Privacy Policy

cig-lo-xl is a humidor management and cigar-information service operating from the European Union. For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy.

Contact: support@cig-lo.com

When you use cig-lo-xl, we collect:

• Account data: email, username, hashed password, account creation date, jurisdiction (for Cuban-cigar geo-fencing), and approval status.
• Cigar inventory you enter: humidors, cigars, quantities, purchase prices, vendors, purchase dates, box codes, factory dates, position notes, lifecycle state.
• Tasting notes and contributions: tasting profiles and community notes you choose to add.
• Subscription data: subscription tier, Stripe customer ID, Stripe subscription ID. Payment-method details are held by Stripe — we never see your card.
• AI Notes interactions: prompts you send and responses returned, plus telemetry on whether the response was a refusal, included citations, or was flagged as unverified.
• Telemetry: feature-use events, weekly persona snapshots (humidor count, cigar count, surface engagement). Used to operate and improve the product.
• Audit data: GDPR actions (export, delete, restore), admin actions on your account if any.

We process your data to (a) provide the service you signed up for, (b) operate billing through Stripe, (c) improve the product, (d) comply with our legal obligations, and (e) protect against abuse. Legal bases under GDPR Art. 6(1):

• Contract performance — service operation, billing.
• Legitimate interests — analytics, abuse prevention, hoarding / ready-to-smoke heuristics. We balance these against your rights.
• Legal obligation — tax, accounting, regulatory record-keeping.
• Consent — optional features such as email digest opt-in.

We share data with the following processors, all under data processing agreements where required:

• Stripe (payments, EU + US) — billing data, customer ID, payment method.
• Groq (AI inference, US) — your AI Notes prompts are sent for completion. We do not send your humidor inventory in prompts.
• Anthropic (AI inference, US — used as fallback provider) — same scope as Groq.
• Hosting provider — server-side hosting and database for cig-lo-xl. Located in the EU.

⚠ Founder/legal: confirm exact subprocessor list and locations before public launch. Schrems-II Standard Contractual Clauses apply to US transfers.

• Account data: kept while your account is active. Deleted within 30 days of account-deletion request.
• Telemetry: 18 months for raw events; persona snapshots are kept indefinitely (small, longitudinally valuable and not directly identifying without joining to user).
• GDPR audit log: 6 years per typical EU operational baseline.
• Stripe records: governed by Stripe's own retention policy. We retain billing references (Stripe customer ID / subscription ID) only.

Under GDPR you have the right to:

• Access — request a copy of the data we hold about you. Self-serve in Settings → Your data → Export my data, or by emailing us.
• Erasure — request deletion of your account. Self-serve in Settings → Your data → Delete my account, with a 30-day cancellation grace period.
• Rectification — correct inaccurate data via the normal edit flows in the app, or by emailing us.
• Restriction / Objection — ask us to limit how we process your data; object to processing based on legitimate interest.
• Portability — the export endpoint produces a JSON-in-ZIP archive intended to be portable.
• Lodge a complaint with your local data protection authority.

cig-lo-xl shows a global cigar catalog including Cuban-origin cigars. For US-jurisdiction users, commerce paths to Cuban-origin listings (purchase recommendations, discount alerts on Cuban inventory) are geo-fenced off in compliance with the US embargo. Display of Cuban catalog data is permitted and unaffected.

We use a small number of strictly necessary cookies / local-storage entries: authentication session token (NextAuth JWT), locale preference. We do not use third-party advertising cookies.

We may update this policy. Material changes will be notified in-product or by email. Last update timestamp is shown at the top of this page.

Questions about this policy or your data? Email support@cig-lo.com.