Privacy Policy

Chai Consulting · chaiconsulting.com
Effective Date: October 4, 2026 · Last Updated: October 4, 2026

1. Who We Are and What This Policy Covers

Chai Consulting, LLC (“Chai Consulting,” “we,” “us,” or “our”) is a wine-collection consulting firm based in Los Altos Hills, California, owned by Maureen Downey. We advise collectors on their wine collections. Our services include advisory and acquisition strategy, sourcing, authentication, cellar organization, inventory management, liquidation, and appraisals and expert witness work. Chai Consulting does not sell wine or any other alcoholic beverage.

This Privacy Policy explains how we collect, use, share, and protect personal information when you visit chaiconsulting.com (the “Site”), contact us by email or phone, submit a form on the Site, respond to our advertising on X (formerly Twitter), LinkedIn, Google, or Meta (Facebook and Instagram), including through X Lead Gen forms and LinkedIn Lead Gen Forms, or otherwise interact with us. It also describes the privacy rights you may have and how to use them.

This policy applies only to chaiconsulting.com. If you become a client, your written engagement agreement may include additional confidentiality terms. Where that agreement conflicts with this policy, the agreement controls.

2. Information We Collect

Information you give us

We collect information you choose to provide when you fill out a form on the Site, email or call us, submit an X or LinkedIn lead form, schedule a consultation, or engage us for services. This may include:

• Contact information: your name, email address, phone number, mailing address, and preferred contact method.
• Professional information: your company, job title, and industry. This information often comes from X or LinkedIn lead forms, which may be pre-filled from your profile on those platforms.
• Collection details: information about your wine collection and your needs, such as the size and makeup of the collection, specific bottles, vintages and producers, purchase history and provenance, invoices or receipts, photographs of bottles, labels, capsules, and corks, storage and cellar conditions, the location of your collection, estimated values, and insurance, estate, or legal context.
• Engagement and billing information: the services you request, scheduling details, contracts, correspondence, and invoice and payment records. Payments are made by Stripe, check, wire transfer, or QuickBooks Payments. We do not store full payment card numbers.
• Communications: the content of your emails, messages, voicemails, and notes from our calls and meetings.

Information we receive from X and LinkedIn lead forms

When you submit a lead form in an X or LinkedIn ad, the platform sends us the information in that form. This may include your name, email address, phone number, company, job title, country, and your answers to any questions we include. Some fields may be pre-filled from your X or LinkedIn profile, and you can review and edit them before you submit. We receive this information through the platform’s advertiser tools and store it securely in our business email and contact system (Microsoft Outlook). The platform’s own privacy policy governs how X or LinkedIn handles your information: see the X Privacy Policy and the LinkedIn Privacy Policy.

Information collected automatically

When you visit the Site, we and our partners automatically collect some information through cookies, pixels, tags, and similar technologies. This may include your IP address, browser and device type, operating system, referring web page, pages viewed, time spent on pages, links clicked, the ad that brought you to the Site, and an approximate location (city, region, or country) based on your IP address. We use the following tools:

• X Pixel (X Corp.): measures the effectiveness of our X ads (for example, whether a visitor who saw or clicked an ad later visited the Site or submitted a form) and lets us show ads on X to people who have visited the Site (retargeting).
• LinkedIn Insight Tag (LinkedIn Corporation): measures conversions from our LinkedIn ads, provides aggregated demographic reports about Site visitors (such as job function and industry), and lets us retarget Site visitors with ads on LinkedIn.
• Google Ads tags (Google LLC): measure conversions from our Google search ads and may let us show ads through Google to people who have visited the Site (remarketing).
• Meta Pixel (Meta Platforms, Inc.): measures the effectiveness of our ads on Facebook and Instagram and lets us show those ads to people who have visited the Site.
• Analytics: Google Analytics (Google LLC), which our marketing agency uses to measure our advertising campaigns, and Squarespace Analytics, our website platform’s built-in visitor statistics. These help us understand how visitors use the Site and how our ads perform.
• Cookie consent: CookieYes, our consent management tool, which records your cookie choices, blocks the advertising tags listed above until your choices allow them, and honors Global Privacy Control signals.
• Essential cookies: cookies set by our website platform, Squarespace, that the Site needs to function, keep it secure, and remember your cookie choices.

Our marketing agency, BV Media, helps manage these advertising campaigns and tools on our behalf as our service provider.

Customer list audiences. We may upload email addresses of contacts who have given them to us to advertising platforms such as X, LinkedIn, Google, or Meta in hashed (encoded) form so that we can reach them, or similar audiences, with our ads. The platforms use the hashed data for matching and are not permitted to use it for other purposes under their advertiser terms.

We do not sell wine or any other alcoholic beverage and we do not collect information to verify your age. We do not knowingly collect precise geolocation, government ID numbers, or financial account login credentials through the Site.

3. How We Use Information

We use personal information to:

• Respond to inquiries: answer questions, follow up on form and lead form submissions, schedule consultations, and communicate with you.
• Provide our services: evaluate your needs; prepare proposals and engagement agreements; deliver advisory, sourcing, authentication, cellar organization, inventory management, liquidation, appraisal, and expert witness services; and invoice for our work.
• Market our services: measure the performance of our ads on X, LinkedIn, Google, and Meta, and show relevant ads to people who have visited the Site or interacted with us.
• Operate and improve the Site: keep the Site working, secure, and easy to use, and understand which content is useful.
• Protect and comply: prevent fraud and misuse, enforce our agreements, keep business records, and comply with laws, regulations, court orders, and professional obligations.

We do not use personal information to make automated decisions that produce legal or similarly significant effects about you.

4. Client Confidentiality

We understand that information about a wine collection, including its contents, value, and location, is sensitive. We treat collection details that you share with us as confidential, whether or not you become a client. We use them only to evaluate and provide the services you request. We do not publish them or use them in marketing, and we share them only as described in Section 5 or with your permission. We will not identify you as a client, or use your name or details in case studies or testimonials, without your written consent. Any confidentiality terms or non-disclosure agreement that we sign with you also apply.

5. How We Share Information

We do not sell personal information for money. We share personal information only in the following situations:

• Service providers: companies that help us run our business under contracts that limit how they may use the information. These include our business email and contact system, Microsoft 365 (Outlook); our website platform and host, Squarespace, which also provides Squarespace Analytics; our cookie consent tool, CookieYes; our marketing agency, BV Media, which manages our online advertising on our behalf; our scheduling tool, Calendly; our file storage provider, Dropbox; our payment and accounting providers, Stripe and QuickBooks; and our analytics provider, Google Analytics (Google LLC).
• Advertising platforms: X, LinkedIn, Google, and Meta receive information through their advertising tags and pixels (the X Pixel, LinkedIn Insight Tag, Google Ads tags, and Meta Pixel) and through any customer list audiences we upload, for ad measurement and retargeting, as described in Sections 2 and 6.
• Professional and legal engagements: when needed to perform services you request, and with your direction or consent, we may share relevant information with others involved in the engagement. Examples include licensed auction houses, retailers, or buyers in a liquidation; storage, logistics, or insurance providers; independent laboratories or specialists who assist with authentication; and your attorneys, accountants, estate representatives, or financial advisors. In appraisal and expert witness matters, information may be disclosed to retaining counsel, opposing parties, courts, arbitrators, or other tribunals as required by the engagement and applicable rules of evidence and discovery, and subject to any protective orders that apply.
• Legal requirements and protection: when we believe in good faith that disclosure is required by law, subpoena, court order, or other legal process, or is necessary to protect the rights, property, or safety of Chai Consulting, our clients, or others, including to investigate or prevent wine fraud or counterfeiting.
• Business transfers: in connection with a merger, sale of the business, or similar transaction, subject to this policy’s protections.
• With your consent: in any other situation where you ask us to share information or agree that we may.

6. Advertising, “Sharing,” and Your Opt-Out Choices

Although we do not sell personal information for money, California law treats making personal information available to a third party for cross-context behavioral advertising as “sharing.” Cross-context behavioral advertising means targeting ads based on your activity across different websites. Some other states call this “targeted advertising,” and some may treat it as a “sale.” Our use of the X Pixel, LinkedIn Insight Tag, Google Ads tags, and Meta Pixel for retargeting, and of customer list audiences if we use them, may be considered sharing or targeted advertising under these laws.

Do Not Sell or Share My Personal Information

You can opt out of the sale or sharing of your personal information, and of targeted advertising, in any of these ways:

• Website choice: click the “Do Not Sell or Share My Personal Information” link in the footer of the Site or in our cookie banner and turn off advertising cookies in our cookie consent tool, CookieYes. This choice is stored in your browser, so you will need to repeat it on each browser and device you use, and again if you clear your cookies.
• Global Privacy Control: we honor the Global Privacy Control (GPC) signal. If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of sale and sharing for that browser, and our consent tool, CookieYes, will block the X Pixel, LinkedIn Insight Tag, Google Ads tags, and Meta Pixel for advertising purposes in that browser. If you have given us your email address, we will also apply the opt-out to that information where we can link it to you.
• Email or phone: email info@chaiconsulting.com with the subject line “Do Not Sell or Share,” or call 650-561-5948. We will apply the opt-out to information we hold about you, including customer list audiences.

We do not knowingly sell or share the personal information of anyone under 16.

Platform and industry opt-outs

You can also control interest-based advertising directly with the platforms and through industry tools:

• X: adjust ad personalization and data-sharing choices in your X account under Settings > Privacy and safety > Ads preferences / Data sharing and personalization.
• LinkedIn: adjust your LinkedIn advertising data settings, including ads based on your activity on other websites.
• Meta (Facebook and Instagram): adjust your Meta ad preferences, including ads based on your activity on other websites.
• Digital Advertising Alliance: optout.aboutads.info (web) and the AppChoices app (mobile).
• Network Advertising Initiative: optout.networkadvertising.org.
• Google: Google My Ad Center and the Google Analytics Opt-out Browser Add-on.
• Browser settings: most browsers let you block or delete cookies. Blocking all cookies may affect how the Site works.

Opting out of interest-based ads does not mean you will stop seeing ads. The ads you see will just be less tailored to you. Industry opt-outs are cookie-based and apply only to the browser and device where you set them.

7. Emails From Us

We do not send marketing emails or newsletters. We use your email address only to reply to your inquiries and to communicate with you about services you request or an engagement you have with us.

8. Data Retention

We keep personal information only as long as we need it for the purposes described in this policy, unless the law requires or permits a longer period. As a general guide:

• Inquiries and leads that do not become engagements (including X and LinkedIn lead form submissions): up to 24 months after our last contact, unless you ask us to delete them sooner.
• Client files, collection details, engagement records, and invoices: for the length of the engagement plus 7 years, to meet tax, accounting, professional, and legal obligations.
• Appraisal and expert witness files: for as long as required by applicable professional standards, court rules, or the engagement terms, and at least 5 years after the report or the end of the matter, or longer if litigation is ongoing.
• Cookie, pixel, and analytics data: according to the settings of each tool. Google Analytics data is kept for up to 14 months, and CookieYes keeps a record of your consent choices. Squarespace, X, LinkedIn, Google, and Meta retain data under their own policies.

When information is no longer needed, we delete it or de-identify it.

9. Security

We use reasonable administrative, technical, and physical safeguards that fit the sensitivity of the information. These include encrypted connections (HTTPS) on the Site, access controls and multi-factor authentication on our business accounts, and limiting access to client files to people who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please avoid sending highly sensitive information, such as financial account numbers, through website forms or lead forms. Contact us first and we will arrange a more secure way to send it.

10. Children and Age

Because our services involve wine, the Site and our services are not directed to anyone under 21 years of age. We do not knowingly collect personal information from anyone under 21. If you believe someone under 21 has given us personal information, please contact us and we will delete it.

11. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), gives you the following rights, subject to certain exceptions:

• Right to know and access: to request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting, selling, or sharing it, and the categories of third parties we disclose it to.
• Right to delete: to request that we delete personal information we collected from you. We may keep information when the law allows, for example to complete an engagement, meet legal or record-keeping obligations, or establish or defend legal claims.
• Right to correct: to request that we correct inaccurate personal information.
• Right to opt out of sale or sharing: to opt out of the sale of your personal information or its sharing for cross-context behavioral advertising (see Section 6).
• Right to limit use of sensitive personal information: we do not use or disclose sensitive personal information for purposes that would give rise to this right under the CCPA, such as inferring characteristics about you, so we do not offer a separate “Limit” link. If that changes, we will update this policy and provide that option.
• Right to non-discrimination: we will not deny you services, charge you a different price, or give you a different quality of service because you exercised your privacy rights.

Categories of personal information (past 12 months)

The table below summarizes the categories of personal information, as defined by the CCPA, that we have collected in the past 12 months, where we got it, and who receives it. The purposes are described in Section 3 and retention periods in Section 8.

Sensitive personal information: we do not intentionally collect sensitive personal information as defined by the CCPA. If you choose to send it to us, for example a financial account number for payment, we use it only to provide the services you request.

How to submit a request

To exercise your rights to know, delete, or correct, contact us by either method:

• Email: info@chaiconsulting.com (subject line: “Privacy Request”)
• Phone: 650-561-5948

To opt out of sale or sharing, use any of the methods in Section 6.

Verification: to protect your information, we will verify your identity before we respond to requests to know, delete, or correct. We do this by matching information you provide, such as your name, email address, phone number, or engagement details, with information we already hold. We do not require verification for opt-out requests. Authorized agents: you may use an authorized agent to submit a request. We may ask for proof of the agent’s authority, such as signed permission or a power of attorney, and we may ask you to verify your identity directly. Timing: we will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, up to another 45 days, we will tell you why. We act on opt-out requests as soon as feasible, and within 15 business days.

Shine the Light: California Civil Code § 1798.83 lets California residents ask whether we disclosed their personal information to third parties for those third parties’ own direct marketing purposes. We do not make such disclosures. You can send questions to the contact information below.

12. Privacy Rights in Other U.S. States

Residents of several other states have privacy rights under their state laws. These states include Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Depending on where you live and whether the law applies to us, you may have the right to:

• confirm whether we process your personal information and access it;
• correct inaccuracies;
• delete personal information;
• obtain a portable copy of your personal information;
• opt out of targeted advertising, the sale of personal information, and profiling that produces legal or similarly significant effects; and
• obtain a list of the specific third parties we have disclosed your personal information to, where state law provides this right.

We extend the opt-out methods in Section 6, including honoring Global Privacy Control, to visitors from all U.S. states. To make any other request, use the contact methods in Section 11. Appeals: if we decline your request, you may appeal by emailing info@chaiconsulting.com with the subject line “Privacy Appeal” within a reasonable time after our decision. We will respond within the time your state’s law requires. If you are not satisfied with the result of your appeal, you may contact your state attorney general.

13. Do Not Track

Some browsers send a “Do Not Track” signal. Because there is no common industry standard for Do Not Track, the Site does not respond to it. We do honor Global Privacy Control as described in Section 6.

14. Visitors Outside the United States

Chai Consulting is based in the United States, and the Site is intended for a U.S. audience. If you contact us from outside the United States, your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your country.

15. Third-Party Websites

The Site may link to other websites, such as X, LinkedIn, winefraud.com, or auction and industry resources. Their privacy practices are governed by their own policies, and we are not responsible for them.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and change the “Last Updated” date above. If we make material changes, we will provide additional notice, such as a notice on the Site or an email to clients. We review this policy at least once every 12 months.

17. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or want to exercise your rights, please contact us: