This Privacy Statement explains how Sommelier Studio (“we”, “us”, “the app”) collects, uses, and protects your personal data when you use the service. It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the ePrivacy Directive.
By using Sommelier Studio you acknowledge that you have read this Statement. If you do not agree with it, please do not use the app.
1. Who we are (Data Controller)
The controller responsible for the processing of your personal data is:
- Contact: info@sommelierstudio.be
- Name / address: [to be completed]
For any privacy-related request (access, rectification, erasure, objection, portability, complaint) please contact us at the email address above. We aim to respond within one (1) month, in line with Article 12(3) GDPR.
2. What data we process
Sommelier Studio has two main use cases. The data we process depends on which one applies to you.
2.1 Sommelier (host) accounts
If you create a host account to run tasting sessions, we process:
- Account credentials: email address and password (the password is stored only as a hash by Firebase Authentication, never in clear text).
- Authentication metadata: sign-in timestamps, session tokens, and a unique user ID (UID) generated by Firebase.
2.2 Tasting sessions (host + guests)
When a session is created and guests join it, we process:
- Session metadata: session ID, join code, host display name, creation timestamp, list of wines being tasted.
- Participant data: the display name you enter when you join, a participant ID, and the time you joined.
- Tasting notes you submit: free-text notes, ratings, body / tannin / acidity values, “vibe” selection, grape guess, and a timestamp.
- AI feedback: the score and textual feedback that our AI judge generates from your note (stored alongside the note).
Guests do not need to create an account; only a display name is required.
2.3 Solo practice tastings
If you sign in and use the solo blind-tasting practice mode, we process, linked to your Firebase UID:
- The tasting template you chose (WSET L3 SAT or ASI).
- Your structured tasting note (appearance / nose / palate / conclusion).
- Your identity guess for the wine (grape, country, region, year, producer, location guess).
- The “actual wine” you reveal at the end of the exercise.
- AI feedback (score + commentary) on your performance.
2.4 Voice recordings (optional)
In solo practice you can choose to dictate your tasting note instead of typing it. This only starts when you press the record button and, if prompted, allow your browser to use the microphone. When you use it, we process:
- A short audio recording of what you say, captured in your browser and sent to our backend when you stop recording.
- A text transcript of that recording, and the tasting-note fields (e.g. colour, intensity, aromas) our AI extracts from it to fill in your tasting grid.
- Your browser locale, used as a language hint for transcription.
The audio recording is used only to produce the transcript. We do not store the audio or the transcript in our database or on our servers (our AI provider may keep a short-lived log, see section 4); only the tasting-note fields that end up in your grid are saved, in the same way as if you had typed them. We do not use voice recordings to identify you or for any biometric purpose. Voice dictation is available to signed-in users only, and you can use solo practice without it. Please avoid mentioning other people or personal details while recording.
2.5 Wine recommendations
If you use the wine recommender, we process the preferences you submit (country, region, wine type, grape variety, price range, occasion, and a free-text location string). This data is sent to our AI backend in order to generate recommendations and is not associated with your account.
2.6 Technical data
For every request to our AI backend we also process:
- Your browser locale (
navigator.language), used so we can answer in your language. - Standard HTTP metadata that any web server receives (IP address, user-agent, request time). This is processed by our hosting provider for security, abuse prevention, and basic operation.
2.7 Cookies and local storage
Sommelier Studio uses strictly necessary browser storage only:
- Firebase Authentication stores a session token in
localStorage/IndexedDBso that you stay signed in. - We store the result of the age-verification prompt under the key
sommelier-studio:age-verifiedso you don’t have to confirm again on every visit. The value is a single string ("yes") and contains no personal data — you can clear it at any time from your browser settings. - To make the app work as expected, we also keep a small amount of
functional data in
localStorage: the join details of the tasting session you are in (so you can rejoin after a refresh) and your in-progress solo practice tasting (so you can resume it). This stays on your device and can be cleared at any time from your browser settings.
We do not use advertising cookies, tracking pixels, or third-party analytics.
3. Why we process this data (purposes and legal bases)
| Purpose | Categories of data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Operating tasting sessions in real time | Session, participant, and notes data | Art. 6(1)(b) – performance of a contract / service requested by you |
| Authenticating sommelier hosts | Email, password hash, UID | Art. 6(1)(b) – performance of a contract |
| Generating AI feedback, lore, presentations, and recommendations | Tasting notes, wine data, locale, preferences | Art. 6(1)(b) – performance of the service |
| Storing your solo practice history | Practice tastings | Art. 6(1)(b) – at your explicit request |
| Transcribing your dictated tasting note and filling in your tasting grid | Audio recording, transcript, locale | Art. 6(1)(b) – performance of the service you request; you start each recording yourself and may use typing instead |
| Keeping the service secure and abuse-free | Technical metadata (IP, user-agent) | Art. 6(1)(f) – legitimate interest in service security |
| Complying with legal obligations | Any of the above | Art. 6(1)(c) – legal obligation |
We do not use your data for profiling, advertising, or automated decision-making with legal effects.
4. Who has access to your data (recipients)
Your data is shared only with the following categories of processors, acting on our instructions:
- Google Firebase (Google Ireland Ltd. / Google LLC) — Authentication and Realtime Database. Data is stored on Google Cloud infrastructure.
- Google Gemini API (Google) — Our backend sends tasting notes, wine data, preferences, your locale, and — if you use voice dictation — your audio recording to the Gemini API in order to generate lore, presentations, feedback, recommendations, geocoding, and transcripts of your dictated tasting notes. Inputs sent to Gemini are subject to Google’s API terms for paid developer use. Google acts as our processor under its Data Processing Addendum (https://business.safety.google/processorterms/), does not use your inputs or generated responses — including audio recordings — to improve its products or train models, and keeps logs of prompts and responses for a limited period solely to detect and prevent abuse and to meet legal or regulatory disclosure requirements.
- Our hosting provider (the infrastructure that serves
/api/ai/*requests).
We do not sell your personal data and we do not share it with advertisers.
5. International transfers
Google Firebase and the Gemini API may process data on servers located outside the European Economic Area (EEA), including in the United States. Google may also store or cache inputs sent to the Gemini API transiently in any country where it or its agents maintain facilities. Where data is transferred outside the EEA, this is done under the European Commission’s Standard Contractual Clauses (Decision 2021/914) and applicable supplementary measures, in accordance with Chapter V GDPR.
You can review Google’s transfer safeguards at: https://cloud.google.com/terms/data-processing-addendum.
6. How long we keep your data
| Data | Retention |
|---|---|
| Sommelier account (email, UID) | Until you ask us to delete it. |
| Live session, participants, notes, AI feedback | Stored in Firebase Realtime Database for as long as the session exists. You can ask the host (or us) to delete a session. |
| Solo practice tastings | Until you delete them or close your account. |
| Voice recordings and transcripts | Not stored by us. The audio is processed only to return a transcript and is not kept in our database or on our servers. Our AI provider (Google) may keep a log of the audio and transcript for a limited period solely for abuse prevention and legal obligations (see section 4). |
| Server logs (IP, user-agent) | Typically up to 30 days, then deleted or anonymised. |
When you close your account, we delete or anonymise your personal data within a reasonable period unless we are legally required to keep it longer (e.g. for accounting or fraud-prevention purposes).
7. Your rights under the GDPR
You have the following rights, free of charge, by emailing info@sommelierstudio.be:
- Access (Art. 15) — receive a copy of the personal data we hold about you.
- Rectification (Art. 16) — have inaccurate data corrected.
- Erasure / “right to be forgotten” (Art. 17) — have your data deleted, subject to legal retention obligations.
- Restriction of processing (Art. 18) — ask us to pause processing.
- Data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Object (Art. 21) — object to processing based on legitimate interest.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with your national supervisory authority. In Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données (https://www.gegevensbeschermingsautoriteit.be). In the Netherlands this is the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl).
8. Security
We take reasonable technical and organisational measures to protect your data.
If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours, and you where required by Art. 34 GDPR.
9. Children
Sommelier Studio is intended for adults of legal drinking age in their jurisdiction. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
10. Notes about real-time session data
Tasting sessions are designed to be shared in real time within the session. This means:
- Other participants in the same session can see the display name you chose, the notes you submit (once released by the host), and your ratings.
- Anyone with the join code for a session can join it. Do not share join codes with people you do not want to participate.
Please do not enter personal data of others, or special-category data (health, religion, political opinions, etc.), into tasting notes.
11. Changes to this Statement
We may update this Privacy Statement from time to time. The “Last updated” date above reflects the most recent version. Material changes will be communicated in the app or by email where appropriate.
12. Contact
Questions, requests, or complaints regarding this Privacy Statement:
