This policy explains what personal data WeWine collects through the WeWine app for iPhone, the web app at app.wewine.app and this website; why we use it; how long we keep it; and the choices you have. It is written to meet the EU General Data Protection Regulation (GDPR) and Spain’s data protection law (Ley Orgánica 3/2018, LOPDGDD).
Who is responsible
The data controller is the company named under “Operator details” above. For anything about your privacy, write to privacy@wewine.app. Data protection officer: [pending].
What we collect
- Account data: display name, email address, sign-in method (Apple, Google or email link), date of birth to confirm you are 18 or over, language and city.
- Your wine profile: quiz answers, the taste profile and wine personality derived from them, wines you save, rate or scan, and the feedback you give.
- Social activity: friends, invitations, Wine Match comparisons, messages and meeting suggestions.
- Photos you choose to scan: bottle labels, shelves, wine lists and food menus.
- Your profile photo, if you add one: checked by an automated image-safety review (Google Gemini) and, when that is unclear, by a person, before anyone else sees it; then shown wherever your name is shown.
- Sommelier conversations: the questions you ask our AI sommeliers and their answers.
- Wine Dating, only if you switch it on: your dating profile, including your gender and the genders you are interested in. This can reveal information about your sex life or sexual orientation, so we process it only with your explicit consent.
- Places: venues you check in to or review, and your city. We do not track your precise location; distance to venues is calculated on your device.
- Purchases: the plan you buy and its status. Card details are handled by Apple or Stripe; we never see them.
- Technical data: device and app version, crash reports and security signals (such as Apple App Attest) used to keep the service working and to prevent abuse.
- Website analytics, only if you accept: on this website, the pages you view, the buttons into the quiz and the app you use, the Winepedia articles you read, and your device, browser, language and approximate location, through Google Analytics. Never your name, email or account, and never share or invitation codes.
This website (wewine.app) uses no advertising trackers. The cookie policy lists its cookies and explains how to accept, reject or withdraw.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Your account, the quiz, your profile, friends and chat | Performance of our contract with you — art. 6(1)(b) |
| Scanning, pairing and AI sommelier answers | Your consent, asked before first use — art. 6(1)(a) |
| Learning from your feedback to improve your profile and WeWine’s recommendations | Your consent: on by default with a clear switch, and you can turn it off at any time |
| Local discovery and Wine Dating | Your explicit consent — art. 6(1)(a) and 9(2)(a) |
| Optional analytics (this website and the apps) and marketing messages | Your consent — art. 6(1)(a); for analytics cookies, also art. 22.2 LSSI-CE; off unless you opt in |
| Safety, moderation, and preventing fraud and abuse | Our legitimate interest in a safe service — art. 6(1)(f); legal obligations — art. 6(1)(c) |
| Billing, invoicing and tax | Legal obligation — art. 6(1)(c); contract |
Automated decisions
Recommendations, Wine Match and rankings are automated, but they have no legal or similarly significant effect on you. Moderation uses automated screening, but a person confirms every suspension or ban, and you can appeal any decision.
Who we share it with
We use service providers that process data on our behalf under written agreements (GDPR art. 28):
- Google Cloud and Firebase: hosting, database and sign-in.
- Google Gemini: AI that reads labels and menus, explains pairings and helps screen messages (only with your consent), and checks profile photos for safety.
- Ruta: the AI sommelier platform that processes your sommelier conversations.
- Apple and Stripe: payments and subscriptions. For App Store purchases, Apple acts as an independent controller.
- Apple (MapKit): the maps in the app and on the web. Your device loads the map from Apple; we send Apple no account details. Venue details come from WeWine’s own records, not from Google.
- Google Analytics (Google Ireland Limited): website and web-app analytics, only with your consent, with Google signals and every advertising feature switched off.
Other people see only what you choose to share, under your profile’s visibility settings. We disclose data to authorities when the law requires it, and we report threats to life or safety and any child sexual abuse material.
International transfers
Our servers are in the United States (Google Cloud, us-central1), and Google may process analytics data there through Google LLC. Transfers rely on the EU–US Data Privacy Framework and, where needed, the European Commission’s Standard Contractual Clauses.
How long we keep it
| Data | Kept |
|---|---|
| Scan photos | 7 days |
| Scan results | Until you delete them, or 24 months of inactivity |
| Messages | Until the conversation or the account is deleted. When you delete your account, messages you sent stay with the person you sent them to, shown as from a “Deleted user” |
| Profile photo | Until you replace or remove it, or delete your account |
| Sommelier conversations | Until you delete them or your account |
| Guest quiz results (no account) | 30 days |
| Moderation evidence | 12 months after the case is closed |
| Usage events | 90 days; after that, only aggregated statistics |
| Website analytics (only with your consent) | Cookies: up to 13 months from your last visit. Detailed data in Google Analytics: 14 months; after that, only aggregated reports |
| Backups | Deleted data disappears from backups within 30 days |
After your account is deleted we keep only de-identified, aggregated statistics (for example, how often a kind of pairing was found useful). They no longer identify you, and we use them to improve WeWine.
Your rights
You can access, correct, delete, restrict or export your data, object to processing based on legitimate interest, and withdraw any consent at any time without affecting earlier processing — for website analytics, with “Cookie settings” at the foot of every page. The privacy centre in the app lets you export and delete your data directly; you can also write to privacy@wewine.app. You have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).
Adults only
WeWine is only for people aged 18 and over. We do not knowingly collect data from minors, and we close accounts that appear to belong to one.
Security
Data is encrypted in transit; access is limited to people who need it; staff accounts use hardware security keys; and every administrative action is logged.
Changes
We will tell you in the app before any material change to this policy takes effect.
Review notes for counsel: confirm the controller (WeWine’s company, or Ruta’s company as App Store trader — plan §10); the DPO appointment; Ruta’s role (processor or joint controller) and the inter-company agreement; the data-use terms of the Gemini API tier in use; the DPIA outcome; Google Analytics — Google’s role (processor under its data processing terms, data-sharing settings off), the DPF/SCC transfer wording and the 2-month retention setting; and the Spanish binding text.