Privacy Policy

Last updated: 14 October 2026

This Privacy Policy explains what personal data WineApp (wineapp.ge) collects, why, who we share it with, and your rights. It follows the Law of Georgia on Personal Data Protection and, where applicable, the EU General Data Protection Regulation (GDPR).

Data controller: Individual Entrepreneur Levan Kurdiani (identification code 01017037408), 2 Vukol Beridze St., Tbilisi, Georgia. Privacy contact: info@wineapp.ge.

1. Data We Collect

Account data: name, email address, password (stored only as a secure hash), winery profile, preferred language and theme, and sign-in security events.

Team data: names and email addresses of team members a winery owner invites, and their roles.

Winery data: rooms, vessels, wines, bottled wines, laboratory analyses, sales, collections, bottles, and notes you enter.

Images: photos you upload (for example bottle and label photos) and the processed versions we create.

Billing data: plan, subscription status, credit balance and usage, payment amounts and statuses, and our payment provider's order and transaction identifiers. Card details are entered on the payment provider's page and are never received or stored by WineApp.

Technical data: IP address, browser and device information, and error logs needed to secure and troubleshoot the service.

Communications: messages you send us by email or through the in-app assistant.

2. Why We Process Data

We process data to create and secure accounts, provide the winery management and AI features you use, enforce plan limits and credits, manage subscriptions and billing, send service emails (such as verification, password reset, and billing notices), provide support, fix errors, and meet legal obligations. The legal bases are performance of our contract with you, our legitimate interest in running and securing the service, legal obligations, and your consent where we ask for it. We do not send marketing emails without consent.

3. AI and Image Processing

When you use label reading, the label image is sent to an AI provider (Google Gemini, or Microsoft Azure AI where enabled) to extract text. When you use background removal or object detection, the photo is sent to Replicate or fal.ai. Images are sent only when you trigger these features and only to produce the result. These providers act as our processors under their business API terms: they may not use your images or results to train their AI models, and they keep them only temporarily, for as long as needed to return the result and for limited abuse and security monitoring under their terms, after which they are deleted. The result (the extracted text or processed photo) is saved in your WineApp account and kept until you delete it or your account is deleted, as described in section 7. We do not use your data to train AI models, and we do not sell it.

4. Service Providers (Processors)

We share personal data only with providers that help us run WineApp, under contracts that restrict their use of the data:

UniPAY (Georgia): card payment processing and refunds.

Vultr (Vultr Holdings LLC, USA): application servers, PostgreSQL database and Redis, hosted in its Warsaw, Poland (EU) data center.

Cloudflare (USA): content delivery, security, and image storage (Cloudflare R2).

Resend and Google (USA): delivery of account and billing emails.

Google (Gemini), Microsoft (Azure AI, where enabled), Replicate, and fal.ai (USA): label reading and image processing.

Sentry (USA): error monitoring, where enabled.

5. International Transfers

Your account and winery data are stored on our servers in Warsaw, Poland (European Union). Card payments are processed by UniPAY in Georgia. Some providers listed in section 4 (Cloudflare, Google, Microsoft, Resend, Replicate, fal.ai and Sentry) process data in the United States or on their global networks. Under the Law of Georgia on Personal Data Protection, EU and EEA countries are considered to provide an adequate level of data protection. Transfers to the United States and other countries rely on the providers' data processing agreements containing standard contractual clauses, on the EU-US Data Privacy Framework where the provider is certified, and, where applicable, on the transfer being necessary to perform our contract with you (for example, to run a feature you requested).

6. Cookies and Local Storage

We use only strictly necessary cookies and browser storage to keep you signed in, protect forms against forgery, and remember your language, theme, and view preferences. We do not use advertising or third-party analytics cookies. The UniPAY payment page may set its own cookies, governed by its privacy policy.

7. Retention

We keep account and winery data while your account is active. When you delete your account, it is deactivated immediately and permanently deleted 30 days later together with uploaded images; until then you can restore it from the link we email you. Copies in backups are overwritten on their normal rotation. Records a staff member created belong to the winery, so a deleted staff account is anonymized on those records instead. Payment records (amounts, dates, and order references) are kept for as long as Georgian tax and accounting law requires. Items you move to the recycle bin can be restored until you empty it.

8. Security

We use encrypted connections (HTTPS), hashed passwords, per-account data isolation, access controls, and least-privilege server access. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.

9. Your Rights

Under the Law of Georgia on Personal Data Protection, and the GDPR where it applies, you may request access to, correction, deletion, restriction, or a portable copy of your personal data, object to processing, and withdraw consent at any time. You can delete your account yourself from your Profile page. To exercise the other rights, email info@wineapp.ge from your account email address. We provide information about your data and copies of it, and review and carry out requests for correction or deletion, no later than 10 business days after receiving the request, subject to the exceptions provided by law. In exceptional cases, the deadline for providing information and copies may be extended by a maximum of 10 additional business days, with proper justification and immediate notice to you. If you opt out of direct marketing, we stop it no later than 7 business days after your request. In the event of a violation of your rights regarding the processing of personal data, you may appeal to the State Audit Office of Georgia or the court, as well as, where applicable, the data protection authority of your country.

10. Children

WineApp is a business tool for adults and is not directed to anyone under 18. We do not knowingly collect personal data from minors.

11. Changes to This Policy

We may update this policy. For material changes we will notify you by email or in the app, and the date at the top of this page always shows the latest version.

Supervisory Authority: State Audit Office of Georgia.