Privacy Policy

Effective Date: October 4, 2026

Applies to gotoliquorstore.com, GotoLiquorStore mobile applications, related consumer Services, and Goto's processing through the common platform infrastructure used to power retailer-branded storefronts.

GOTO DOES NOT SELL CUSTOMER LISTS OR PERSONAL INFORMATION TO DATA BROKERS FOR MONETARY PAYMENT. OPTIONAL ANALYTICS AND ADVERTISING TECHNOLOGIES, INCLUDING GOOGLE ANALYTICS AND META PIXEL, ARE DISABLED BY DEFAULT AND ARE USED ONLY AFTER THE APPLICABLE AFFIRMATIVE PRIVACY CHOICE IS MADE.

This Privacy Policy explains how Goto Concept LLC ("Goto," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information through the consumer Services. Operational disclosures necessary to process and fulfill a transaction are described below.

Goto operates a common technology and logistics-facilitation platform connecting adults of legal drinking age with independent licensed Retailers. This Policy governs Goto's processing through gotoliquorstore.com, GotoLiquorStore applications, and the same Goto platform infrastructure when it is used to power retailer-branded websites. A retailer-branded storefront may provide its own privacy notice governing the Retailer's independent processing. Retailers, payment processors, Delivery Providers, Carriers, app stores, and other entities may also have independent legal obligations when they control their own processing.

GotoLiquorStore.com and Goto-powered retailer-branded storefronts use common backend architecture and customer-data infrastructure. Information submitted through one of these properties may be stored in the same Goto platform environment and associated with a common customer profile or platform record. This architecture allows Goto to operate account functions, security and fraud controls, fulfillment, customer support, privacy preferences, compliance records, and other platform functions consistently across Goto-powered properties.

The use of common infrastructure does not mean that every Retailer receives or can access every customer's information. Goto uses access controls designed to restrict a Retailer's access to information associated with that Retailer's storefront, transactions, customer-service needs, compliance obligations, or other permitted purpose. Unrelated Retailers are not authorized to browse, export, or use customer information merely because their storefronts operate on the same backend.

If the same consumer separately interacts with more than one Goto-powered Retailer, each Retailer may receive information reasonably necessary for its own interaction, while Goto may maintain platform-level account, security, support, privacy, and transaction records across those interactions.

Depending on the activity and applicable law, Goto may act as an independent controller/business for platform-level processing and as a processor/service provider when processing personal information solely on a Retailer's documented instructions. A Retailer may separately act as a controller/business for its retail sales, fulfillment, compliance records, and independently controlled activities.

We may collect identifiers and contact information; account and platform-profile information; age and eligibility information; transaction and commercial information; payment tokens, transaction amounts, authorization/settlement status, limited card metadata, connected-payment and payout metadata, refunds, chargebacks, and related transaction records; addresses and location information; device, browser, and security information; communications; preferences; consent and privacy-choice records; and, when used in a delivery workflow, government-ID and proof-of-delivery information. Information from different Goto-powered properties may be associated within the same Goto platform record where reasonably necessary to operate the common platform. Full payment-card credentials are generally handled by the payment processor rather than intentionally stored by Goto.

We collect information from you, your browser or device, Retailers, payment processors, Delivery Providers, Carriers, and service providers supporting the Services.

Depending on the applicable workflow, a Retailer or Delivery Provider using Goto technology may scan or photograph a government-issued ID, obtain information from the ID, record an age or identity verification result, obtain a signature, record a delivery timestamp, and document whether delivery was completed or refused. We use these records for lawful delivery verification, fraud prevention, transaction support, dispute resolution, and regulatory compliance.

We do not use government-ID information for advertising. We do not use ID photographs or delivery signatures to create biometric identifiers, facial-recognition templates, or biometric authentication templates unless we first provide any separate legally required notice and obtain legally required consent.

Data minimization is the default: where law and the verification method permit, the system should retain the minimum compliance record rather than a full identification image. Full ID images, if captured, are generally deleted within 120 days after completion of the transaction unless a longer period is reasonably necessary for a documented fraud investigation, chargeback, dispute, regulatory requirement, or legal hold.

We may request device-level precise location permission to identify nearby Retailers, facilitate a location-dependent feature, route a delivery, or support fraud prevention. You may withdraw device permission through device settings. We do not use precise location for targeted advertising or to infer sensitive characteristics.

We use personal information to provide, maintain, personalize, and secure the Services and the common Goto platform; administer platform accounts and customer records; determine lawful product and fulfillment availability; route order requests; process and facilitate payments through Goto's connected-payment infrastructure; calculate and allocate commissions, retailer proceeds, delivery/shipping amounts, refunds, chargebacks, reserves, and settlement adjustments; facilitate pickup, delivery, and shipping; provide age and delivery-verification tools; communicate about transactions; provide customer support across Goto-powered properties; administer privacy choices and requests; prevent fraud and abuse; maintain legal, accounting, tax, and regulatory records; establish or defend legal claims; perform analytics and, where you have affirmatively enabled Advertising technologies, measure and personalize advertising as described in this Policy; and send marketing only where legally permitted and subject to applicable consent and opt-out requirements.

We do not use alcohol purchase information to infer a medical condition, diagnosis, disability, pregnancy status, substance-use condition, or other health status for advertising, profiling, or sale.

We disclose information only as reasonably necessary for operational, legal, safety, and business purposes described in this Policy. Recipients may include the Retailer involved in the relevant transaction or customer interaction; Stripe and other payment processors or connected-payment service providers; Delivery Providers and Carriers; hosting, security, fraud-prevention, mapping, communications, customer-support, and analytics service providers acting for Goto; professional advisers; governmental authorities where legally required; and parties to a legitimate corporate transaction. Payment-related disclosures may include information necessary to authorize, settle, allocate, refund, reverse, dispute, or reconcile a transaction. Goto does not disclose customer information to an unrelated Retailer merely because that Retailer also uses the Goto platform.

Operational disclosures to Retailers, payment processors, Delivery Providers, Carriers, and service providers acting solely to provide requested services are distinct from disclosures to optional analytics and advertising providers described in Section 10.

We provide the Retailer information reasonably necessary to evaluate, accept, fulfill, deliver, cancel, refund, or document an order. A Retailer may have independent legal duties concerning alcohol transaction and compliance records. Goto does not authorize a Retailer to use Goto-derived customer information for unrelated independent marketing solely because an order occurred. Any such marketing must have a separate lawful basis and legally required consent.

A Retailer receives access only to information reasonably necessary for its own transactions, customer service, compliance, or another disclosed permitted purpose. Goto does not provide one Retailer with another Retailer's customer list or order history for independent marketing, profiling, or analytics.

If the same consumer separately purchases from or interacts with multiple Goto-powered Retailers, each Retailer may receive information necessary for its own interaction. Goto may maintain the consumer's platform-level record across those interactions for the purposes described in this Policy.

Payment-card information is handled by payment processors. Goto generally receives a token, limited card metadata, authorization status, transaction amount, and refund information rather than full card credentials. We do not intentionally store full card numbers or security codes on Goto systems unless expressly disclosed and handled under applicable payment-security requirements.

We use necessary cookies, local storage, tokens, and similar technologies to operate and secure the Services, maintain sessions and carts, remember age-gate status where appropriate, authenticate accounts, prevent fraud, and remember privacy preferences. These technologies are used to provide or secure requested functionality.

Goto may use optional third-party analytics and advertising technologies, including Google Analytics and Meta Pixel, only after you make the applicable affirmative privacy choice through our Privacy Choices interface.

These optional technologies are disabled by default and are not intended to load, set optional cookies, or transmit user-interaction information to Google, Meta, or another optional analytics or advertising provider before the applicable consent is obtained.

If you enable Analytics, Goto may use Google Analytics to understand website traffic, measure how users interact with the Services, evaluate performance, and improve functionality. Google Analytics may receive information such as device and browser information, IP address, approximate location derived from network information, page URLs, referral information, pseudonymous identifiers, and configured interaction events.

If you enable Advertising, Goto may use Meta Pixel or similar advertising technologies to measure advertising performance, understand conversions, create or measure advertising audiences, and personalize advertising. Meta may receive information such as device and browser information, IP address, page URLs, referral information, browser or platform identifiers, and configured interaction or conversion events.

Goto does not authorize Google Analytics or Meta Pixel to collect passwords, full payment-card information, government-identification information, private customer-support communications, or other sensitive form-field contents.

You may reject optional technologies or later change or withdraw your preferences through Your Privacy Choices. Declining optional analytics or advertising technologies will not prevent you from using the basic Services.

Goto does not use third-party session-replay, keystroke-recording, chat-replay, or similar technologies to transmit the contents of a user's website interactions to a third party for that third party's independent advertising, marketing, profiling, or analytics purposes. Goto does not intentionally permit such technologies to capture passwords, payment-card fields, government-ID fields, private support communications, or other sensitive checkout content. If Goto later deploys session-replay or comparable interaction-recording technology for Goto's own internal service improvement, it should be disabled until any legally required prior consent is obtained, be disclosed before recording begins, and be configured to mask or exclude sensitive fields.

Goto does not disclose information that identifies a consumer together with the title or identity of specific video or other audio-visual content viewed through the Services to third parties for their independent advertising or marketing purposes. If the Services later embed a third-party video player or similar media service that can transmit viewing activity or identifiers to its provider, Goto should either configure the player so that such transmission does not occur before user action and any required consent, or provide a clear standalone disclosure and obtain any consent required by applicable law before the transmission occurs.

Goto does not authorize third-party tracking pixels in marketing emails to disclose a recipient's email-open, click, location, device, or similar engagement data to third parties for their independent advertising, marketing, profiling, or analytics purposes. If Goto uses first-party or service-provider delivery and engagement metrics for Goto's own campaign administration, those providers must be restricted to acting on Goto's instructions and the practice must remain consistent with this Policy and applicable law.

The Services provide a Privacy Choices interface through which you may control optional analytics and advertising technologies.

Available choices may include:

1. Reject Optional: keeps optional Analytics and Advertising technologies disabled.
2. Manage Preferences: allows you to separately enable or disable Analytics and Advertising.
3. Accept All: enables both Analytics and Advertising technologies disclosed in the Privacy Choices interface.

Where separate preferences are offered, Google Analytics is treated as an Analytics technology and Meta Pixel is treated as an Advertising technology.

Necessary technologies used to operate and secure the Services, maintain sessions and carts, authenticate accounts, process requested transactions, prevent fraud, remember age-gate status, and save privacy preferences remain active because they support requested functionality.

Goto honors legally required universal opt-out preference signals, including Global Privacy Control ("GPC"), where applicable. Where applicable law treats Meta Pixel or similar advertising activity as a sale, sharing, or targeted advertising, a recognized GPC signal will be treated as a request to opt out of that activity.

You may change your privacy preferences at any time through the Your Privacy Choices link.

We may send transactional communications concerning accounts, orders, delivery, shipping, refunds, security, and support. Marketing email, text, or calls are sent only where legally permitted and subject to any consent requirement. Acceptance of the Terms, creation of an account, provision of a telephone number, or completion of a purchase does not by itself constitute consent to receive marketing calls or texts when separate consent is required. Marketing consent is not a condition of purchase. You may unsubscribe from marketing email through the provided mechanism and revoke text-message consent through STOP or another reasonable supported method. Marketing opt-out does not prevent transaction messages necessary to provide a service you requested.

If Goto records a customer-service call, it will provide notice before or at the beginning of recording and obtain consent where applicable law requires it. If required consent is declined, Goto will use a reasonable alternative communication method where available.

Depending on law, government identifiers, precise geolocation, account credentials, and certain other information may be treated as sensitive. Goto uses sensitive personal information only where reasonably necessary and proportionate to provide a requested service, verify age or identity, complete and document a transaction, maintain security, prevent fraud, comply with law, or perform another legally permitted purpose. We do not use sensitive personal information to infer characteristics for advertising or marketing.

Goto does not intentionally create or maintain facial geometry, voiceprints, fingerprints, or other biometric identifiers for ordinary consumer identification or authentication. An ID photograph or handwritten delivery signature used as a transaction or compliance record is not processed by Goto to create a biometric template. If Goto later introduces biometric identification technology, it will provide any separately required notice and obtain any legally required consent before doing so.

We retain personal information only as long as reasonably necessary and proportionate to the purpose for which it was collected and to satisfy legal, accounting, fraud-prevention, security, regulatory, platform-account, and dispute-resolution needs. Because Goto operates a common customer-data environment, the end of a relationship with one Retailer does not necessarily require deletion of a platform-level customer profile or records that remain necessary for another Goto-powered interaction, Goto-controlled purpose, or legal obligation. When retention is no longer reasonably necessary, we delete or deidentify information subject to backups, legal holds, and lawful retention requirements.

We maintain administrative, technical, and physical safeguards designed for the sensitivity and risks of the information processed. Measures may include access controls, encryption where appropriate, authentication controls, logging, data minimization, vendor management, and incident response. No system can guarantee absolute security.

Depending on your state and the law applicable to Goto, you may have rights to confirm processing; access; correct; delete; obtain a portable copy; receive information about categories of collection and disclosure; opt out of sale, targeted advertising, or certain profiling; limit certain uses of sensitive information; withdraw consent where processing relies on consent; appeal a denied request; and exercise rights without unlawful discrimination.

Goto accepts privacy requests from U.S. consumers through support@gotoliquorstore.com, subject to reasonable verification, legal exceptions, security considerations, and other lawful limitations. Goto may centrally coordinate a request that spans the common platform and may route or coordinate the Retailer-specific portion with the applicable Retailer where required. A request concerning one Retailer does not authorize disclosure of another Retailer's records.

Where the California Consumer Privacy Act, as amended, applies, the categories described above may include identifiers, customer-record information, commercial information, internet or electronic-network activity, geolocation information, and sensitive personal information such as account credentials or government-ID information used for verification. Goto may disclose these categories for operational business purposes to the parties described in this Policy.

Where the California Consumer Privacy Act, as amended ("CCPA"), applies, the categories of personal information described above may include identifiers, customer-record information, commercial information, internet or electronic-network activity, geolocation information, and sensitive personal information such as account credentials or government-identification information used for verification.

Goto may disclose these categories for operational business purposes to the parties described in this Policy.

Goto does not sell customer lists or personal information to data brokers for monetary payment.

If you affirmatively enable Advertising technologies, Goto may use Meta Pixel for advertising measurement, audience creation, and advertising personalization. Depending on the facts, configuration, and applicable law, disclosures through Meta Pixel may constitute "sharing" for cross-context behavioral advertising or another activity for which California law provides an opt-out right.

California consumers may exercise applicable opt-out rights through Your Privacy Choices and, where applicable, through a recognized Global Privacy Control signal.

Goto does not knowingly sell or share personal information of persons under 16; the Services are intended only for persons at least 21 years old.

Goto uses sensitive personal information only for permitted operational, security, fraud-prevention, verification, and legal-compliance purposes and does not use government-identification information, precise location, payment information, or similar sensitive information for advertising personalization.

Where notice at collection is required, Goto will provide a conspicuous notice at or before collection.

Residents of Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, New Jersey, Rhode Island, Tennessee, Texas, and other states with applicable comprehensive privacy laws may have additional rights. Goto will honor legally applicable rights, including sensitive-data consent, universal opt-out, appeal, and data-protection requirements where applicable. Florida-specific rights will be honored to the extent the Florida Digital Bill of Rights applies to Goto.

The Services are not directed to children or persons under 21. We do not knowingly permit a person under 21 to create an account for purchasing alcohol or to receive an alcohol order. If we learn that information from an underage person was collected in circumstances where it is not lawful or appropriate to retain, we will take reasonable steps to delete or restrict it.

Information may be disclosed in connection with a legitimate merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction, subject to applicable requirements. We may also disclose information to comply with valid legal process, protect rights and safety, investigate fraud or security incidents, or enforce agreements.

We may update this Policy prospectively. We will post a revised effective date and provide additional notice or obtain consent where required for a material change. We will not use previously collected information for a materially different incompatible purpose without legally required notice and consent.

Goto intends this Policy, its cookie/privacy banner, just-in-time notices, and other privacy disclosures to describe the technologies and data practices actually deployed in production. Goto should conduct periodic and change-triggered reviews of website and application tags, SDKs, pixels, analytics tools, customer-support technologies, embedded media, marketing technologies, and material service-provider changes before making or materially changing a privacy representation. A new third-party technology that changes the collection, use, or disclosure of personal information should not be enabled until its data flows, contractual restrictions, consent requirements, and disclosures have been reviewed and implemented.

Privacy questions and requests:

Goto Concept LLC

2 Cityplace Dr, Saint Louis, Missouri 63141, United States

Email: support@gotoliquorstore.com