Privacy Policy

1. Who we are

CaveLivre is operated by Brendan Maguire, an individual developer based in Perth, Western Australia, Australia ("we", "us", "our"). Contact: [email protected].

Our server infrastructure is hosted in Helsinki, Finland (European Union) with Hetzner Online GmbH. Because our servers are in the EU, the General Data Protection Regulation (GDPR) applies to how we process personal data, in addition to the Australian Privacy Act 1988 (Cth).

2. What we collect

Account data

• Name and email address (provided at registration)
• Hashed password (bcrypt, cost factor 12 — we never see your actual password)
• Account creation date, last login, email verification status

Cellar & tasting data

• Wine records you enter: name, producer, vintage, region, variety, purchase price, notes, ratings
• Tasting notes, occasion records, and guest lists you create
• Photos you upload (wine labels, tasting photos)

Usage data

• Server access logs (IP address, request path, timestamp, HTTP status) — retained for 7 days
• Error logs for debugging purposes — retained for 30 days

Payment data

Payments are processed by Apple (App Store) or Google (Play Store). We do not receive or store your credit card number. We receive only a subscription status signal from the platform.

3. How we use your data

• Providing the service — authenticating you, storing your cellar, generating AI sommelier recommendations
• Transactional email — email verification, password reset, subscription notifications
• Security & abuse prevention — rate limiting, fraud detection, debugging
• Legal compliance — retaining records as required by Australian law

We do not sell your personal data. We do not use your data for advertising. We do not build behavioural profiles.

Legal basis (GDPR): Processing is necessary for the performance of a contract (your subscription); legitimate interests (security, fraud prevention); and compliance with legal obligations.

4. Data processors

All US-based processors operate under EU Standard Contractual Clauses and/or are covered by Australian Privacy Act cross-border data transfer provisions.

5. Data retention

• Account and cellar data: retained while your account is active
• Deleted wines: soft-deleted, purged after 90 days
• Server access logs: 7 days
• Error logs: 30 days
• On account deletion: all personal data deleted within 30 days, except records required for legal compliance (e.g. billing history, 7 years under Australian tax law)

6. Your rights

Under the Australian Privacy Act 1988 and GDPR you have the right to:

• Access — request a copy of your personal data
• Correction — correct inaccurate data (via account settings or by emailing us)
• Portability — export your cellar as CSV or JSON (available in Settings → Export)
• Erasure — delete your account and all associated data
• Restriction — request we restrict processing in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

To exercise any right, email [email protected]. We will respond within 30 days (GDPR requires 1 month).

If you are in the EU/EEA and believe we have not adequately addressed your concern, you may lodge a complaint with your local supervisory authority. If you are in Australia, you may contact the Office of the Australian Information Commissioner (OAIC).

California residents (CCPA): We do not sell personal information. You have the right to know what data we hold and to request deletion. Contact us at [email protected].

7. Cookies & local storage

CaveLivre uses only essential cookies:

We do not use third-party analytics (no Google Analytics, no Mixpanel). We do not use advertising cookies. No consent banner is required because we use only strictly necessary cookies.

8. AI & automated decisions

The Sommelier recommendation feature sends your wine inventory data (names, vintages, varieties, regions — not your personal contact details) to Anthropic's Claude API to generate personalised wine pairings and recommendations.

Wine label scanning uses Anthropic's vision API — the photo you take is transmitted to Anthropic for analysis and is not stored by Anthropic beyond the duration of the API call (per Anthropic's data processing terms).

No fully automated decisions with legal or similarly significant effects are made about you.

9. Children

CaveLivre is an alcohol-related application and is intended only for adults of legal drinking age in their jurisdiction (18+ in Australia). We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact us and we will delete the account immediately.

10. Contact & updates

Privacy enquiries: [email protected]

We may update this policy from time to time. Material changes will be notified by email. Continued use of the service after the effective date constitutes acceptance.