Privacy Policy

1. Who We Are

This Privacy Policy explains how Vineflow GmbH, Bälliz 46, 3600 Thun, Switzerland, UID CHE-372.317.584 ("Vineflow", "we", "us", or "our"), collects, uses, discloses, stores, and protects personal data when you use our website, learning platform, digital content, study tools, tastings, bookings, payment flows, and related services.

For the purposes of Swiss data protection law, the EU/UK GDPR where applicable, and similar privacy laws, Vineflow is generally the controller of the personal data described in this Policy.

2. Scope

This Policy applies to users worldwide, including users in Switzerland, the European Economic Area, the United Kingdom, the United States, and Asia-Pacific jurisdictions. Some rights and notices apply only where the relevant local law applies to Vineflow or to your use of the Service.

This Policy should be read together with our Terms of Service and Cookie Policy.

3. Personal Data We Collect

The personal data we collect depends on how you use Vineflow.

Account and Identity Data

• email address;
• display name or name if you provide it;
• Firebase user ID and authentication status;
• login method and authentication metadata;
• password credentials handled by our authentication provider, not stored by Vineflow in plain text.

Learning and Product Data

• the D1, D2, D4 or D5 courses assigned to your account and their access periods;
• learning progress, ratings, attempts, answers, scores, and study activity;
• exam date settings if you choose to add them;
• draft answers, tasting work, flashcard state, and similar study data;
• local draft data stored in your browser for some study features.

Payment and Transaction Data

• Stripe checkout session identifiers and payment status;
• product, price, access period, and purchase history;
• billing details provided through Stripe or another payment provider where needed for receipts, tax, fraud checks, refunds, or chargebacks;
• refund, chargeback, or support information related to a payment.

Vineflow does not store full credit card numbers, card security codes, or bank account credentials. Stripe processes payment method details and related payment data under its own terms and privacy notices.

Booking and Tasting Data

• booking requests, preferred dates, location, group size, and event details;
• contact details for the person arranging a tasting or event;
• dietary, accessibility, alcohol-free, or other preferences you choose to share;
• correspondence, quotes, confirmations, changes, cancellations, and attendance-related information.

Technical, Device, and Usage Data

• IP address, device type, browser, operating system, approximate location derived from technical data;
• security logs, authentication events, error information, and server request data;
• pages or features used, timestamps, and performance information;
• cookies, local storage, session storage, and similar browser technologies described in our Cookie Policy.

Communication and Support Data

• emails you send to us;
• support requests, refund requests, account questions, and related correspondence;
• newsletter or marketing preferences if we offer and you choose to use those features.

4. Sources of Personal Data

We collect personal data from:

• you, when you create an account, purchase access, contact us, or use learning tools;
• your device and browser, when you use the website or platform;
• service providers such as Firebase and Stripe, together with Vineflow-controlled hosting or server infrastructure;
• internal product and security systems that record learning activity, access status, and account events.

5. Why We Use Personal Data

We use personal data to:

• provide, operate, maintain, and secure Vineflow;
• create and authenticate accounts;
• grant, manage, and verify paid access;
• plan, quote, confirm, deliver, reschedule, or cancel tastings, bookings, and other non-digital services;
• process payments, receipts, refunds, chargebacks, and fraud prevention checks;
• save study progress, drafts, attempts, scores, ratings, and exam date settings;
• provide support, respond to questions, and handle refund requests;
• improve content quality, learning tools, reliability, and user experience;
• detect, prevent, and investigate misuse, account sharing, scraping, security incidents, or unlawful use;
• comply with legal, tax, accounting, regulatory, and consumer protection obligations;
• send service notices and, where you have consented or where law allows, optional product updates.
• send newsletters or product updates if we offer them and you subscribe or otherwise consent.

6. Legal Bases Where GDPR or Similar Laws Apply

Where EU, UK, Swiss, or similar data protection laws require a legal basis, we rely on one or more of the following:

• Contract: to provide your account, paid access, learning tools, and support.
• Legitimate interests: to secure the Service, prevent misuse, improve features, maintain records, and communicate about service-related matters.
• Legal obligations: to comply with tax, accounting, consumer protection, sanctions, fraud prevention, and legal request obligations.
• Consent: where we ask for optional consent, such as for non-essential cookies, optional marketing communications, or other consent-based processing.

7. Cookies, Local Storage, and Similar Technologies

Vineflow uses limited cookies, browser storage, and provider-managed storage to make the Service work, keep users signed in, remember preferences, preserve local drafts, and support security. Some study features use local storage on your device so that drafts or temporary quiz work can be restored before submission.

We do not use advertising pixels or third-party audience analytics on Vineflow. Your learning results are saved to show your progress, not to build advertising profiles. If we introduce optional tracking, we will explain what it does and provide the choices required by applicable law before it starts.

Vineflow may link to or maintain social media profiles on Instagram, Facebook, and LinkedIn. If you click a social media link, visit our profile, follow us, comment, like, share, send a direct message, or otherwise interact with us on those platforms, the relevant platform may process your personal data under its own terms and privacy policy. Vineflow may see profile information and interaction data made available by the platform, such as your username, public profile, comments, messages, reactions, and basic engagement statistics.

8. How We Share Personal Data

We share personal data only where needed for the purposes described in this Policy.

• Authentication and database providers: for account login, authentication, data storage, functions, and platform operations, including Google Firebase.
• Payment providers: to process payments, refunds, receipts, and fraud prevention, including Stripe. Stripe may receive and process payment method information, billing details, transaction identifiers, payment status, fraud-prevention data, refunds, chargebacks, and related records under its own terms and privacy notices.
• Hosting and infrastructure: Google Firebase and Google Cloud deliver the website and course API and store account and learning data.
• Email support: messages you send to vineflow25@gmail.com are handled through Gmail. Our contact page opens a draft in your email app; it does not send your message automatically.
• Social media platforms: if you interact with Vineflow through Instagram, Facebook, or LinkedIn, those platforms may process your interaction with us and provide us with limited profile, message, comment, and engagement information.
• Professional advisers: such as accountants, lawyers, auditors, insurers, or tax advisers.
• Authorities or third parties where legally required: to comply with law, enforce rights, protect users, prevent fraud, or respond to lawful requests.
• Business transfers: if Vineflow is involved in a merger, acquisition, restructuring, or sale of assets, subject to appropriate protections.

We do not sell personal data. We do not currently share personal data for cross-context behavioural advertising.

9. International Data Transfers

Vineflow is based in Switzerland, and our service providers may process personal data in Switzerland, the European Economic Area, the United Kingdom, the United States, and other countries where they operate.

Where required, we rely on appropriate safeguards for international transfers, such as adequacy decisions, standard contractual clauses, data processing agreements, or other legally recognised safeguards.

10. Data Retention

We keep personal data only as long as reasonably necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

• Account and learning data are usually kept while your account remains active or while access/support is needed.
• Payment and transaction records may be kept longer for tax, accounting, refund, fraud, and legal reasons.
• Booking and tasting records may be kept as long as needed to deliver the service and maintain tax, accounting, support, or legal records.
• Support messages are kept as long as needed to resolve the issue and maintain appropriate records.
• Security logs are kept for a limited period unless needed to investigate misuse, fraud, or security incidents.
• Local drafts stored in your browser remain on your device until submitted, cleared by the feature, or deleted by you.

11. Security

We use reasonable technical and organisational measures designed to protect personal data, including secure authentication, access controls, limited administrator access, encrypted transport, and reliance on reputable infrastructure providers.

No online service can be guaranteed to be perfectly secure. You are responsible for keeping your login credentials confidential and for using a secure device and email account.

12. Your Privacy Rights

Depending on where you live and which laws apply, you may have the right to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or information about how your personal data is used and shared.

To exercise rights, contact us at vineflow25@gmail.com. We may need to verify your identity before responding. We will respond within the time required by applicable law.

You may also have the right to lodge a complaint with your local data protection authority. If you are in Switzerland, this may include the Federal Data Protection and Information Commissioner. If you are in the EEA or UK, you may contact your local supervisory authority.

13. US State Privacy Notice

This section applies to residents of US states with privacy laws that apply to Vineflow, including California where applicable. Some US state laws apply only to businesses that meet certain revenue, user, or data-sharing thresholds. If a law does not apply to Vineflow, we may still choose to handle requests in a practical and privacy-respectful way.

Categories Collected in the Last 12 Months

• identifiers, such as email address, account ID, IP address, and payment/customer identifiers;
• customer records, such as purchase history, product access, billing records, and support requests;
• commercial information, such as products purchased, refunds, and access status;
• internet or electronic network activity, such as device data, browser data, logs, and feature usage;
• approximate location derived from IP address or service-provider logs;
• inferences related to learning progress, study activity, and product usage;
• sensitive personal information only in limited forms, such as account login credentials handled by our authentication provider and payment information handled by Stripe.

Categories Disclosed for Business Purposes

We may disclose the categories above to service providers and processors for the business purposes described in this Policy, including authentication, hosting, payment processing, support, security, fraud prevention, analytics of service reliability, tax/accounting, and legal compliance.

Sale, Sharing, Targeted Advertising, and Profiling

Vineflow does not sell personal data. Vineflow does not currently share personal data for cross-context behavioural advertising or targeted advertising. Vineflow does not use profiling that produces legal or similarly significant effects.

If these practices change, we will update this notice and provide any legally required consent or opt-out controls before the change takes effect.

US Privacy Rights

Depending on your state and the law that applies, you may have the right to:

• know or confirm whether we process personal data about you;
• access the categories or specific pieces of personal data we hold;
• delete personal data, subject to exceptions;
• correct inaccurate personal data;
• receive a portable copy of personal data you provided;
• opt out of sale, sharing, targeted advertising, or certain profiling, if those practices apply;
• limit certain uses or disclosures of sensitive personal information, where applicable;
• not be discriminated against for exercising privacy rights;
• appeal a denied privacy request where your state law provides an appeal right.

To make a US privacy request or appeal, email us at vineflow25@gmail.com and include your account email, state of residence, and the right you wish to exercise.

Global Privacy Control and Do Not Track

Some browsers or extensions can send a Global Privacy Control signal. Because Vineflow does not currently sell personal data or share it for cross-context behavioural advertising, there is no sale or sharing to opt out of in the current Service. We will review Global Privacy Control support if we add covered advertising or sharing practices.

Browser "Do Not Track" signals are not yet standardised in a consistent way. Vineflow does not currently respond to Do Not Track signals as a separate technical control.

14. Children and Minors

Vineflow is intended for adults and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe that a child under 13 has provided personal data to Vineflow, contact us and we will take appropriate steps to review and delete the data where required.

Users must be at least 18 years old, or the age of legal majority in their place of residence if higher, to create an account or purchase access.

15. Marketing Communications

If we offer newsletters or optional product updates, we will use your contact details only where we have a lawful basis to do so, such as your consent or another basis permitted by law. You can opt out of marketing communications at any time by using the unsubscribe method in the message or by contacting us.

If you follow or interact with Vineflow on Instagram, Facebook, or LinkedIn, you can manage those interactions, notifications, advertising preferences, and visibility settings through the relevant social media platform.

Service emails, security notices, payment receipts, access updates, and support replies are not marketing communications and may still be sent where needed to provide the Service.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify users, such as by updating this page, showing an in-product notice, or sending an email where appropriate.

17. Contact

For privacy questions, data requests, US state privacy requests, or concerns about this Policy, contact Vineflow at vineflow25@gmail.com.