Privacy Policy

This policy explains what personal data Drinksbase collects, why we collect it, who we share it with, and the rights you have over it. It covers the website at drinksbase.net and the application at app.drinksbase.net (together, the “Service”).

1. Who is responsible for your data

The controller of your personal data is Winesoul di Nuno Luís Marreiros, of Corso San Gottardo 74, 6830 Chiasso, Switzerland, tax number CH-501.1.016.416-4.

For any question about this policy or about your data, write to support@drinksbase.net.

2. What we collect

Account and contact data

Name, business email address, password (stored hashed, never in readable form), company name, role, country and language preference, plus anything else you choose to add to your profile.

Product and business content

The product records, brands, certifications, label images and documents, price lists, catalogues and lists you create or upload. This is mostly business data rather than personal data, but it may contain personal data — a winemaker's name on a technical sheet, a contact person on a price list — and it is treated as your data throughout.

Billing data

Billing name, address, tax number, plan, invoices and payment status. Card details are entered directly with our payment provider, Stripe Payments Europe Ltd, and are never stored on our servers.

Technical and usage data

IP address, browser and device type, pages viewed, actions taken in the application, and timestamps. We use this to keep the Service running, to investigate errors and abuse, and to understand which features are used.

Support and correspondence

Messages you send us, and our replies, including any attachments you choose to include.

3. Why we use it, and on what legal basis

To provide the Service — creating your account, storing and serving your product data, generating e-labels, exports and catalogues, and connecting you with other Drinksbase users you choose to connect with. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
To take payment and issue invoices, and to keep the accounting records the law requires us to keep. Legal basis: contract, and legal obligation (Art. 6(1)(b) and (c)).
To keep the Service secure and reliable — monitoring, logging, backups, fraud and abuse prevention. Legal basis: legitimate interests (Art. 6(1)(f)).
To improve the product — aggregate usage statistics that tell us which features earn their place. Legal basis: legitimate interests, or consent where analytics cookies are used.
To send service messages — renewals, security notices, changes to these terms. These are not marketing and you cannot opt out of them while you hold an account. Legal basis: contract.
To send product news, if you asked for it. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time.

4. Automated processing of labels and product text

Two automated services help you fill in and publish product data:

Label image processing — images you upload are processed by Pixian.AI, operated by Cedar Lake Ventures, Inc. (United States), to prepare them for use in the Service.
Translation — product text you choose to translate is sent to OpenAI (United States) to produce the translated version.

In both cases the result is a draft that you review and confirm — nothing is published automatically, and there is no automated decision-making producing legal effects for you within the meaning of Art. 22 GDPR. Both providers are in the United States, so the transfer safeguards in section 7 apply. Neither provider uses your uploads or your product text to train its models. They process what we send them only to return the result we asked for.

5. Data you publish yourself

Some things you create in Drinksbase are meant to be public: e-label pages behind a QR code, public product pages, and your public profile if you enable it. Anything you place there is visible to anyone with the address, and can be indexed by search engines and copied by third parties.

E-label pages are hosted permanently, including after you cancel a paid plan, because a printed QR code on a bottle in circulation has to keep resolving. If you need a specific e-label taken down, contact us — but be aware that removing it may break the mandatory information link on bottles already on the market, which is a decision for you to take.

We do not sell personal data. We share it only with:

Other Drinksbase users you choose — when you accept a connection or share a list with an importer, distributor, venue or institutional partner, the data in that list becomes visible to them. You control which lists you share and with whom.
Service providers acting on our instructions (processors) — hosting, email delivery, payment processing, error monitoring, automated extraction and analytics. The current list is:
- Vercel Inc. (United States) — hosting and site analytics;
- Supabase — database and file storage;
- Stripe Payments Europe Ltd (Ireland) — payment processing;
- Resend — delivery of service and account emails;
- Cedar Lake Ventures, Inc. / Pixian.AI (United States) — label image processing;
- OpenAI (United States) — translation of product text.
Authorities, where we are legally required to disclose.
An acquirer, if the business is sold or merged — in which case you will be told before your data is transferred.

7. Transfers outside the EEA

The Service is hosted on Vercel (Vercel Inc., United States) and runs in Vercel's France region, so day-to-day serving happens inside the EU. Some providers listed above may process data outside the European Economic Area. Where they do, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses, together with additional safeguards where required. You can ask us for a copy of the safeguards that apply to a specific transfer.

8. How long we keep it

Account and product data — for as long as your account is open.
After you close your account — deleted or anonymised within 30 days, except for published e-label pages, which remain available as described in section 5, and anything we must keep by law.
Invoices and accounting records — ten years from the end of the financial year they belong to, the retention period Swiss law sets for business records in Art. 958f of the Code of Obligations. Swiss VAT law requires the same ten years.
Server and security logs — 3 months.
Backups — overwritten on a rolling 90 day cycle.

9. Your rights

Under the GDPR you may ask us to:

confirm what data we hold about you, and give you a copy (access);
correct data that is wrong or incomplete (rectification);
delete data we no longer have grounds to keep (erasure);
restrict processing while a dispute is resolved;
send your data to you or another provider in a machine-readable format (portability);
stop processing based on legitimate interests (objection);
withdraw a consent you gave, without affecting what was done before you withdrew it.

Write to support@drinksbase.net and we will respond within one month. If you are not satisfied, you can complain to a supervisory authority. We are established in Switzerland, so the Swiss Federal Data Protection and Information Commissioner (FDPIC) is competent for us; if you are in the EEA, you may instead complain to the data protection authority of the country where you live or work.

Because we are established in Switzerland and offer the Service to customers in the EEA, both the Swiss Federal Act on Data Protection (FADP) and the GDPR apply to this processing. Where the two differ, we apply the stricter standard.

10. Cookies and similar technologies

The site shows a cookie banner on your first visit and remembers your choice. We use:

Strictly necessary cookies — your session, your language, and your cookie choice itself. These do not require consent and cannot be switched off.
Analytics — aggregate traffic measurement through Vercel Analytics. The script is not present on the page until you accept; if you decline, or ignore the banner, it is never loaded.

You can change your mind at any time by clearing this site's data in your browser, which makes the banner appear again. E-label pages carrying mandatory product information do not carry marketing or tracking.

11. Security

Data is transmitted over TLS and stored on infrastructure with access control, logging and regular backups. Passwords are hashed. Access to production data is limited to the people who need it to run the Service. No system is perfectly secure, but if a breach affects your personal data and is likely to result in a risk to you, we will notify you and the supervisory authority as the GDPR requires.

12. Children

The Service is a business tool sold to companies and is not directed at children. We do not knowingly collect data from anyone under 16.

13. Changes to this policy

When we change this policy we update the version and date at the top. If a change materially affects how we handle your data, we will tell you by email or in the application before it takes effect.

14. Contact

Winesoul di Nuno Luís Marreiros · Corso San Gottardo 74, 6830 Chiasso, Switzerland · support@drinksbase.net