What we keep,
what we don't,
and why.

This policy covers the Sommelier AI apps (iOS, Android, web) and this website. It explains what personal data we collect, why, who we share it with to run the service, and how you stay in control. We do not sell your data.

The short version.

Your palate is yours. We do not sell it, and we do not use it to train general-purpose models. We keep what we need to make the product better for you, we share it only with the vendors who help us run the service, and you can export or delete it whenever you want.

What we collect.

• Account, identity & purchases. Your name, email, and language, plus the login handled by our authentication provider (Auth0). If you subscribe, the purchase is handled by whoever sold it to you — Stripe on the web, the Apple App Store on iOS, Google Play on Android — and we receive receipt, entitlement, and subscription-status information back from them. We never see full card numbers.
• Your cellar & journal. Bottles, vintages, dates, ratings, tasting notes, and journal entries you create.
• Your palate. Taste-quiz answers, ratings, and scan history, used to build and tune your personal taste profile.
• Photos you scan. Images of wine labels and wine lists you capture are sent to our AI provider (Microsoft Azure OpenAI) to identify the wines.
• Chat with the AI sommelier. The messages you send, and context we attach (such as your cellar), are processed by Azure OpenAI. To answer some questions we may send a search query to our web-search provider (Tavily).
• Contacts you choose for invites. When you invite someone to a Wine Night from your device contacts, we upload the name and — if you include them — the email and/or phone number of the specific people you pick. We never read or upload your whole address book.
• Notifications. If you turn notifications on, we store a device push token issued through Expo and the platform's notification service, and use it only to deliver the notifications you asked for — Wine Night invitations, cellar and drinking-window alerts, and account or security notices. You can turn them off at any time in the app or in your device settings; nothing in the app requires them.
• Cellar Journal newsletter. If you subscribe from this website, we store your email address and the IP address of the request as evidence of opt-in, and we use them only to send you the Cellar Journal. Every letter carries a one-click unsubscribe link, and you can unsubscribe anytime at asksommelier.ai/unsubscribe or by emailing help@asksommelier.ai. After you unsubscribe we keep the minimum record needed to honor it.
• Consent & security records. When you accept these terms, we record the version, timestamp, IP address, and device/browser (user-agent) to evidence your consent.
• How you use the apps. Which screens you open and for how long, which features you use — for example scanning a label, asking the sommelier, or adding a bottle — and whether they worked, along with the app version, platform, app language, your device's region setting, your plan at the time (free, trial, or subscription), and, once we know it, the kind of channel that first brought you (for example, an ad, a campaign link, or Google Play). Our own service records these usage events and stores them in our own database on Microsoft Azure, linked to your account. If you subscribe, we also keep a country with your account: for a subscription through the App Store or Google Play, the country RevenueCat reports as your last seen location; for a subscription on the web, your billing country as Stripe records it. These usage records are separate from the device & diagnostic data below, and they never contain what you write or photograph: no chat or note text, no images, no search terms, no contact details. When someone opens a Wine Night invitation or a gift page without being signed in, we count that open for the event or gift and the day only — never per person — and we do not record who opened it.
• An installation identifier. When usage measurement is switched on for your account and you are signed in, the app creates a random identifier for that installation: in the device's secure storage on iOS and Android (with a copy in the app's own storage, used only to detect a reinstall), and in your browser's local storage for the web app. It is tied to the account it was created for, it is not a hardware or advertising identifier, and it goes only to our own servers, with your usage events. The app deletes it when you sign out or when it learns that measurement has been switched off for your account, and creates a new one only when usage measurement is switched on again for the account that is signed in. When your account is deleted, we remove the identifier from your usage records, so it cannot tie a new account to your old ones.
• Where you installed the Android app from. When usage measurement is switched on for your account and you are signed in, the Android app asks Google Play which link the app was installed from — the "install referrer", for example the campaign tags of an ad or of a link on this website — or learns that there was none. The answer describes the original installation, even when the app asks for it later. The app keeps it on your phone only until it has been sent to our servers, and deletes it then, or earlier if you sign out or measurement is switched off for your account. On our servers we keep only the campaign details it contains (such as source, medium, campaign, and content, or for a Meta ad the campaign, ad set, and ad identifiers); we do not store the full referrer or any search keyword in our usage records, and we do not write it to our logs. If the install came from a Meta (Facebook or Instagram) ad, those details arrive encrypted, and we decrypt them on our servers with a decryption key Meta provides for our app. We do not use an embedded Meta advertising or attribution SDK for this feature, and we do not send these attribution data to Meta. The iOS app reads no install source.
• Campaign tags on links to the web app. A link can carry campaign tags — the "utm_" parameters in a web address, which say, for example, which newsletter or ad it came from. If you open the web app from such a link while you are signed in and usage measurement is switched on for your account, the web app saves the source, medium, campaign, and content tags (and only whether a search keyword was present, never the keyword itself), together with when it saved them and which part of the app the link opened, in your browser's local storage, sends them to our servers once, and then deletes them. If you are not signed in, or measurement is off, it saves nothing, and tags from a link you opened before signing in are not kept. Saved tags expire after 30 days: after that they are not used or sent, and the web app removes them the next time it runs its cleanup. They are also deleted when you sign out. We keep what it sends with your account, so we know which campaign brought you, and remove it when you delete your account, as described under Retention & deletion.
• How you heard about us, if you tell us. The apps may ask how you found Sommelier AI (for example, a friend, Instagram, or a search engine). Answering is optional — you can skip the question or choose "prefer not to say" — and we keep the first answer you give with your account.
• Device & diagnostic data. App version, device and OS type, and error/performance telemetry, processed by Microsoft Azure Monitor to keep the service reliable. We do not use third-party advertising or cross-site tracking.

How we use it.

• To provide and personalize the service — recommendations, your cellar, scanning, and chat.
• To validate purchases, unlock the entitlements you paid for, and keep your subscription status current (via Stripe, Apple, or Google Play, depending on where you subscribe, and RevenueCat for the mobile apps).
• To understand how the apps are used and make them better — which features people come back to, where they get stuck, whether a change helped — from the usage events described above. We also use the subscription country described above to break those statistics down by country. Our analytics dashboards show totals and trends, not individual activity timelines.
• To learn which channels and campaigns bring people to Sommelier AI, from the install referrer, the campaign tags, and your optional answer about how you heard of us.
• To keep the service secure, debug problems, and prevent abuse.
• To comply with legal obligations.

We do not sell your personal data, and we do not use your palate or content to train models for anyone other than you.

Who processes it.

We share data with a small set of vendors who process it on our behalf, only to provide their part of the service, under contracts that require them to protect it:

• Microsoft Azure — hosting, database, and file storage (United States).
• Microsoft Azure OpenAI — AI chat, label recognition, and enrichment.
• Tavily — web search used to ground some AI answers.
• Auth0 by Okta — sign-in and account authentication.
• Stripe — subscription payments made on the web.
• Apple App Store — iOS purchases, receipts, and subscription status.
• Google Play — Android purchases, receipts, and subscription status, and the install referrer described above.
• RevenueCat — receipt validation and entitlement management for App Store and Google Play subscriptions.
• Expo — push notifications (mobile).
• Azure Communication Services — transactional email we send you.
• Cloudflare — Turnstile bot protection on the forms on this website.

We may also disclose data if required by law, or to protect the rights and safety of our users and the service.

People you invite.

When you invite someone to a Wine Night using their contact details, you are sharing another person's information with us. We use it only to deliver that invite and manage the event, and we do not use it to market to them. If they open the invitation without signing in, we count only that the link was opened, for that event and that day — not who opened it. If you — or the person you invited — want that information removed, email privacy@asksommelier.ai and we will delete it.

Your palate.

Your palate fingerprint is the most personal thing in this product, and we treat it that way: stored encrypted at rest, never sold, and never used to train general-purpose or third-party models. It exists to serve your recommendations. When you delete your account, your palate is deleted with it.

Retention & deletion.

We keep your data while your account is active. You can delete your account at any time from Settings. When you do, we delete your account data — cellar, journal, palate, chat history, and scans — from our active systems and remove your sign-in identity; residual copies are purged from encrypted backups within 30 days. Contact details you provided to invite guests are deleted when the event is removed, or earlier on request. We may retain a minimal record where the law requires it. Records of purchases and subscription transactions, in particular, are kept for as long as accounting requirements call for; they include the store or payment reference, the amount, the dates, and, where one was reported, the country.

Usage events and session records are kept for up to 25 months, and screen-time records for up to 13 months, counted from when each record was made; then they are deleted. When you delete your account, we de-identify your usage history within 24 hours: we remove your account, your installation identifier, and the additional details some events carry (such as the campaign tags of the link you arrived from), and we delete the per-person daily summaries built from it. What remains records what was done in the apps and when. Every record keeps the platform and the app version it was made with, where known. Usage events and screen-time records keep the plan you were on at the time (free, trial, or subscription), and session records keep the plan you were on when the session started. Only usage events keep the app language, the region setting, and the kind of channel that first brought you. Records from the same session of use still share a random session identifier, and usage events about a Wine Night keep that Wine Night's identifier; a Wine Night hosted by another account is not deleted when you delete yours. None of these records carries your account or installation identifier. The de-identified records are deleted on the same schedule, counted from when each record was made; deleting your account does not restart it. Totals already calculated from usage — for example, how many people used a feature on a given day — hold counts only and are kept indefinitely.

Subscriptions are a separate matter, and it matters where you bought yours. A subscription bought on our website is cancelled with your account through the Stripe billing flow. A subscription bought through the Apple App Store or Google Play is managed by that store — deleting your Sommelier AI account does not cancel it, so cancel it in your App Store or Google Play subscription settings. Either way, you never have to cancel first: you can delete your account immediately.

Cookies & tracking.

This website uses no advertising cookies, no third-party pixels, and no cross-site tracking, and our pages keep nothing in your browser. If you arrive from a link that carries campaign tags (the "utm_" parameters in a web address), the page you land on adds the same source, medium, campaign, and content tags to its links into the web app and to Google Play, so we can tell which campaign brought you. If you then follow one of those links, the tags reach the web app or Google Play as part of its web address; nothing else from the address you arrived with is passed on. We self-host our fonts, so reading a page sends nothing to a font CDN. One third party does load on every page of this site: Cloudflare Turnstile, the challenge that keeps bots out of our contact and newsletter forms. Cloudflare receives your IP address and basic browser signals to tell a person from a script, and does not use them to advertise to you.

The app stores a sign-in token on your device so you stay logged in. Only while usage measurement is switched on for your account and you are signed in, the apps also keep on your device: the random installation identifier; an identifier and timing for your current session of use and, while the app is open, the screen you are on (so that the next start can tell whether it closed unexpectedly); a short queue of usage events not yet sent; a few technical markers, such as whether sending is paused; and whether you skipped the question about how you heard of us. The web app can also keep campaign tags, and the Android app its install referrer, until they have been sent, as described above. The web app keeps these items in your browser's local storage, and the current session's identifier and timing in that tab's session storage, which the browser clears when the tab is closed. When you sign out, or when the app learns that measurement has been switched off for your account, it stops adding to them and deletes all of these measurement items. None of them is a cookie, but each is information stored on your device, which is why we list them here. Server-side, we use Microsoft Azure Monitor for diagnostics as described above.

Your rights.

You can access, correct, export, or delete your data. In the app, use Settings · Account; for anything the app doesn't cover — including a full export — email privacy@asksommelier.ai. EU and UK residents have the rights granted by the GDPR (including the right to object and to lodge a complaint with a supervisory authority); California residents have the rights granted by the CCPA/CPRA, including the right not to be discriminated against for exercising them. We honor these rights for all users, everywhere.

Age & children.

Sommelier AI is for adults of legal drinking age in their country. It is not directed to, and we do not knowingly collect personal data from, anyone under that age. If you believe a minor has provided us data, contact us and we will remove it.

Changes & contact.

We may update this policy; when we do, we will change the effective date above and, for material changes, notify you in the app or by email. This version adds how we measure the use of the apps: the installation identifier, usage events, how your usage history is de-identified when you delete your account, the Android install referrer, campaign tags on links, the country we keep for subscriptions, and the optional question about how you heard of us. The data controller is IT Solutions & Consulting Services INC, operating as Sommelier AI.

Questions or requests: privacy@asksommelier.ai. We answer within five working days.