Privacy policy

The controller of personal data collected on this site is: Philippine Turbaux, sole trader ("Cépage"), 2 rue Lucien Delval, 02420 Lehaucourt, France Contact for any data-related question: cepage.contact@gmail.com

The lexicon, the region map and the label explanations can be consulted without an account and without any personal data collection. No analytics tool is installed.

A single item is stored locally in your browser: a technical flag recording that you confirmed being of legal age. It stays on your device, is never sent to any server, and can be removed by clearing the site data in your browser.

If you create an account, we collect: your email address, a password (stored encrypted, never in clear text), the display name you choose, and the content of your tasting journal: wines tasted, ratings out of five, notes and prices you enter.

Your tastings are private by default. They become visible to other members only if you enable sharing yourself, tasting by tasting. You can disable that sharing at any time.

Legal basis: performance of the contract for keeping your journal, and your explicit consent for sharing a review with the community.

Retention: your data is kept for as long as your account is active. Deleting the account, available from the "Your account" page, immediately and permanently erases your profile and all of your tastings.

The photos you take are resized on your device, then sent to OpenAI's API (GPT model), in the United States, for the sole purpose of extracting the list of wines. What you enter next (dishes, tastes, budget, or the bottle you have at home) is also sent to it to choose the wine or the dish. Photos are stored neither on our servers nor in your account: once the list is read, the photo is discarded.

OpenAI acts here as a processor within the meaning of the GDPR. It does not use data received through its API to train its models, and may keep it for up to 30 days to detect abuse. The transfer to the United States relies on the European Commission's standard contractual clauses. Do not photograph any document containing personal data other than the wine list.

The site is hosted by Railway Corporation (United States), on servers located in Amsterdam (Netherlands). Accounts, the journal and analysis counters are stored in a Supabase database. Payments are processed by Stripe. These providers act as processors within the meaning of the GDPR; transfers outside the European Union rely on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework.

To apply the scan limits for visitors without an account, a random identifier is placed in a cookie in your browser and a fingerprint of your IP address is computed. That fingerprint is a salted hash: it cannot be turned back into the address, and serves only to spot automated use.

Legal basis: the legitimate interest in protecting the service from abuse. This data is deleted after 90 days. The cookie involved is strictly necessary to the service and therefore requires no prior consent.

Payments are processed by Stripe Payments Europe Ltd, acting as a processor. Your card details never pass through our servers and are never stored by us.

We keep only a Stripe customer identifier, your subscription status and its renewal date, in order to unlock the Premium features. Deleting your account erases this from our database; invoices remain held by Stripe for the legally required period.

We count page views in order to know which sections are useful. For each visit only two pieces of information are recorded: the address of the page consulted and the date. No IP address, no visitor identifier, no tracking cookie.

These counters therefore cannot identify you or reconstruct your journey: they do not constitute personal data and require no consent. They are shared with no third party.

This site uses no advertising cookies and no analytics cookies. Only two storages are used, both strictly necessary for the site to function: remembering the age check, and a session cookie that keeps you signed in to your account. As such they require no prior consent under article 82 of the French Data Protection Act.

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the right to access, rectify, erase, restrict processing of, object to and port your data.

To exercise these rights, write to: cepage.contact@gmail.com. You will receive a reply within one month at most.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.