The short version. We collect what you type into our forms, and nothing else. There are no analytics, no advertising and no tracking cookies on this site. We do not sell or rent anyone’s details, ever. You can stop our emails or delete your details yourself on Remove my details.
Who we are
The Manchester Wine Festival is a one-day, volunteer-run festival held in Manchester Center, Vermont, organised by Nature’s Market. We are responsible for the information described on this page. Reach us at [email protected].
What we collect, and why
Everything below arrives because somebody filled in a form on this site. We ask for as little as the job needs.
| If you | We store | Because |
|---|---|---|
| Join the mailing list or send us a message | Your name, email address, phone number if you give one, your message, and your confirmation that you are 21 or over | To reply, and to tell you about new events and the festival |
| Sign up at /list | Your name, email address, which of the wine list, festival news and Nature’s Market news you ticked and when, and your confirmation that you are 21 or over | To email you only what you ticked: the wine list and how to order and pick up at Nature’s Market, festival news, or news and offers from Nature’s Market |
| Tick the text box when you sign up | Your mobile number, that you agreed to texts, and when | To text you festival news, until you reply STOP or ask us to stop |
| Book tickets or event seats | Your name, email address, mobile number if you ask for your ticket by text, what you booked and paid, the Square payment and receipt reference, your ticket code, and how many of your party have been checked in at the door and when | To confirm and deliver your ticket, admit you at the door, and keep the festival’s accounts |
| Send a booking request while online payment is not open | Your name, email address and what you asked to book | To tell you when payment opens |
| Join the waitlist for a sold-out ticket or session | Your name, email address or mobile number (or both), and what you are waiting for | To contact you, once, by email, call or text if a place opens. Nothing is booked or charged |
| Apply to exhibit | Business name, contact name, email, phone, website, a description of what you make, product type, booth type, and whether you hold a liquor licence. If you create an account we also store a hashed password and any wine list you upload | To assess the application, lay out the festival, and meet Vermont liquor rules |
| Offer to volunteer | Your name, email, phone, availability, the roles that interest you, any relevant experience, and your confirmation that you are 21 or over | To build the shift roster and contact you about it |
| Support the festival as a business | Business name, contact name, email, phone, website, your logo, and the few words of support you write for the site | To name you as a supporter, with your agreement, and to stay in touch |
| Sign in to a vendor or staff account | The IP address and browser you signed in from, against that session | So an account holder can see where their account has been used |
We also keep our own working notes against vendor, supporter and volunteer records — for example that we have spoken to you, or that a booth is confirmed. If you ask for a copy of what we hold, those notes are included.
Businesses we approach
If we contact a local business about supporting or exhibiting, we hold the business name and publicly listed contact details until they tell us they are not interested, at which point we record that and stop.
The 21+ confirmation
This is a wine festival and it is restricted to people aged 21 and over. Our forms ask you to confirm your age; the festival checks photo identification at the gate. We record only that you confirmed it — we do not ask for a date of birth and we do not keep a copy of anyone’s ID. We do not knowingly collect information from anyone under 21 through this site. If you believe a child has sent us something, write to us and we will delete it.
Cookies
This site sets three cookies, and only for people who sign in: __Host-mwf_admin for festival staff, __Host-mwf_vendor for vendors with an account, and __Host-mwf_door on the festival’s own door-scanning devices (sessions begun before September 28, 2026 use the same names without the __Host- prefix until they end). Each holds nothing but a random session reference, is marked so that JavaScript cannot read it, and is sent only over HTTPS. Signing out deletes the session at our end, not just the cookie at yours.
While you book, your browser keeps what you have chosen and typed for a few minutes (in its own storage, not a cookie), so a page refresh does not lose your booking. It never leaves your device.
The payment step loads Square’s secure card form. Square may set its own cookies or read information about your device there, to prevent fraud; that is covered by Square’s privacy notice, not ours.
Browsing the public pages sets no cookies at all. There is no analytics, no advertising network, no social media pixel and no cross-site tracking of any kind on this site, which is why you are not being asked to dismiss a banner.
Who else sees it
We use four service providers, and no others:
- Square takes card payments. Your card details go straight to Square and never reach us; Square tells us that the payment went through and gives us its reference.
- Brevo delivers our email. Your email address and the message pass through Brevo’s servers.
- Twilio sends our texts (your ticket, if you ask for it by text, and news to the text list), from Nature’s Market’s number. Your mobile number and the text pass through Twilio.
- Cloudflare sits in front of this website to keep it fast and to absorb attacks. Cloudflare sees the requests your browser makes, including your IP address.
Everything else — the database and the uploaded files — sits on our own server. We do not sell, rent or trade anyone’s information, and we do not share it for anyone else’s marketing. We would hand something over if the law actually required it of us, and not otherwise.
Tickets and payments
Tickets are sold on this site and paid by card through Square. The terms of sale, including refunds, are in the terms of use. At the door, volunteers look up your booking on the festival’s own devices, which keep a copy of the booking list (name, booking number, party size and check-ins, never email or phone) so the door works without signal; that copy is wiped when a device is switched off.
How long we keep it
Sign-in sessions and email links expire on their own and are deleted automatically — a staff session after twelve hours, a vendor session after thirty days, a sign-in link after thirty minutes, and a password reset after an hour.
Applications, messages, volunteer offers and supporter records are kept for as long as we are still running the festival with them, because a vendor who exhibited in 2025 is usually someone we want to invite in 2026. We do not delete them on a timer. Bookings and payment records are kept for the festival’s accounts. You can delete your mailing-list and volunteer details yourself on Remove my details. Anything else, ask us and a person will remove it, so allow a few days.
What you can ask for
- A copy of what we hold about you, including our internal notes.
- A correction, if something is wrong.
- Deletion. If you exhibited or volunteered we may need to keep a basic record of that for our own accounts, and we will tell you if so.
- To stop hearing from us. Every mailing-list email has an Unsubscribe link, and Remove my details does it too. Once you opt out, your address stays on a do-not-email list (kept only as a one-way fingerprint) so it is not emailed again by mistake. Ticket confirmations for something you book still arrive.
Write to [email protected]. We will not ask you to explain why.
Where your information is
Our server is in the United States. Cloudflare, Brevo, Square and Twilio operate internationally, so a request or an email may pass through equipment outside the United States on its way to us.
Keeping it safe
Passwords are stored only as a one-way hash, never as text we could read. Sign-in links and session references are random values, and only a fingerprint of each is stored, so our database does not contain anything that could be used to sign in as you. The site is served over HTTPS. Uploaded files are stored outside the public web root under randomly generated names. No system is perfect, and we would rather say that than claim otherwise.
Changes to this notice
If we start collecting something new, or bring in a new provider, we will change this page and the date at the top of it before we do.