Privacy Policy

1. Information We Collect

• Account information: name, email address, display name, and account preferences.
• Submission content: the exam answers, tasting notes, and other materials you submit, with the grading and feedback generated for them.
• Payment information: handled by Stripe. We do not store full card numbers; we retain limited billing identifiers and subscription status.
• Usage and technical data: log data, device and browser information, IP address, and how you interact with the Service.
• Communications: messages you send us, including support requests and content flags.

2. How We Use Information

We use your information to: provide and operate the Service, including generating grading and feedback; manage your account, subscription, trials, and billing; send transactional and service-related emails; evaluate, calibrate, and improve our grading and feedback systems, using anonymized data where practicable; protect the security and integrity of the Service and prevent abuse; and comply with legal obligations.

Where the UK/EU GDPR applies, our lawful bases are: performance of our contract with you (providing the Service); your consent (for example, calibration use of identifiable Submissions you have agreed to, and certain communications); our legitimate interests (improving and securing the Service); and compliance with legal obligations.

3. Service Providers and Sharing

We share personal information only as needed to operate the Service, with providers acting on our behalf under contractual confidentiality and data-protection obligations:

• Supabase — database, authentication, storage
• Vercel — application hosting and infrastructure
• Stripe — payment processing and subscription management
• Resend — transactional email delivery
• Anthropic — AI processing to generate grading and feedback

Your Submissions are transmitted to our AI provider to produce grading and feedback. We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising. We may disclose information where required by law, to enforce our Terms, or to protect our rights, users, or the public.

4. International Transfers

We are based in the United States, and we and our providers may process your information in countries other than your own, including the US. Where we transfer personal information out of the UK or EEA, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, and, where applicable, a provider's certification under the EU–US Data Privacy Framework. You may request details of these safeguards at contact@winesage.ai.

5. Data Retention

We retain personal information while your account is active and as needed to provide the Service. When you delete your account, we apply a soft-delete with a 60-day recovery grace period, after which we delete or anonymize your personal information, except where retention is required for legal, accounting, security, or dispute-resolution purposes. Anonymized data used for calibration may be retained after that point because it no longer identifies you.

6. Your Rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, to object to processing, and to withdraw consent (without affecting prior lawful processing).

• UK/EU residents have rights under the UK GDPR / GDPR, including the right to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office).
• California residents have rights under the CCPA/CPRA, including to know, delete, and correct, and to opt out of "sale" or "sharing" (we do neither). We will not discriminate against you for exercising your rights.

To exercise a right, email contact@winesage.ai. We will verify and respond within the time required by applicable law.

7. Cookies and Similar Technologies

We use only cookies that are strictly necessary to operate the Service — specifically, the authentication and session cookies required to keep you signed in securely. We do not set any advertising, tracking, or analytics cookies.

For aggregate usage analytics we use Vercel Web Analytics. This tool sets no cookies, uses no persistent identifiers, and does not store your IP address or any other personal information in an identifiable form. All usage data is aggregate only and cannot be attributed to individual users.

8. Security

We use reasonable technical and organizational measures, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Policy from time to time. For material changes we will give reasonable notice. The "Last updated" date reflects the most recent revision.

11. Contact

Questions or rights requests: contact@winesage.ai. The data controller is winesage.ai.