Privacy policy
Last updated: October 22, 2026
In the event of any discrepancy between translations, the French version of this policy prevails.
1. Data controller
The controller of the data collected by the Carnet de dégustation app is Présence SARL, 7 rue Andrieux, 75008 Paris, France (SIREN 523 573 566), represented by Mr Guingamp.
For any question about your personal data: bonjour@lescarnetsdedegustations.fr.
2. Data collected and purposes
The app is used to keep your personal tasting notebook. It processes:
- your email address, your name if you provide it, and your password (stored only in encrypted form): to manage your account;
- your tastings: dates, places, titles, wines, ratings and comments;
- your photos (labels and photos of the moment, in their original and retouched versions);
- your audio recordings, that is your voice, and their transcription;
- your phone’s location at the time of a tasting, only if you allow it, as well as the date and place recorded in a photo you import;
- the internet address (IP address) of the device trying to sign in, create an account or reset a password: only to block repeated attempts (5 attempts per quarter of an hour), deleted within 24 hours at most.
The app is reserved for adults (18 or older), which everyone confirms when creating their notebook.
Your photos, recordings and texts are sent to an artificial intelligence service to read the label, transcribe your dictation and pre-fill the wine’s record. This service is configured to refuse any reuse of your data for training purposes.
When you ask to “Learn more about this wine”, only the name of the wine (estate, cuvée, appellation, vintage) is sent to an internet search engine, through the same artificial intelligence service. No information about you accompanies this search.
The map of your tastings is drawn by your browser from map tiles downloaded from OpenFreeMap: this service receives your device’s internet address, as with any web page, but no data from your notebook.
Your notebook is strictly private: nobody but you has access to it. A tasting is only made public if you choose to share it, as an image whose content you decide.
3. Legal basis for processing
- Performance of the contract (the terms of use you accept when creating your notebook): managing your account, keeping your notebook (tastings, photos, recordings, ratings), automatic reading of labels and dictations, the “Learn more” search and the map.
- Consent: use of your phone’s location, camera and microphone, which your phone asks you to allow and which you can withdraw at any time in its settings; signing in with Google, if you choose it.
- Legitimate interest: the security of the service (blocking repeated sign-in attempts, database backups).
4. Processors and recipients
To provide this service, we use third-party processors. Each processor only handles the data strictly necessary for its task, under a contract compliant with Article 28 of the GDPR.
Vercel Inc.
440 N Barranca Ave #4133, Covina, CA 91723, USA
- Purpose
- Hosting and serverless function execution (Frankfurt region - fra1)
- Data processed
- IP addresses
- Server logs
- Session cookies
- Retention
- 30 days for logs
- Legal basis
- Legitimate interest (Art. 6.1.f GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). Functions run in the EU (Frankfurt) but legal entity is US-based
- Learn more
- Privacy policyData processing agreement (DPA)
Databricks, Inc. (Neon)
160 Spear Street, 13th Floor, San Francisco, CA 94105, USA
- Purpose
- PostgreSQL database hosting
- Data processed
- All application data stored in the database
- Retention
- Account lifetime (deletion on request)
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). Database region configurable (eu-central-1 available)
- Learn more
- Privacy policyData processing agreement (DPA)
Resend Inc.
2261 Market Street #4667, San Francisco, CA 94114, USA
- Purpose
- Transactional email delivery
- Data processed
- Recipient email
- Content of sent emails
- Retention
- 30 days for delivery logs
- Legal basis
- Contract performance / legitimate interest
- Transfer / details
- Standard Contractual Clauses (SCC)
- Learn more
- Privacy policyData processing agreement (DPA)
Cloudflare, Inc.
101 Townsend Street, San Francisco, CA 94107, USA
- Purpose
- File storage and distribution (uploaded binary objects)
- Data processed
- User-uploaded files
- Metadata (name, MIME type, size)
- Retention
- Account lifetime (deletion on request)
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC)
- Learn more
- Privacy policy
OpenRouter, Inc.
1111B S Governors Ave STE 27308, Dover, DE 19904, USA
- Purpose
- Routing AI calls to the selected models (label reading, dictation transcription, wine information search)
- Data processed
- Content submitted to AI features: label photos, recordings, texts
- Retention
- Varies with the model provider ultimately reached. Requests are routed to providers that do not use the data for training
- Legal basis
- Performance of the contract / legitimate interest (depending on the feature)
- Transfer / details
- Standard contractual clauses (SCC)
- Learn more
- Privacy policyData processing agreement (DPA)
OpenStreetMap Foundation (service Nominatim)
St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, Royaume-Uni
- Purpose
- Converting the GPS coordinates of a tasting into a place name (reverse geocoding), only if the user allows location access
- Data processed
- Approximate GPS coordinates (5 decimal places)
- IP address of the server (not the user’s)
- Retention
- Technical logs kept for a few days at most by the service
- Legal basis
- Consent (location permission in the browser, Art. 6.1.a GDPR)
- Transfer / details
- European Commission adequacy decision for the United Kingdom
- Learn more
- Privacy policy
Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Irlande
- Purpose
- Authentication via Google account (OAuth)
- Data processed
- Name
- Profile picture
- Retention
- User account lifetime
- Legal basis
- Consent (Art. 6.1.a GDPR)
- Transfer / details
- Possible transfers to Google LLC (USA) via Standard Contractual Clauses
- Learn more
- Privacy policy
OpenFreeMap
Projet open source, serveurs dédiés en Hongrie (UE)
- Purpose
- Map rendering: vector tiles are loaded directly by the visitor's browser
- Data processed
- Visitor IP address
- Map area being viewed
- Retention
- No retention announced beyond the server's technical logs
- Legal basis
- Legitimate interest (Art. 6.1.f GDPR)
- Transfer / details
- No transfer outside the EU. Open source project with no formal data processing agreement: no data is sent to it deliberately, only the visitor's IP reaches it, as with any resource loaded from another domain
- Learn more
- Privacy policy
Cloudflare, Inc.
101 Townsend Street, San Francisco, CA 94107, USA
- Purpose
- Domain name management (DNS) and forwarding of emails received on that domain to the destination mailbox (Email Routing)
- Data processed
- DNS queries
- Sender and recipient addresses
- Content of forwarded messages
- Retention
- For the time it takes to forward the message to its destination
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC)
- Learn more
- Privacy policyData processing agreement (DPA)
5. Retention period
Your data is kept for as long as your account exists. When you delete a tasting, its photos and recordings are erased immediately. When you delete your account (from Settings), your whole notebook is erased immediately and permanently. Database backups are renewed automatically and disappear after nine months at most.
6. Your rights
Under the GDPR, you have the following rights over your data:
- Right of access and rectification
- Right to erasure (right to be forgotten)
- Right to data portability
- Right to object and to restrict processing
- Right to withdraw your consent at any time (where processing is based on consent)
- Right to lodge a complaint with the CNIL (French data protection authority) (cnil.fr)
To exercise your rights: bonjour@lescarnetsdedegustations.fr. We undertake to reply within one month at most.
7. Cookies
This site only uses cookies that are strictly necessary for it to work (session, language). No advertising or profiling cookies are set.
If an audience measurement feature requiring consent is ever enabled, a consent banner will be shown before any non-essential cookie is set.
8. Changes
This policy may be updated to reflect changes in the services and processors used. The date of the last update is shown at the top of this page. Substantial changes will be notified by email to account holders.