Privacy policy

1. The short version

The rest of this page is the long version. It is long because it is specific, not because there is a lot going on.

2. What this policy covers

This policy covers this website and the three forms on it: the contact form, the wine club request and the email sign-up.

It does not cover the shops and restaurants listed in the store directory. Those are independent businesses with their own practices, and visiting one of them is nothing to do with this site. It does not cover the producers who make the wines, and it does not cover other websites you may reach from here.

3. Who we are and how to reach us

In these pages, "Covalli", "we" and "us" mean the Covalli brand and the United States importer that owns it and operates this site. Our full legal name and mailing address are available on request.

Questions about this policy, or about information you have sent us, go to the same place as everything else. Write to privacy@covallivineyards.com, or use the contact form. We answer within two business days.

If you need our legal name or postal address in order to make a privacy request, ask and we will give them to you.

4. What we do not collect

It is quicker to start here. We do not collect, and do not hold:

• Payment card, bank or billing details. Nothing is sold on this site.
• Government identification numbers of any kind.
• Precise location. We do not ask your browser for it and we do not derive it.
• Biometric or health information.
• Your date of birth. The age gate checks it and discards it; see below.
• Any account, username or password, because there are none.
• Anything the law calls sensitive personal information.

We also do not build profiles, score you, or make automated decisions about you.

5. What you give us

Three forms, and only what each one asks for.

The contact form:

Your name

So a reply can be addressed to you.

Email address

So a reply can reach you. It is used to answer your message and nothing else.

Company, optional

So trade and press enquiries can be handled properly.

Reason

So the message reaches the right person.

Your message

Whatever you choose to write.

The wine club request:

Your name and email address

So we can reply and confirm.

Shipping state

Because what is possible depends on the state.

Shipment

Which of the shipment sizes you are asking about.

Preferences, optional

Reds only, no sparkling, and so on.

Your confirmation that you are 21 or older

Kept with the request as a record that you gave it.

The email sign-up asks for an email address and nothing else.

Two details ride along with every submission, and it is fair that you know: the page you submitted from, and the time you submitted. On the contact page the page address includes the reason you picked, because that is held in the address bar. Neither is used to track you between visits; they exist so a message can be placed in context and answered.

Please do not send us information you would not want in an email inbox. The message box is free-form, so we cannot control what arrives in it, and we would rather you kept anything sensitive to yourself.

6. What is collected automatically

Like every website, this one is served by a host, and the host keeps access logs. Ours is Cloudflare. Those logs record the ordinary facts of a web request: the internet address it came from, the browser and operating system it reported, the page requested, and the page you came from if any.

Two things worth being explicit about. First, the filters on the range and the store directory are held in the web address, so the filters you chose appear in those logs. Second, we do not join any of it to anything else, we do not use it to identify you, and we do not use it for advertising. It exists so the site can be served and kept secure.

7. Cookies, browser storage and the age gate

This site sets one cookie, and it is not ours. Our host, Cloudflare, runs bot protection in front of every page, and that protection sets a cookie named __cf_bm to tell automated traffic from people. It is a security measure and nothing else: it holds no information about you, it is not read by us, it is not used to build a profile, and it expires within half an hour. There is no cookie banner because a cookie strictly necessary to keep a site secure is one of the few that needs no consent. We set no cookies of our own, and we run no analytics, no advertising and no tracking.

It stores exactly one thing in your browser, and only for as long as the tab is open. When you pass the age gate, a marker named covalli.agegate.session is written to session storage with the value ok. It is a yes-or-no marker and nothing more. Close the tab and it is gone, which is why the gate asks again on your next visit. Nothing in that marker identifies you, and it is never sent to us.

Your date of birth is checked inside your own browser. It is compared against today’s date to work out whether you are 21, and then it is discarded. It is not transmitted to us, it is not stored, and we could not tell you what you typed.

One honest footnote. The three date fields carry the standard autofill labels, so your own browser may offer to remember or fill in your date of birth. That is your browser doing what browsers do, on your own device. It is not us, and we receive nothing from it.

If our host ever changes what that protection does, or if we ever add anything that sets a cookie of our own, this section changes with it first.

8. How we use what you send

• To answer your message, and to follow up if answering it takes more than one email.
• To reply to a wine club request and tell you what is actually possible in your state.
• To send the release note, if you asked for it.
• To keep a record that a 21-or-older confirmation was given.
• To keep the site working and secure, and to comply with the law where we must.

That is the whole list. We do not use it to advertise to you, we do not enrich it with information bought from anyone, and we do not pass it to anyone selling anything.

9. Email from us

The release note is one email when a new vintage lands or a bottle enters a new market. Nothing else. That is the promise on the sign-up form and it is the promise here.

An address given for the release note is not used for wine club or trade outreach, and an address given on the contact form is not added to the release note. Every message we send carries a way to unsubscribe, and unsubscribing takes effect straight away.

The forms are delivered by Resend, an email delivery service. When you submit a form, what you typed is passed to Resend, which turns it into an email and delivers it to our inbox. Resend handles it only to deliver it, and holds it only briefly in its delivery logs. Nothing else about you is sent, and no form submission is added to any mailing list except the release note, which is the only form that asks.

10. Who else is involved

Three, and they are all infrastructure.

Google Fonts

The two typefaces this site is set in are served by Google. Your browser requests them directly, which means Google receives your internet address and the details your browser reports. We receive nothing from Google in return, and no font request identifies you to us.

Cloudflare

Hosts and delivers the site, and keeps the access logs described above.

Resend

Delivers the three forms to us as email. It receives what you typed into a form, and nothing more. It does not see your browsing, and it is not used for advertising or analytics of any kind.

There are no advertising networks, no data brokers, no analytics providers, no tag managers, no chat widgets and no embedded content from anywhere else. Service providers we do use may only act on our instructions and may not use what they handle for their own purposes.

11. When we share information

We do not sell your personal information, and we do not share your personal information for cross-context behavioural advertising. We do not process it for targeted advertising or for profiling. We have never done any of these things.

Because we do not sell or share personal information, there is no "Do Not Sell or Share My Personal Information" link on this site. There is nothing for it to switch off.

We disclose information in only three situations: to the service providers named above, so the site can run; where the law requires it, or to respond to a valid legal demand; and to protect the safety or rights of a person, including our own.

12. How long we keep it

Host access logs

Kept for as long as our host retains them for security and diagnostics, and not copied anywhere else by us.

Contact messages

Kept while the question is open and for a reasonable period afterwards, so a follow-up makes sense. Ask us to delete yours and we will.

Wine club requests

Kept while the request is live, and afterwards as a record of the age confirmation given.

Release note subscribers

Kept until you unsubscribe.

Unsubscribe records

Kept indefinitely, on purpose. It is the only way to be sure an unsubscribe keeps being honoured.

The age gate marker is not in this table because it never reaches us. It lives in your browser until you close the tab.

13. Security

The site is served only over an encrypted connection. Form submissions travel encrypted. Access to what you send is limited to the people who need it to answer you.

No one can promise perfect security, and we will not pretend otherwise. What we can say is that the less a site holds, the less there is to lose, and this site holds very little by design.

14. The store directory

The directory lists shops and restaurants that carry Covalli, with the business name, street, city, state and telephone number. It is business contact information, compiled from our own distribution records, and it is not consumer data.

If you run a listed business and something is wrong, or you would rather not be listed, tell us and we will correct or remove the entry. The directory is rebuilt from our records, so a correction sticks best when it reaches us rather than the page.

15. Age and minors

This site is intended only for people who are 21 or older, which is why it opens with an age gate.

It is not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child has sent us something, tell us and we will delete it.

16. Your choices

You can read this entire site without giving us anything. Every form is optional, and none of them is a condition of seeing anything.

You can unsubscribe from the release note at any time, and you can ask us to delete anything you have sent.

17. Your privacy rights

If you live in California, or in another state with a comparable privacy law - Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Minnesota and a growing list of others - you have rights over your personal information. We extend the same rights to everyone who writes to us, wherever you live, because it is simpler and fairer than checking.

• To know what we hold about you, and to get a copy of it.
• To have it corrected if it is wrong.
• To have it deleted.
• To receive it in a portable form.
• To opt out of sale, of sharing for advertising, and of profiling. There is nothing to opt out of here, because we do none of them.
• To be free from any penalty for exercising these rights.

To make a request, write to privacy@covallivineyards.com or use the contact form. Tell us what you want us to do. There are no accounts on this site, so the only way we can find your information is by the email address you used, and we may need you to write from that address, or answer a question about the message in question, before we act. If we cannot reasonably confirm that the information is yours, we will say so rather than hand it to the wrong person.

We answer within 45 days. If a request is complicated we may need longer, and we will tell you before the first period runs out.

An authorised agent may make a request for you. We will ask for proof that you gave them permission.

If we turn a request down, you may appeal. Reply to our decision and say you are appealing, and a different person will look at it and write back within 45 days. If you are still not satisfied, you may complain to your state attorney general.

California residents may also ask, once a year, whether we disclosed personal information to third parties for their own direct marketing. The answer is no, and it has always been no.

18. Do Not Track and Global Privacy Control

Some browsers send a Do Not Track or Global Privacy Control signal, asking sites not to track you or not to sell your information.

Those signals ask us to stop doing things we do not do. There is no tracking on this site to switch off, and no sale or sharing to opt out of, so a signal makes no difference to how this site behaves. We would rather say that plainly than claim to honour a signal nothing here reads.

19. Links to other sites

Where this site links somewhere else, that site has its own privacy policy and we are not responsible for it.

20. Changes to this policy

This policy was last updated on 16 September 2026, and the date at the top of the page always says when. If we change it in a way that matters, we will say what changed rather than quietly reissue it.