This policy explains how Wineater processes your personal data when you use wineater.com, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. The French version is authoritative.
1. Data controller
The data controller is BACCHUSTECH OÜ (a company incorporated in Estonia, registration code 17217985, brand Wineater), with registered office at Tornimäe tn 5, Kesklinna linnaosa, Tallinn, Harju maakond, Estonia (see the legal notice).
Contact for any personal data question: hi@wineater.com.
2. Data collected, purposes and legal bases
- Trial sign-up form (name, business name, email address, optional menu or catalogue file, GDPR consent checkbox). Purpose: create and configure your trial account and contact you about it. Legal basis: your consent (checkbox) and, for the ensuing relationship, pre-contractual steps taken at your request. You can withdraw consent at any time.
- AI sommelier demo on the site (the text you type to describe a meal or a wish). Purpose: give you wine recommendations. Legal basis: providing the feature you request (legitimate interest). Do not enter personal data in this field.
- Demo booking through a HubSpot form (the information you enter in the form, for example your business contact details). Purpose: organise the demo and sales follow-up. Legal basis: pre-contractual steps at your request / legitimate interest in B2B prospecting.
- Audience statistics through Google Tag Manager and Google Analytics 4 (page views and actions on the site, no targeted advertising). Purpose: measure traffic and site effectiveness. Legal basis: your consent, given through the cookie banner.
- Technical server and hosting logs (IP address, date, pages requested). Purpose: security and proper operation of the site. Legal basis: legitimate interest.
- Emails sent to hi@wineater.com. Purpose: answer your request. Legal basis: legitimate interest or pre-contractual steps.
3. Cookies and trackers
No audience tracker is loaded before you make a choice. If you click "Reject" or do not answer, Google Tag Manager is not loaded. Google consent signals (Consent Mode) are set to "denied" by default.
- Remembering your choice (browser local storage and the "wineater_consent" cookie): strictly necessary, exempt from consent. Duration: 6 months, after which the banner is shown again.
- Google Tag Manager / Google Analytics (set only after you accept): audience measurement. First-party cookies "_ga" and "_ga_*"; lifetime: 13 months.
- You can change your choice at any time with the "Cookie settings" link in the footer. Rejecting is as easy as accepting.
4. Recipients and processors
Your data can be accessed by authorised Wineater staff and by the following providers, acting as processors or third parties as the case may be:
- Vercel Inc. (hosting of the site and API);
- Supabase Pte. Ltd. (database and storage of files sent through the sign-up form);
- Google (Tag Manager, and Analytics where applicable; Gemini AI models used by the sommelier API to analyse the text typed in the demo);
- OpenAI (computing vector embeddings of the text typed in the demo);
- HubSpot (HubSpot Ireland Limited for the European Economic Area; demo booking form, "eu1" server);
- Hosts of external resources loaded by your browser: Supabase Storage (images, fonts), unpkg (widget script), and third-party sites for some partner and press logos. Your browser sends them your IP address when loading these resources;
5. Transfers outside the European Union
Some of the providers listed above (notably Google, OpenAI, Vercel, Supabase, HubSpot) may process data outside the European Union, in particular in the United States. These transfers rely on the mechanisms provided by the GDPR: an adequacy decision (notably the Data Privacy Framework for certified US providers) or standard contractual clauses.
6. Retention periods
- Sign-up form data and uploaded file: 12 months from the last contact.
- Email exchanges: 12 months.
- Text typed in the demo: 12 months.
- Audience measurement data: up to 14 months (the longest period offered by Google Analytics 4).
- Proof of your cookie choice: 6 months.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time (without affecting the lawfulness of earlier processing) and the right to give instructions on what happens to your data after your death.
To exercise these rights, write to hi@wineater.com. We may ask for proof of identity if in doubt. We reply within one month.
8. Complaint to a supervisory authority
If you believe your rights are not respected, you can lodge a complaint with the supervisory authority of your country of residence or work, or with the Estonian authority competent for our establishment, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). In France this is the CNIL (www.cnil.fr).
9. Security
We apply appropriate technical and organisational measures (encrypted HTTPS connections, restricted access to data).
10. Changes
We may update this policy. The date of the last update is at the top of the page; if cookie practices change significantly, your choice will be requested again.