The Five Forty is an annual membership for discounts at independent businesses in Virginia’s Shenandoah Valley, operated by 540, LLC, a Virginia limited liability company doing business as The Five Forty (“we”, “us”). This policy covers our website, our mobile app, and your membership.

It is part of the Member Terms. Businesses that list offers with us are covered by a separate agreement.

• Account details — your email address and a password, which is stored only as a cryptographic hash and is never readable by us. Optionally a display name, a phone number, and a profile photo.
• Billing details — the billing address associated with your membership, and the city we show on your account.
• Interests — the deal categories you choose, so the app can lead with things you care about.
• Feedback — anything you write about a business.
• Messages — the name, email, and message you send through the contact form.

Card numbers are handled entirely by Stripe and never reach our servers. We do not see, store, or process your full card details.

What we do keep is:

• your Stripe customer and subscription identifiers, and the status of your membership — active, in grace, suspended, cancelled;
• your credit balance and referral earnings;
• a card fingerprint from Stripe — an irreversible token that tells us two payments used the same card without telling us what the card is. It exists for one purpose: stopping a single person from farming referral rewards with their own card.

If you choose to take referral rewards as cash rather than credit, Stripe collects your identity and bank details directly through their own onboarding, under their terms and privacy policy. We store only the resulting account identifier and whether it is verified.

• Engagement — which businesses and deals you view, favourite, and redeem, with a timestamp and the city of the business. This is what lets a business see that its listing is working, and lets us see which categories matter.
• Notification tokens — if you turn on push notifications, the token your browser or device issues, so we can deliver them. Turning notifications off revokes it.
• Contact-form metadata — the IP address and browser user-agent of a contact-form submission. This exists to make abuse legible after the fact, and for nothing else.
• Ordinary server logs kept by our hosting providers, which include IP addresses and are retained for a short period for security and debugging.

We do not request or store precise device location. Maps are drawn by Mapbox, which — like any service that loads content into your browser — sees your IP address when it serves map tiles.

• To run your membership: sign-in, billing, renewal, and access.
• To show you deals, and to keep listings and favourites working.
• To operate the referral program, including detecting attempts to abuse it.
• To send you service messages you cannot opt out of while you are a member — billing notices, renewal reminders, security alerts — and, separately, marketing you can turn off at any time.
• To show businesses how their listings are performing, and to understand in aggregate what the membership is worth.
• To meet tax, accounting, and other legal obligations.

Businesses on the platform see counts of how their listings performed, and the text of feedback left for them with no name attached. They do not receive your email address, phone number, billing address, or payment details. When you redeem an offer in person you are of course showing them your membership — that interaction is between you and them.

Service providers process data on our behalf, under contract, only for what we ask them to do:

• Stripe — payments, subscriptions, and payouts.
• Supabase — our database, authentication, and file storage.
• Vercel — website and application hosting.
• Resend — transactional email delivery.
• Mapbox — maps.
• Apple, Google, and Expo — push notification delivery, if you have turned notifications on.

We may also disclose information where the law requires it, to protect our rights or someone’s safety, or as part of a sale or merger of the business — in which case this policy travels with it.

We use cookies that are necessary to run the site: they keep you signed in and keep the sign-in process secure. There are no advertising cookies, and no cross-site tracking. Blocking the essential ones will stop you being able to sign in.

• Account and profile data — while your membership exists, and for a reasonable period afterwards so that a rejoin, a dispute, or a refund can be handled.
• Billing and referral records — for as long as tax and accounting law requires, which is longer than the membership itself.
• Feedback — may remain visible to the business after your membership ends, since it was already anonymous to them.
• Engagement records and logs — kept for a limited period, then aggregated or deleted.

Most of this you can do yourself: your profile, notification preferences, and marketing opt-out live in your account settings, and cancelling or changing payment goes through the Stripe customer portal.

You also have the right to ask us to give you a copy of your personal information, correct it, or delete it, and to object to certain uses. Virginia residents have these rights under the Virginia Consumer Data Protection Act, including a right to appeal if we refuse a request; residents of other states have comparable rights under their own laws. We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of there.

Write to support@thefiveforty.com and we will respond within the time the applicable law allows. We may need to verify who you are first. Deleting your account does not delete records we are required to keep for tax or accounting purposes.

Data is encrypted in transit. Access to the database is enforced row-by-row, so one member’s account cannot read another’s, and the most sensitive material — feedback text, contact submissions, notification tokens, engagement records — is held in a restricted area that the public interface cannot reach at all.

No system is perfectly secure. If a breach affects you, we will tell you and the relevant authorities as the law requires.

The Service is for adults. You must be at least 18 to hold a membership, and we do not knowingly collect personal information from children. If you believe a child has given us information, write to support@thefiveforty.com and we will delete it.

We operate in the United States and our providers store data there. If you use the Service from elsewhere, you are sending your information to the United States.

We may update this policy. If a change is material we will tell you by email or a prominent notice on the site before it takes effect, and we will update the “Last updated” date above.

support@thefiveforty.com · 540, LLC dba The Five Forty, P.O. Box 161, Linville, VA 22834