This Privacy Statement explains how Sommelier Studio (“we”, “us”, “the app”) collects, uses, and protects your personal data when you use the service. It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the ePrivacy Directive.
By using Sommelier Studio you acknowledge that you have read this Statement. If you do not agree with it, please do not use the app.
1. Who we are (Data Controller)
The controller responsible for the processing of your personal data is:
- Contact: info@sommelierstudio.be
- Name / address: [to be completed]
For any privacy-related request (access, rectification, erasure, objection, portability, complaint) please contact us at the email address above. We aim to respond within one (1) month, in line with Article 12(3) GDPR.
2. What data we process
Sommelier Studio has two main use cases. The data we process depends on which one applies to you.
2.1 Sommelier (host) accounts
If you create a host account to run tasting sessions, we process:
- Account credentials: email address and password (the password is stored only as a hash by Firebase Authentication, never in clear text).
- Authentication metadata: sign-in timestamps, session tokens, and a unique user ID (UID) generated by Firebase.
2.2 Tasting sessions (host + guests)
When a session is created and guests join it, we process:
- Session metadata: session ID, join code, host display name, creation timestamp, list of wines being tasted.
- Participant data: the display name you enter when you join, a participant ID, and the time you joined.
- Tasting notes you submit: free-text notes, ratings, body / tannin / acidity values, “vibe” selection, grape guess, and a timestamp.
- AI feedback: the score and textual feedback that our AI judge generates from your note (stored alongside the note).
Guests do not need to create an account; only a display name is required.
2.3 Solo practice tastings
If you sign in and use the solo blind-tasting practice mode, we process, linked to your Firebase UID:
- The tasting template you chose (WSET L3 SAT or ASI).
- Your structured tasting note (appearance / nose / palate / conclusion).
- Your identity guess for the wine (grape, country, region, year, producer, location guess).
- The “actual wine” you reveal at the end of the exercise.
- AI feedback (score + commentary) on your performance.
2.4 Wine recommendations
If you use the wine recommender, we process the preferences you submit (country, region, wine type, grape variety, price range, occasion, and a free-text location string). This data is sent to our AI backend in order to generate recommendations and is not associated with your account.
2.5 Technical data
For every request to our AI backend we also process:
- Your browser locale (
navigator.language), used so we can answer in your language. - Standard HTTP metadata that any web server receives (IP address, user-agent, request time). This is processed by our hosting provider for security, abuse prevention, and basic operation.
2.6 Cookies and local storage
Sommelier Studio uses strictly necessary browser storage only:
- Firebase Authentication stores a session token in
localStorage/IndexedDBso that you stay signed in. - We store the result of the age-verification prompt under the key
sommelier-studio:age-verifiedso you don’t have to confirm again on every visit. The value is a single string ("yes") and contains no personal data — you can clear it at any time from your browser settings.
We do not use advertising cookies, tracking pixels, or third-party analytics.
3. Why we process this data (purposes and legal bases)
| Purpose | Categories of data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Operating tasting sessions in real time | Session, participant, and notes data | Art. 6(1)(b) – performance of a contract / service requested by you |
| Authenticating sommelier hosts | Email, password hash, UID | Art. 6(1)(b) – performance of a contract |
| Generating AI feedback, lore, presentations, and recommendations | Tasting notes, wine data, locale, preferences | Art. 6(1)(b) – performance of the service |
| Storing your solo practice history | Practice tastings | Art. 6(1)(b) – at your explicit request |
| Keeping the service secure and abuse-free | Technical metadata (IP, user-agent) | Art. 6(1)(f) – legitimate interest in service security |
| Complying with legal obligations | Any of the above | Art. 6(1)(c) – legal obligation |
We do not use your data for profiling, advertising, or automated decision-making with legal effects.
4. Who has access to your data (recipients)
Your data is shared only with the following categories of processors, acting on our instructions:
- Google Firebase (Google Ireland Ltd. / Google LLC) — Authentication and Realtime Database. Data is stored on Google Cloud infrastructure.
- Google Gemini API (Google) — Our backend sends tasting notes, wine data, preferences, and your locale to the Gemini API in order to generate lore, presentations, feedback, recommendations, and geocoding. Inputs sent to Gemini are subject to Google’s API terms for paid developer use; we do not authorise Google to use your data to train models.
- Our hosting provider (the infrastructure that serves
/api/ai/*requests).
We do not sell your personal data and we do not share it with advertisers.
5. International transfers
Google Firebase and the Gemini API may process data on servers located outside the European Economic Area (EEA), including in the United States. Where data is transferred outside the EEA, this is done under the European Commission’s Standard Contractual Clauses (Decision 2021/914) and applicable supplementary measures, in accordance with Chapter V GDPR.
You can review Google’s transfer safeguards at: https://cloud.google.com/terms/data-processing-addendum.
6. How long we keep your data
| Data | Retention |
|---|---|
| Sommelier account (email, UID) | Until you ask us to delete it. |
| Live session, participants, notes, AI feedback | Stored in Firebase Realtime Database for as long as the session exists. You can ask the host (or us) to delete a session. |
| Solo practice tastings | Until you delete them or close your account. |
| Server logs (IP, user-agent) | Typically up to 30 days, then deleted or anonymised. |
When you close your account, we delete or anonymise your personal data within a reasonable period unless we are legally required to keep it longer (e.g. for accounting or fraud-prevention purposes).
7. Your rights under the GDPR
You have the following rights, free of charge, by emailing info@sommelierstudio.be:
- Access (Art. 15) — receive a copy of the personal data we hold about you.
- Rectification (Art. 16) — have inaccurate data corrected.
- Erasure / “right to be forgotten” (Art. 17) — have your data deleted, subject to legal retention obligations.
- Restriction of processing (Art. 18) — ask us to pause processing.
- Data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Object (Art. 21) — object to processing based on legitimate interest.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with your national supervisory authority. In Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données (https://www.gegevensbeschermingsautoriteit.be). In the Netherlands this is the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl).
8. Security
We take reasonable technical and organisational measures to protect your data.
If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours, and you where required by Art. 34 GDPR.
9. Children
Sommelier Studio is intended for adults of legal drinking age in their jurisdiction. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
10. Notes about real-time session data
Tasting sessions are designed to be shared in real time within the session. This means:
- Other participants in the same session can see the display name you chose, the notes you submit (once released by the host), and your ratings.
- Anyone with the join code for a session can join it. Do not share join codes with people you do not want to participate.
Please do not enter personal data of others, or special-category data (health, religion, political opinions, etc.), into tasting notes.
11. Changes to this Statement
We may update this Privacy Statement from time to time. The “Last updated” date above reflects the most recent version. Material changes will be communicated in the app or by email where appropriate.
12. Contact
Questions, requests, or complaints regarding this Privacy Statement:
