Legal
Privacy Policy
Last updated: October 2026
Who we are
Lagrange Distilling, La Grange, Texas, USA ("we", "us") is the controller of the personal data described here. For anything privacy-related, email gin@lagrange-distilling.com.
The short version
No cookies. No third-party analytics, advertising or tracking scripts. We never sell or share your personal information. We keep a security log of every visit, and — with your consent where the law requires it, otherwise after notice — we collect first-party usage data about how the site is used so we can understand our visitors and improve it. You can turn usage tracking off at any time under "Your choices".
What we collect and why
Security log (always). For every page you open we record your IP address, the time, the page, the referring site, your browser's user-agent string, the device class (phone, tablet, desktop) and an approximate location derived from the IP address (country, region, city). This contains no account, session or visitor identifier. Purpose: detecting and investigating abuse, attacks and fraud against the website. Kept for 400 days, then deleted automatically.
Usage data (with your consent or after notice, depending on your region). Pages visited and the order, time on each page, how far you scrolled, where you clicked or tapped, the movement of your pointer, viewport size, language, timezone and colour-scheme preference, the referring site, and errors your browser encountered on our pages. It is tied to a random session identifier (your tab, for 30 minutes of inactivity) and a random visitor identifier stored in your browser, and to a device fingerprint: a code computed from characteristics of your device and browser (screen size, graphics hardware, installed fonts, audio and canvas rendering, and similar) that lets us recognise the same device on a later visit without storing anything on it. Your IP address and approximate location are recorded with each session. Purposes: understanding how many different people visit and what they do, finding and fixing problems, verifying traffic we are charged for, and security. We never record keystrokes or anything you type.
Contact form. The name, email address and message you submit, used solely to answer you and delivered to our mailbox via Amazon Web Services.
Storage in your browser
We set no cookies. Local storage holds: your confirmation that you are 21 or older; your privacy choice; and, only when usage tracking is on, the visitor identifier, the session identifier (tab storage) and an encrypted queue of usage events waiting to be sent if your connection drops. Turning usage tracking off removes the identifiers and the queue.
Who processes it
Everything runs on our own infrastructure on Amazon Web Services (CloudFront, API Gateway, Lambda, DynamoDB, Simple Email Service) in the United States. AWS acts as our processor. No data goes to any other third party, and we do not sell, rent or share it.
How long we keep it
Security log: 400 days. Contact-form correspondence: as long as needed to deal with it and any follow-up. Usage data: for as long as it is useful for the purposes above; we review it periodically and you can ask for yours to be deleted at any time.
Your region
The rules that apply depend on where you are. We detected …; change it if that is wrong.
EU / EEA · GDPR
Lawful bases (GDPR Art. 6). Security log — our legitimate interest in keeping the website and its visitors secure (Art. 6(1)(f); Recital 49 recognises network and information security as such an interest). Usage data, device fingerprint and session replay — your consent (Art. 6(1)(a)), which we ask for before any of it is collected and which you can withdraw at any time under "Your choices" below; withdrawal does not affect processing before it. Contact form — our legitimate interest in answering you, or steps you request before a contract (Art. 6(1)(b)).
Storage on your device. Under the ePrivacy Directive (Art. 5(3)) we store the age-gate flag and your privacy choice because they are strictly necessary; the visitor id, session id and offline queue are stored only after you consent.
Your rights. Access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing), and withdrawal of consent. Email gin@lagrange-distilling.com — we answer within one month. You may lodge a complaint with your national supervisory authority (list at edpb.europa.eu).
Transfers. Data is processed in the United States on Amazon Web Services. AWS is certified under the EU-US Data Privacy Framework, and we rely on that framework and, where needed, the European Commission's Standard Contractual Clauses.
United Kingdom · UK GDPR & DPA 2018
Lawful bases (UK GDPR Art. 6). Security log — our legitimate interest in keeping the website secure. Usage data, device fingerprint and session replay — your consent, which we ask for first and which you can withdraw under "Your choices" below. Contact form — our legitimate interest in answering you.
PECR. We store the age-gate flag and your privacy choice because they are strictly necessary; the visitor id, session id and offline queue are stored only after you consent (PECR reg. 6).
Your rights. Access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Email gin@lagrange-distilling.com. You may complain to the Information Commissioner's Office (ico.org.uk).
Transfers. Data is processed in the United States on Amazon Web Services under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") and, where needed, the International Data Transfer Agreement.
Switzerland · FADP
Federal Act on Data Protection (FADP, 2023). We process the security log on the basis of our overriding interest in keeping the website secure, and usage data, device fingerprint and session replay only with your consent, which we ask for first and which you can withdraw under "Your choices" below. We do not use your data for high-risk profiling.
Your rights. Information, access, rectification, erasure, data portability and objection. Email gin@lagrange-distilling.com. You may contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
Transfers. Data is processed in the United States on Amazon Web Services under the Swiss-US Data Privacy Framework.
United States · CCPA/CPRA & state privacy laws
We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act (CCPA, as amended by the CPRA) or by the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or other states. We run no advertising, no cross-context behavioural advertising and no third-party analytics, and we do not engage in profiling that produces legal or similarly significant effects.
Categories collected (last 12 months): identifiers (IP address, visitor and session ids, device fingerprint); internet activity (pages visited, time on page, scrolling, clicks and pointer movement, browser errors); approximate geolocation (from your IP); device characteristics; and anything you type into the contact form. Sources: you and your browser. Purposes: site security, understanding and improving the site, answering your enquiries.
Your rights. Depending on your state: to know what we collect, to delete it, to correct it, to limit use of sensitive data (we collect none), to opt out of sale/sharing/targeted advertising (we do none), and not to be discriminated against for exercising rights. We honour the Global Privacy Control browser signal as an opt-out of usage tracking. Email gin@lagrange-distilling.com; we will verify the request and respond within 45 days. You may use an authorised agent. Nevada residents: we do not sell covered information.
Your choices here. Usage tracking runs after notice; you can turn it off at any time under "Your choices" below. The security log runs regardless.
Canada · PIPEDA
PIPEDA. We collect the security log for the purpose of protecting the website, which a reasonable person would consider appropriate in the circumstances. For usage data, device fingerprint and session replay we ask for your express consent first, and you can withdraw it under "Your choices" below (subject to legal or contractual restrictions, of which there are none here). Quebec residents: the same choices satisfy Law 25; we do not use technology to identify, locate or profile you without that consent.
Your rights. Access to and correction of your personal information, and to challenge our compliance. Email gin@lagrange-distilling.com. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner.
Transfers. Data is stored in the United States on Amazon Web Services and may be subject to US law.
Brazil · LGPD
LGPD (Lei 13.709/2018). Legal bases (Art. 7): security log — legitimate interest (Art. 7 IX) in the security of the website; usage data, device fingerprint and session replay — your consent (Art. 7 I), requested first and revocable under "Your choices" below; contact form — performance of procedures you request (Art. 7 V).
Your rights (Art. 18). Confirmation of processing, access, correction, anonymisation/blocking/deletion, portability, information about sharing, information about the consequences of refusing consent, and revocation of consent. Email our data protection officer at gin@lagrange-distilling.com. You may petition the Autoridade Nacional de Proteção de Dados (gov.br/anpd).
International transfer (Art. 33). Data is processed in the United States on Amazon Web Services under standard contractual clauses approved by the ANPD.
South Africa · POPIA
POPIA. We process the security log because it is necessary to pursue our legitimate interest in protecting the website (s. 11(1)(f)), and usage data, device fingerprint and session replay only with your consent (s. 11(1)(a)), asked for first and withdrawable under "Your choices" below. We do not use your information for direct marketing.
Your rights. To be notified of collection, to access, correct or delete your personal information, to object, and to withdraw consent. Email our Information Officer at gin@lagrange-distilling.com. You may lodge a complaint with the Information Regulator (inforegulator.org.za).
Transfers (s. 72). Data is processed in the United States on Amazon Web Services, which is bound by contractual terms providing substantially similar protection.
Australia · Privacy Act 1988
Privacy Act 1988 and the Australian Privacy Principles. We collect the security log because it is reasonably necessary to protect the website (APP 3), and usage data, device fingerprint and session replay after notifying you (APP 5); you can turn usage tracking off at any time under "Your choices" below. We do not use or disclose your information for direct marketing (APP 7).
Your rights. Access to and correction of your personal information (APP 12, 13). Email gin@lagrange-distilling.com. You may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Overseas disclosure (APP 8). Data is stored in the United States on Amazon Web Services.
Elsewhere · local law
We process the security log to protect the website, and usage data, device fingerprint and session replay after notifying you; you can turn usage tracking off at any time under "Your choices" below. If the law where you live requires consent for such processing, we rely on the choice you make in the banner.
Your rights. Wherever you are, you can ask us what we hold about you, ask us to correct or delete it, or object to our use of it — email gin@lagrange-distilling.com. Data is stored in the United States on Amazon Web Services.
Your choices
Usage tracking is currently on. In your region usage data is collected after notice; you can opt out. The security log is kept regardless, as explained above.
Turning it off stops collection immediately and deletes the visitor and session identifiers from your browser. To have data we already hold deleted, email gin@lagrange-distilling.com with the approximate dates of your visits.
Age restriction
This website is intended for people of legal drinking age (21+ in the United States). We do not knowingly collect information from anyone under 21.
Changes
If this policy changes, we'll update this page and the date above, and ask for your choice again where what we collect has changed.
