declining changes nothing about your order, your price, or your place in the queue.

• Frequency. Message frequency varies. Message and data rates may apply. We send no more than 3 messages on the same subject in a day.
• Hours. Marketing messages go out only between 8am–8pm in your local time.
• Stopping them. Reply STOP, END, QUIT, CANCEL, UNSUBSCRIBE or any similar word to any message. You can also email privacy@pinpoint-vending.com, call us, or tell any member of our team. Any reasonable method works — you are not limited to the keyword. We stop as soon as we can, and within 10 business days at the outside.
• Help. Reply HELP, or use the address above.
• Cost. We charge nothing for messages. Your carrier may. Carriers are not liable for delayed or undelivered messages.

We keep a record of your consent — the number, the wording you were shown, the date and the IP address it came from — and a record of any withdrawal, for as long as we may need to evidence it. The wording is stored exactly as it appeared beside the box, not as a reference to a version of it, so you can be told precisely what you agreed to.

Service email

Email about an order, an account, a payment, or a reply to something you sent us. These are not marketing, they have no unsubscribe link, and you cannot turn them off while an order is live. If you want them to stop, the order has to end.

Marketing email

Location alerts you asked for, offers, and news about the advertising program. These go only to people who asked for them — by setting an alert, ticking a box, or asking us about the service. We do not buy email lists and we do not email people who have had no dealings with us.

• Stopping them. Every marketing email carries an unsubscribe link that works in one click, with no sign-in and no survey on the way out. You can also reply to any of them, or write to privacy@pinpoint-vending.com. We act on it immediately, and within 10 business days at the very outside.
• What it does not stop. Service email, as described above. Unsubscribing from marketing never affects an order.
• Where your address goes. To the provider that sends the message, and nowhere else. It is never given to an advertising platform — see section 6.

Who your number is never given to

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your number and your consent are excluded from every disclosure and every sale-or-sharing arrangement described in this policy. The full clause is in section 5, and section 6 confirms that our treatment of analytics and advertising identifiers does not reach your phone number.

9Your rights

20 US states now give residents rights over their personal information, and those rights are close to identical across them. We extend all of the following to everyone who asks, in any state, because running one process is simpler and fairer than running twenty.

• Know and access — what we hold, where we got it, why we have it, and who we gave it to.
• Get a copy — in a portable, machine-readable format.
• Correct — anything inaccurate.
• Delete — subject to the records we are required to keep, which are listed in section 11.
• Opt out — of sale, sharing, targeted advertising, and profiling with significant effects. See section 6.
• Limit sensitive information — we do not collect any, so there is nothing to limit.
• Not be treated differently for asking — exercising any of these will never change your price, your service, or your place in the queue.

How to ask

Email privacy@pinpoint-vending.com. Tell us what you want and give us enough to find you — usually the email address on your account. We verify it is you before acting, and for a deletion or a copy we may ask for more proof, because handing your data to the wrong person is the worse failure.

We answer within 45 days. If we need longer we will say so inside that window and take at most 45 days more. It is free, unless a request is repetitive or excessive — and we will tell you before charging anything.

Someone acting for you

An authorised agent may ask on your behalf. We will need written proof of their authority and, in most cases, confirmation from you directly.

If we say no

You can appeal. Reply to our decision, or write to privacy@pinpoint-vending.com with “Appeal” in the subject. A different person reviews it and we answer within 60 days with our reasons. If we still say no, you may complain to your state Attorney General, and we will tell you how.

10State-specific notes

California

The categories in section 2 are the categories we have collected in the last twelve months, and the recipients named there are who we disclosed them to, for business purposes only. California residents may also ask once a year, under the “Shine the Light” law, what we shared with third parties for their own direct marketing. The answer is nothing.

Colorado, Connecticut, Virginia, and the states that followed them

The appeal process in section 9 is the one these laws require, and the universal opt-out signal in section 6 is honoured.

Nevada

Nevada residents may tell us not to sell covered information. We do not sell it, but section 9 is where to say so.

Oregon

Oregon residents may ask for the names of the specific third parties we disclosed their information to, rather than the categories. Ask, and we will name them. The advertising and measurement platforms are named in section 7 already, without being asked.

Minnesota

Minnesota residents may ask us to explain a profiling decision and what would have changed it. We do not profile in a way that produces significant effects, so there should never be a decision to explain. If you think there has been, ask.

Maryland

Maryland’s law is stricter than the rest on minimisation: we collect only what is reasonably necessary for the service you asked for. That is the standard we apply everywhere.

11How long we keep it

When a period ends we delete the information or strip it of anything that could link it back to you. If you ask us to delete and we are required to keep something, we will tell you what and why, and delete the rest.

12Children

This is a service for businesses and it is not directed at children. We do not knowingly collect personal information from anyone under 18, and we do not knowingly sell or share the information of anyone under 16. If you believe a child has given us information, write to privacy@pinpoint-vending.com and we will delete it.

13Security

We protect personal information with encryption in transit, access controls that limit who on our team can see what, and providers carrying recognized security certifications. Payment card data never reaches our systems.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affects you, we will notify you and the relevant regulators as the law requires, without unreasonable delay.

14Where your information is held

We operate in the United States and our providers store information there. We do not currently market to, or knowingly collect information from, people in the European Economic Area, the United Kingdom, or elsewhere outside the US. If that changes, this policy changes first.

15Changes to this policy

We will update this page when our practices change, and move the “last updated” date at the top. If a change materially reduces your rights or widens what we do with your information, we will tell you directly — by email to the address on your account — at least 30 days before it takes effect, and we will not apply it retroactively.