GDPR
Last updated: 2026-09-30 (OENARI 4.2)
OENARI processes personal data in accordance with the General Data Protection Regulation (EU 2016/679). This page is the formal counterpart to the Privacy Policy.
Data Controller
OENARI, Sweden — support@oenari.com.
Legal Bases
| Purpose | Basis |
|---|---|
| Account, cellar, notes, import/export, memberships | Performance of contract — Art. 6(1)(b) |
| Social features you opt into (profile, follows, sessions, clubs, likes) | Performance of contract — Art. 6(1)(b) |
| Shared catalogue, anonymous statistics, moderation, abuse prevention | Legitimate interest — Art. 6(1)(f) |
| Push and e-mail notifications | Consent — Art. 6(1)(a), withdrawable in Settings |
| Pseudonymous usage events | Legitimate interest — Art. 6(1)(f) |
| Responding to legal requests | Legal obligation — Art. 6(1)(c) |
Your Rights
Access and portability (Art. 15, 20). In the App: Profile → Settings → Privacy → Export my data. You receive a JSON file immediately containing your account, profile, membership, bottles, tasting notes, consumption, wishlist, cellar structure, tags, follows and followers, blocks, reports filed, sessions hosted and attended, session scores, notification settings, registered devices, and a per-event summary of usage analytics. The export can only be run by you, for you.
Rectification (Art. 16). Edit directly in the App.
Erasure (Art. 17). Profile → Settings → Delete Account. Personal data is deleted immediately; community contributions are anonymised. See Account Deletion.
Restriction and objection (Art. 18, 21). E-mail us. You can object to the legitimate-interest processing above; note that the shared catalogue cannot function without anonymous contributions.
Withdraw consent. Notifications: in Settings. Location tagging: remove the tag from the note.
We answer requests within 30 days.
Storage
All personal data is stored with Supabase in the European Union (eu-west-1). Transfers to processors outside the EU are covered by Standard Contractual Clauses.
Sub-processors
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, storage, server functions | EU |
| Apple, Google | Sign-in (optional); app stores and in-app purchases | EU/US |
| RevenueCat | Subscription status | US (SCCs) |
| Google Cloud Vision | Label text recognition | EU/US (SCCs) |
| Anthropic | AI label reading, AI food pairing, tasting-note translation, checks of submitted catalogue wines — no name, e-mail or account ID sent | US (SCCs) |
| Expo, Firebase (Google), Apple | Push notification delivery | US/EU |
| Resend | Transactional e-mail | US (SCCs) |
| Cloudflare | Web hosting | EU/global |
Data Breaches
If a breach is likely to put your rights at risk we notify the supervisory authority within 72 hours and affected users without undue delay, and document the breach and our response.
Supervisory Authority
Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden — imy.se. You may also complain to the authority in your own country.
Contact
support@oenari.com