Privacy policy

Last updated: October 22, 2026

In the event of any discrepancy between translations, the French version of this policy prevails.

1. Data controller

The controller of the data collected by the Carnet de dégustation app is Présence SARL, 7 rue Andrieux, 75008 Paris, France (SIREN 523 573 566), represented by Mr Guingamp.

For any question about your personal data: bonjour@lescarnetsdedegustations.fr.

2. Data collected and purposes

The app is used to keep your personal tasting notebook. It processes:

  • your email address, your name if you provide it, and your password (stored only in encrypted form): to manage your account;
  • your tastings: dates, places, titles, wines, ratings and comments;
  • your photos (labels and photos of the moment, in their original and retouched versions);
  • your audio recordings, that is your voice, and their transcription;
  • your phone’s location at the time of a tasting, only if you allow it, as well as the date and place recorded in a photo you import;
  • the internet address (IP address) of the device trying to sign in, create an account or reset a password: only to block repeated attempts (5 attempts per quarter of an hour), deleted within 24 hours at most.

The app is reserved for adults (18 or older), which everyone confirms when creating their notebook.

Your photos, recordings and texts are sent to an artificial intelligence service to read the label, transcribe your dictation and pre-fill the wine’s record. This service is configured to refuse any reuse of your data for training purposes.

When you ask to “Learn more about this wine”, only the name of the wine (estate, cuvée, appellation, vintage) is sent to an internet search engine, through the same artificial intelligence service. No information about you accompanies this search.

The map of your tastings is drawn by your browser from map tiles downloaded from OpenFreeMap: this service receives your device’s internet address, as with any web page, but no data from your notebook.

Your notebook is strictly private: nobody but you has access to it. A tasting is only made public if you choose to share it, as an image whose content you decide.

3. Legal basis for processing

  • Performance of the contract (the terms of use you accept when creating your notebook): managing your account, keeping your notebook (tastings, photos, recordings, ratings), automatic reading of labels and dictations, the “Learn more” search and the map.
  • Consent: use of your phone’s location, camera and microphone, which your phone asks you to allow and which you can withdraw at any time in its settings; signing in with Google, if you choose it.
  • Legitimate interest: the security of the service (blocking repeated sign-in attempts, database backups).

4. Processors and recipients

To provide this service, we use third-party processors. Each processor only handles the data strictly necessary for its task, under a contract compliant with Article 28 of the GDPR.

Vercel Inc.

440 N Barranca Ave #4133, Covina, CA 91723, USA

Outside EU
Purpose
Hosting and serverless function execution (Frankfurt region - fra1)
Data processed
  • IP addresses
  • Server logs
  • Session cookies
Retention
30 days for logs
Legal basis
Legitimate interest (Art. 6.1.f GDPR)
Transfer / details
Standard Contractual Clauses (SCC). Functions run in the EU (Frankfurt) but legal entity is US-based
Learn more
Privacy policyData processing agreement (DPA)

Databricks, Inc. (Neon)

160 Spear Street, 13th Floor, San Francisco, CA 94105, USA

Outside EU
Purpose
PostgreSQL database hosting
Data processed
  • All application data stored in the database
Retention
Account lifetime (deletion on request)
Legal basis
Contract performance (Art. 6.1.b GDPR)
Transfer / details
Standard Contractual Clauses (SCC). Database region configurable (eu-central-1 available)
Learn more
Privacy policyData processing agreement (DPA)

Resend Inc.

2261 Market Street #4667, San Francisco, CA 94114, USA

Outside EU
Purpose
Transactional email delivery
Data processed
  • Recipient email
  • Content of sent emails
Retention
30 days for delivery logs
Legal basis
Contract performance / legitimate interest
Transfer / details
Standard Contractual Clauses (SCC)
Learn more
Privacy policyData processing agreement (DPA)

Cloudflare, Inc.

101 Townsend Street, San Francisco, CA 94107, USA

Outside EU
Purpose
File storage and distribution (uploaded binary objects)
Data processed
  • User-uploaded files
  • Metadata (name, MIME type, size)
Retention
Account lifetime (deletion on request)
Legal basis
Contract performance (Art. 6.1.b GDPR)
Transfer / details
Standard Contractual Clauses (SCC)
Learn more
Privacy policy

OpenRouter, Inc.

1111B S Governors Ave STE 27308, Dover, DE 19904, USA

Outside EU
Purpose
Routing AI calls to the selected models (label reading, dictation transcription, wine information search)
Data processed
  • Content submitted to AI features: label photos, recordings, texts
Retention
Varies with the model provider ultimately reached. Requests are routed to providers that do not use the data for training
Legal basis
Performance of the contract / legitimate interest (depending on the feature)
Transfer / details
Standard contractual clauses (SCC)
Learn more
Privacy policyData processing agreement (DPA)

OpenStreetMap Foundation (service Nominatim)

St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, Royaume-Uni

Outside EU
Purpose
Converting the GPS coordinates of a tasting into a place name (reverse geocoding), only if the user allows location access
Data processed
  • Approximate GPS coordinates (5 decimal places)
  • IP address of the server (not the user’s)
Retention
Technical logs kept for a few days at most by the service
Legal basis
Consent (location permission in the browser, Art. 6.1.a GDPR)
Transfer / details
European Commission adequacy decision for the United Kingdom
Learn more
Privacy policy

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Irlande

EU
Purpose
Authentication via Google account (OAuth)
Data processed
  • Email
  • Name
  • Profile picture
Retention
User account lifetime
Legal basis
Consent (Art. 6.1.a GDPR)
Transfer / details
Possible transfers to Google LLC (USA) via Standard Contractual Clauses
Learn more
Privacy policy

OpenFreeMap

Projet open source, serveurs dédiés en Hongrie (UE)

EU
Purpose
Map rendering: vector tiles are loaded directly by the visitor's browser
Data processed
  • Visitor IP address
  • Map area being viewed
Retention
No retention announced beyond the server's technical logs
Legal basis
Legitimate interest (Art. 6.1.f GDPR)
Transfer / details
No transfer outside the EU. Open source project with no formal data processing agreement: no data is sent to it deliberately, only the visitor's IP reaches it, as with any resource loaded from another domain
Learn more
Privacy policy

Cloudflare, Inc.

101 Townsend Street, San Francisco, CA 94107, USA

Outside EU
Purpose
Domain name management (DNS) and forwarding of emails received on that domain to the destination mailbox (Email Routing)
Data processed
  • DNS queries
  • Sender and recipient addresses
  • Content of forwarded messages
Retention
For the time it takes to forward the message to its destination
Legal basis
Contract performance (Art. 6.1.b GDPR)
Transfer / details
Standard Contractual Clauses (SCC)
Learn more
Privacy policyData processing agreement (DPA)

5. Retention period

Your data is kept for as long as your account exists. When you delete a tasting, its photos and recordings are erased immediately. When you delete your account (from Settings), your whole notebook is erased immediately and permanently. Database backups are renewed automatically and disappear after nine months at most.

6. Your rights

Under the GDPR, you have the following rights over your data:

  • Right of access and rectification
  • Right to erasure (right to be forgotten)
  • Right to data portability
  • Right to object and to restrict processing
  • Right to withdraw your consent at any time (where processing is based on consent)
  • Right to lodge a complaint with the CNIL (French data protection authority) (cnil.fr)

To exercise your rights: bonjour@lescarnetsdedegustations.fr. We undertake to reply within one month at most.

7. Cookies

This site only uses cookies that are strictly necessary for it to work (session, language). No advertising or profiling cookies are set.

If an audience measurement feature requiring consent is ever enabled, a consent banner will be shown before any non-essential cookie is set.

8. Changes

This policy may be updated to reflect changes in the services and processors used. The date of the last update is shown at the top of this page. Substantial changes will be notified by email to account holders.

Alcohol abuse is dangerous for your health. Please drink responsibly.