Privacy Policy

1. Data Controller

Vinage is a product of Arnold Ruijter IT (KVK 99478781), based in the Netherlands. Arnold Ruijter IT is the controller of the personal data described in this privacy policy. For questions, please contact us at the e-mail address below.

2. What data do we process?

Vinage only processes the data that is necessary for the app to function. We collect the following categories:

• Account data: your e-mail address, and your name if you sign in with Google (via Firebase Authentication).
• Wine data: names, types, vintages, quantities, notes, photos and other information you enter yourself about wines in your collection.
• Cellar layout: placement data of wines in your digital cellar.
• Scan images: when you scan a bottle, the photo is temporarily sent to Anthropic for recognition — or to OpenAI, if you have set your own OpenAI key. We do not keep the full scan; we keep the cropped label photo with the wine.
• Subscription data: plan (free / paid), payments processed via Stripe. Vinage does not store any payment card details.
• Technical data: Vinage uses no analytics or tracking scripts.

If the app runs into an error, we store a short technical report (which screen, which version, which type of device). It contains no name, e-mail address or wine data. Such a report is deleted automatically after 90 days.

Cloud Sharing (optional) — if you sign in (with Google or an e-mail link) and create a cloud cellar, your wine data is synchronised via Firebase (Google). Your e-mail address (and, with Google, your name) is used for authentication and, only if you have separately given permission, for occasional e-mails about new features and tips to get the most out of Vinage — including, once, a few days after you sign up, an automatic e-mail to help you get started if your cellar is still empty. That permission is optional and you can unsubscribe at any time — via Settings or via the unsubscribe link in every e-mail. Beyond that, we use your address only for essential service messages, for example about a price change or a change to this policy; those are part of the service and are separate from the permission described above.

What we do not process — we do not collect advertising IDs or browsing behaviour, and we do not store location data. One exception: if you look for a wine to go with a dish and your browser gives permission, the app uses OpenStreetMap (Nominatim) to determine your town for a shopping tip; your coordinates are not kept.

3. What do we use your data for?

• Creating and managing your account.
• Storing and synchronising your wine collection across all your devices.
• Processing subscription payments.
• Providing AI-driven wine advice (only if you use this feature; under their terms, Anthropic and OpenAI do not use data received through their API to train models).
• Sending drinking-window alerts and reminders (only if you enable them).
• Improving the app based on the technical error reports (see above).
• Sending occasional e-mails about new features and tips to get the most out of Vinage (including the one-time getting-started e-mail after you sign up), only with your consent (and you can unsubscribe at any time).

The legal basis for processing is the performance of the contract (use of the app) and, where applicable, your consent — such as for Cloud Sharing and for e-mails about new features and tips.

4. Third parties (processors)

Vinage works with the following parties. Your data is never sold or used for advertising. For each party we list what we use it for, which data it receives and where it is based.

• Google Firebase — sign-in, storage of your data, hosting of the app and server functions. Data: your e-mail address (and your name when you sign in with Google), your wine data and photos, and when you scan a QR code, the web address in it (our server fetches that page, so the website does not see your IP address). Location: storage in the EU — Firestore in the Netherlands, photos and server functions in Belgium. Google processes sign-in data worldwide; transfer on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Privacy policy.
• Anthropic — label recognition, tasting notes and wine advice, via our own proxy (or directly if you set your own Anthropic key). Data: the label photo and wine data. Location: USA; transfer on the basis of the EU Standard Contractual Clauses. Privacy policy.
• OpenAI — only if you set your own OpenAI key: label recognition and wine advice. Data: the label photo and wine data. Location: USA; transfer on the basis of the EU Standard Contractual Clauses. Privacy policy.
• Stripe — payment for subscriptions. Data: your e-mail address and payment details; Vinage itself stores no card details. Location: Ireland and USA; transfer on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Privacy policy.
• Resend — delivering the e-mails we send (product updates you consented to, and service messages). Data: your e-mail address. Location: USA; transfer on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Privacy policy.
• Open Food Facts — looking up product data when you scan a barcode. Data: the barcode. Location: France. Privacy policy.
• OpenStreetMap (Nominatim) — only when you look for a wine to go with a dish and your browser allows location access: determining your town for a shopping tip (only that town name is passed to the AI). Data: your coordinates; these are not stored. Location: United Kingdom; transfer on the basis of the EU adequacy decision for the UK. Privacy policy.
• Origovero — only when you scan a digital product passport: fetching the bottle’s passport data. Data: the bottle’s GTIN and serial number. Location: the Netherlands.
• Google Fonts · gstatic.com · unpkg.com — loading fonts and code libraries. Data: your IP address. Location: USA; transfer on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Privacy policy.

Community reviews — when you rate a wine, we share your stars and your note, together with the wine’s name, producer and vintage, with other Vinage users. This is pseudonymous: the review is linked to an internal user ID, not to your name or e-mail address. Other users do not see your name, your e-mail address or your user ID. If you remove a wine from your collection, your shared review remains. You can switch this off under Settings → Sync & sharing → Share my reviews; your shared reviews are then removed. If you delete your account, the review is detached from your user ID and kept anonymously.

5. Retention Period

Your data is retained for as long as you have an active Vinage account. If you delete your account via Settings → Delete account, your personal data and wine data are permanently erased, including the photos. A shared cellar is only deleted if you are its last member; otherwise it remains for the other members and only your membership ends. A paid subscription is cancelled immediately. Your shared reviews are kept anonymously. Financial records (transaction log) are kept for as long as legally required (usually 7 years).

6. Your Rights (GDPR)

Want your account deleted? The Delete account page explains exactly how it works and what happens to your data afterwards.

Under the General Data Protection Regulation (GDPR) you have the following rights:

• Right of access: you can request which data we process about you.
• Right to rectification: you can correct inaccurate data.
• Right to erasure: you can delete your account and all your data from within the app (Settings → Delete account). If you only want to erase the data on this device, use Clear all data in Settings.
• Right to data portability: you can export your wine data as JSON or CSV from within the app (Settings → Export data).
• Right to object: you can object to certain processing by contacting us at vinage@vinage.app.

You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

7. Cookies and Local Storage

Vinage does not use advertising or third-party tracking cookies. The app keeps your data in your browser’s storage (localStorage, sessionStorage and IndexedDB): your collection, your settings and your session. Firebase may set technical cookies that are needed for signing in. If you choose a language on the website yourself, a functional cookie (__session) remembers that choice for one year, so that vinage.app opens in that language next time; the cookie contains only the language code.

8. Security

Vinage takes appropriate technical and organisational measures to protect your data. All communication takes place via HTTPS. Data is stored encrypted in Firebase, which is certified to ISO 27001 and SOC 2. Access to your account is secured: you sign in with Google or an e-mail link. API keys that you set yourself are stored locally on your device only. Despite these measures, no security measure is 100% watertight.

Important: without Cloud Sharing your collection lives only on this device. If you clear Vinage’s site data in your browser (often part of "clear cache" or "clear browsing data"), the collection on this device is permanently lost. Make regular backups via Settings → Export data, or enable Cloud Sharing so that your collection stays synchronised across devices and recoverable.

9. Changes to this Policy

This privacy policy may be updated from time to time. In the event of material changes you will receive a notification via the app or by e-mail. The date at the top of this document indicates the most recent version. Continued use of the app after a change constitutes acceptance of the updated policy.

10. Contact

For questions, requests or complaints regarding this privacy policy, you can contact us at: