B2Bacco Privacy Notice
Draft for approval. Not yet in effect.
| Operator | Michael Hines, sole proprietor, 20257 Royal Villagio Ct, Unit 202, Estero, FL 33928, United States |
| Privacy contact | legal@b2bacco.com |
| Effective date | On approval |
| Current version | https://www.b2bacco.com/legal/privacy |
| Terms | https://www.b2bacco.com/legal/eula |
1. Who we are and what this notice covers
B2Bacco is operated by Michael Hines, a sole proprietor based in Florida ("we", "us", "our"). Cigar and tobacco manufacturers and distributors (Tenants) use B2Bacco to take orders from the retail businesses that buy from them (Retailers), and then to ship, invoice, collect payment and keep their accounting books.
This notice covers personal information about:
- the Tenant's staff, sales representatives and brokers who use B2Bacco;
- contacts at Retailers, such as buyers, accounts-payable contacts and owners;
- people named on shipping or billing addresses;
- anyone who receives an email from B2Bacco or opens a B2Bacco link;
- visitors to b2bacco.com, and businesses that contact us about early access.
B2Bacco is a business-to-business service. It is not offered to consumers.
2. Our role
- For data in a Tenant's account, the Tenant decides why and how it is used. We process it on the Tenant's behalf and on the Tenant's instructions. If you have a question or request about that data, contact the Tenant first. We will help the Tenant respond, or pass your request on.
- For a small amount of data, we decide for ourselves how it is used: what we need to operate and secure B2Bacco, such as security logs and sign-in records, and your correspondence with us.
3. Information we process
| Category | Examples | Where it comes from |
|---|---|---|
| Account and sign-in | Name, business email, role, Tenant, linked sales-rep record. Your password, stored only as a one-way hash. Authenticator-app enrollment. Session records. Sign-in times, IP address and browser type in security logs. | You; your Tenant's administrators; the Tenant's previous business system |
| Retailer business and contact details | Business name and account number. Contact names, business emails and phone numbers. Billing and shipping addresses. Sales-rep assignment, payment terms, credit status and customer class. License or resale-certificate details the Tenant records. | The Tenant, including its import from its previous business system; the Retailer |
| Orders, shipments and invoices | Order lines, prices, discounts, taxes and excise. Shipping method, package weights and tracking numbers. Whether adult signature is required. Invoice documents, balances, credits, deposits and notes. | Users; B2Bacco; the shipping process |
| Payment details | Authorize.net customer and payment profile identifiers, the card's last four digits and expiry date. Transaction identifiers, amounts and results. Never full card numbers, card security codes or bank account numbers. | Authorize.net; the Tenant |
| QuickBooks Online connection | The Tenant's QuickBooks company identifier. Access and refresh tokens, stored encrypted. Identifiers of the records B2Bacco creates in QuickBooks. | Intuit, when the Tenant connects |
| Recipient addresses. The content of transactional emails, which can include invoice documents and payment links. Delivery, bounce and complaint events. | B2Bacco; Resend | |
| History imported from the Tenant's previous business system | A frozen, read-only copy of the Tenant's records, such as customers, addresses, orders, invoices, payments and accounting history. B2Bacco's import does not extract tax identification numbers, bank or ACH details, or card numbers. | The Tenant's previous system |
| Technical and audit records | Request identifiers and timestamps. The Tenant and the kind of user behind each request. Audit events for payment actions, overrides and settings changes. Error logs. Logs are designed never to contain card numbers, security codes or credentials. | B2Bacco |
| Early-access enquiries | Your name, business, role and email address, and what you tell us, when you email us or meet us at a trade show. | You |
B2Bacco does not collect precise device location. If a future feature needs it, we will update this notice before that feature goes live.
4. How we use information
We use it to:
- run B2Bacco for the Tenant: taking, allocating, shipping and invoicing orders, collecting payment, posting to the Tenant's accounting system, and showing each sales rep their assigned Retailers;
- send transactional emails for the Tenant (see section 7);
- keep B2Bacco secure: preventing fraud and abuse, and keeping an audit trail;
- give support and troubleshoot problems when the Tenant asks;
- reply to early-access enquiries;
- meet legal obligations, including keeping records.
We do not sell personal information. We do not share it for cross-context behavioral advertising. B2Bacco sends no marketing email, and nothing in B2Bacco markets tobacco products to consumers.
5. Payment card information
- Card details are entered only on Authorize.net's hosted payment page. B2Bacco never receives or stores a full card number or a card security code.
- B2Bacco stores only payment-profile identifiers, the last four digits and the expiry date.
- Payment links work only for the invoice or invoices they were created for. They expire after 30 days or once the invoice is paid, whichever comes first, and the Tenant can revoke them.
- Payments go through the Tenant's own Authorize.net merchant account. Authorize.net's privacy policy covers the data it handles.
6. QuickBooks Online (Intuit)
- An authorized administrator of the Tenant connects B2Bacco to the Tenant's QuickBooks Online company. Intuit then issues access tokens to B2Bacco.
- B2Bacco asks only for accounting access. It does not ask for access to Intuit payments or payroll.
- The tokens are encrypted at rest and used only by B2Bacco's servers. They are never sent to a browser.
- What B2Bacco writes to QuickBooks. The Tenant's accounting entries: customers (name and billing details), invoices, payments, credits, deposits and journal entries.
- What B2Bacco reads from QuickBooks. The chart of accounts, items and company settings it needs to post entries correctly. It keeps the identifiers of the QuickBooks records it creates or maps to, so that nothing is posted twice.
- Disconnecting. The Tenant can disconnect from B2Bacco or from QuickBooks. B2Bacco then stops posting and deletes the tokens. Entries already posted stay in the Tenant's QuickBooks company, under the Tenant's control. Entries not yet posted are kept in B2Bacco until the Tenant reconnects or tells us what to do with them.
- We do not sell QuickBooks data, use it for advertising, or share it with anyone except the service providers in section 8 that host B2Bacco.
- Intuit's own privacy statement covers the data Intuit handles.
7. Email
- B2Bacco sends transactional emails for the Tenant: order confirmations, shipping notices with tracking links, invoices with a payment link, receipts and payment-declined notices.
- They come from notifications.b2bacco.com and name the Tenant as the sender, for example "Tenant name via B2Bacco". Replies go to the Tenant.
- Resend delivers them. Resend processes the recipient's address, the message content and delivery events. B2Bacco stops emailing an address that bounces.
- B2Bacco does not track whether you open its emails or click their links.
8. Service providers and connected services
We share personal information only as this notice describes.
| Provider | What it does | Information involved | Location | Relationship |
|---|---|---|---|---|
| Vercel | Hosts b2bacco.com, the B2Bacco console and API. Stores invoice documents and other private files. Keeps application logs. | All categories above, while being processed | United States | Our service provider |
| Neon | Hosts the B2Bacco database, with backups | All categories above | United States | Our service provider |
| Microsoft Azure | Stores the read-only copy of a Tenant's previous business system, and runs a standby copy of the API | Imported history; while on standby, all categories above | United States | Our service provider |
| Inngest | Runs B2Bacco's scheduled and background jobs | Job data such as record identifiers | United States | Our service provider |
| Resend | Delivers B2Bacco's transactional email | Recipient addresses, email content, delivery events | United States | Our service provider |
| Cloudflare | Answers DNS for b2bacco.com | No personal information | United States | Our service provider |
| Authorize.net | Processes card payments and stores cards on file | Card details entered on its page; payment profiles; transaction data | United States | The Tenant's provider; B2Bacco uses it with the Tenant's credentials |
| Intuit (QuickBooks Online) | Holds the Tenant's accounting books | The accounting entries in section 6 | United States | The Tenant's provider; B2Bacco connects at the Tenant's request |
| UPS | Carries the Tenant's shipments | Ship-to name, address and phone; package details; adult-signature requirement; tracking numbers | United States | The Tenant's provider, through the Tenant's own UPS shipping software and account |
We may also disclose information:
- when the law requires it;
- to protect the rights, property or safety of users, Tenants, Retailers or us;
- as part of a merger, acquisition or sale of the business, subject to this notice.
9. Where information is stored
B2Bacco stores and processes information in the United States.
10. How long we keep information
| Information | How long |
|---|---|
| Business records: orders, shipments, invoices, payments, credits, accounting postings, audit events, and the history imported from the Tenant's previous system | At least 7 years, to meet federal and state tax, excise and tobacco recordkeeping requirements, or longer where the Tenant asks or the law requires |
| User accounts | While the Tenant keeps the account active. After that the account is deactivated; identity details linked to business records are kept with those records. |
| Payment-link tokens | Until the invoice is paid, the link is revoked, or 30 days pass |
| QuickBooks tokens | Until the Tenant disconnects; then deleted |
| Database backups | Point-in-time recovery covers 7 days |
| Application, job and email-delivery logs | As long as our hosting providers keep them, generally no more than 90 days |
| Early-access enquiries | Until you ask us to delete them, or two years after our last contact |
| When a Tenant leaves B2Bacco | We export the Tenant's data to it, then delete it within 90 days, except records the law requires us to keep or the Tenant asks us to keep |
11. Security
- Encryption. Data travels only over HTTPS. It is encrypted at rest by our hosting providers. QuickBooks tokens are also encrypted by B2Bacco itself.
- Access control. Every request is tied to a Tenant and a user, and access is limited by role. Sales reps see only their assigned Retailers. Reps and Retailers never see cost or margin.
- Sign-in. Passwords are stored as one-way hashes. Administrator and accounting roles must use multi-factor authentication.
- Credentials. System credentials are kept in a dedicated secrets manager. Production credentials are used only in production, and access to production is limited to the operator.
- Test environments. Non-production environments sit behind access protection and email only addresses on an approved list.
- Audit. Payment actions, overrides and settings changes are recorded in an audit trail.
No system is perfectly secure, and we cannot guarantee the security of information.
12. Security incidents
If a security incident affects personal information in a Tenant's account, we will tell the Tenant without undue delay, and within 72 hours of confirming it. We will help the Tenant meet its own duties to notify affected people and authorities.
13. Your choices and rights
- Contact the Tenant you deal with about your information. You can also contact us (section 17). We will answer, or pass your request to the Tenant, within 45 days. We may need to verify your identity first.
- Depending on where you live, you may have the right to:
- know about, see, correct or delete your personal information, or get a copy of it;
- opt out of its sale or sharing. We do neither;
- not be treated differently for using these rights.
- B2Bacco sends only transactional messages about your business with the Tenant. To change where or whether you receive them, contact the Tenant.
14. Cookies
- B2Bacco uses only cookies that are strictly necessary for sign-in and security.
- b2bacco.com sets no cookies.
- We use no advertising or analytics cookies.
15. Children
B2Bacco is not directed at anyone under 21. We do not knowingly collect personal information from children.
16. Changes to this notice
We may update this notice. The current version, with its effective date, is always at https://www.b2bacco.com/legal/privacy. We will notify Tenant administrators of material changes before they take effect.
17. Contact
Michael Hines, operator of B2Bacco 20257 Royal Villagio Ct, Unit 202 Estero, FL 33928, United States legal@b2bacco.com