1. Introduction
This Privacy Policy explains how Matthieu Lerat, sole trader / individual entrepreneur under French law (hereinafter "the Publisher", "we"), collects, uses, and protects the personal data of users (hereinafter "you", "the User") of the Arom mobile application (hereinafter "the App").
It complements the Terms of Use and applies to anyone using the App, regardless of their country of residence.
2. Data Controller
| Data Controller | Matthieu Lerat, individual entrepreneur (EI, French sole-trader status) |
|---|---|
| SIRET | 517 790 358 00041 |
| Address | Not disclosed — email contact only |
| Contact (personal data) | contact@arom.wine |
The Publisher has not appointed a Data Protection Officer (DPO), as this is not legally required given the size and activity of the business.
3. Minimum age
The App references alcoholic beverages. It is intended solely for users aged 18 or older. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us at the address above so we can delete it.
4. Data we collect
| Category | Details | Source |
|---|---|---|
| Account data | Email address, unique user identifier, name (if provided) | Sign-in via Sign in with Apple or Google Sign-In |
| Personal cellar data | Wines you add (name, vintage, region, notes, ratings, quantities, etc.) | Manual entry, batch import, or label recognition |
| Photos | Photos of wine labels and dishes | Your device's camera or photo library (with your permission) |
| Content submitted for suggestions | Dish names, descriptions, photos, to obtain food/drink pairings or recipes | Entered or photographed by the User |
We do not collect location data, advertising identifiers, and do not use any analytics or advertising-tracking tools.
5. How we use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account, secure access to the App | Performance of a contract (Art. 6.1.b) |
| Build and display your personal cellar | Performance of a contract (Art. 6.1.b) |
| Recognize a wine label from a photo (AI) | Performance of a contract (Art. 6.1.b) |
| Generate food/drink pairing and recipe suggestions (AI) | Performance of a contract (Art. 6.1.b) |
| Illustrate suggestions with visuals (image search) | Performance of a contract (Art. 6.1.b) |
| Ensure security, prevent fraud and abuse | Legitimate interest (Art. 6.1.f) |
| Send you marketing communications or a newsletter | Consent (Art. 6.1.a) — not currently active; if activated, it will only be based on your explicit consent, with the option to unsubscribe at any time |
6. Recipients of your data — subprocessors
We do not sell or rent your personal data. We only share it with the technical providers necessary to operate the App:
| Subprocessor | Role | Data involved |
|---|---|---|
| Supabase | Database hosting, authentication, photo storage, server infrastructure | Account data, cellar data, photos |
| Anthropic (Claude API) | Wine label recognition, generation of food/drink pairing and recipe suggestions | Label/dish photos, text content submitted for analysis |
| Unsplash | Illustrative image search (generic dish/wine photos) | Search terms related to suggestions (no account data transmitted) |
| Apple (Sign in with Apple) | Authentication | Apple ID, email (or relay email if you choose to hide it) |
| Google (Google Sign-In) | Authentication | Google ID, email, name |
These providers only use your data to perform the services we entrust to them, not for their own purposes.
7. International data transfers
Some of our subprocessors (notably Anthropic and Unsplash, both US-based companies) may process data outside the European Union. Where this occurs, such transfers are governed by appropriate safeguards recognized under the GDPR, in particular the European Commission's Standard Contractual Clauses.
Our Supabase database and storage are hosted within the European Union (Paris, France region). Only processing carried out by Anthropic and Unsplash involves a transfer outside the EU, under the conditions described above.
8. Data retention
- Account and cellar data: retained for as long as your account is active.
- Photos: retained for as long as your account is active, tied to your user identifier and protected by access rules ensuring only you can access them.
- Account deletion: when you delete your account from the App, deletion is immediate and automated: your account, all your saved wines, and all your photos are erased from our systems at the time of the request.
- Content sent for AI recognition or suggestions: transmitted to Anthropic only for as long as necessary to process the request, in accordance with Anthropic's own retention policy.
- Technical infrastructure logs (server, security logs): retained according to our hosting providers' standard retention periods, typically a few days to a few weeks.
9. Security of your data
- Your cellar data and photos are protected by database-level security rules (Row Level Security) ensuring only your account can access them.
- Communication between the App and our servers is encrypted (HTTPS/TLS).
- We do not use a proprietary password system: authentication relies exclusively on Sign in with Apple and Google Sign-In.
- Sensitive access keys to our services (e.g. admin key) are never embedded in the App and remain strictly server-side.
10. Your rights
Under the General Data Protection Regulation (GDPR) and applicable French data protection law, you have the following rights over your personal data:
- Right of access: obtain a copy of the data we hold about you;
- Right to rectification: correct inaccurate or incomplete data;
- Right to erasure: request deletion of your data (also available directly within the App);
- Right to restriction of processing;
- Right to data portability: receive your data in a structured, commonly used format;
- Right to object, notably to direct marketing;
- Right to withdraw consent at any time, where processing is based on it (e.g. marketing emails).
To exercise these rights, contact us at contact@arom.wine. We commit to responding within one month.
You also have the right to lodge a complaint with the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr, 3 Place de Fontenoy, 75007 Paris, France. If you reside outside France, you may also contact your local data protection authority.
11. Cookies and trackers
The Arom mobile App does not use cookies, advertising trackers, or analytics tools. This document covers the mobile application; should a website at arom.wine using cookies be published, a dedicated cookie policy will be made available at that time.
12. Changes to this policy
We may update this Privacy Policy from time to time, in particular to reflect changes to the App or applicable law. In the event of a material change, you will be informed through an appropriate means (e.g. an in-app notification). The version in force is the one published at the time you use the App.
13. Contact
For any question regarding this Privacy Policy or the processing of your personal data, you can contact us at: contact@arom.wine.