This Privacy Policy explains how MakeWine (“we”, “us”), the operator of makewine.app, collects, uses and protects your personal data. MakeWine is operated from Ireland and complies with the EU General Data Protection Regulation (GDPR). For any privacy question, email privacy@makewine.app.

1. What we collect

Account data: your email address, display name, and a securely hashed password. We never store your password in plain text.
Profile data (optional): anything you add to your public maker profile — bio, location, region, website, social links, images.
Content you create: wines, fermentations, gravity/telemetry readings, recipes, tasting notes, vineyard and cellar records, export certificates, and provenance records.
Billing data: if you subscribe, payments are processed by Stripe. We store your Stripe customer/subscription identifiers and plan, but we do not store your card details — Stripe does.
Technical data: log and security data (e.g. IP address for rate limiting), and, if enabled, privacy-friendly analytics about how the site is used. When someone scans the voluntary provenance QR page for one of your wines, we derive a coarse country from their IP address using a lookup that runs on our own server — the IP is used only for that lookup and is not stored (and never sent to a third party); only the resulting country is kept, alongside a broad device type, with no other identifiers.

2. How we use it and our legal bases

To provide the service (your account, your data, subscriptions) — legal basis: performance of a contract.
To secure the service (authentication, rate limiting, abuse prevention) — legal basis: legitimate interests.
To send transactional email (verification, password reset, important account notices) — contract / legitimate interests.
To improve the product via aggregate analytics — legitimate interests, or consent where required.

3. Sharing & processors

We share data only with service providers (“processors”) acting on our instructions:

Stripe — payment processing (Stripe stores your card details; we do not).
Our transactional email provider — delivery of account & security emails (verification, password reset).
Our cloud hosting provider — server hosting and database, hosted in the United Kingdom, with encrypted backups stored in the EU (see section 6).
Plausible — privacy-first, cookieless analytics, loaded only if you consent; it sets no cookies and collects no personal data about you.
Open-Meteo — weather data for vineyard features (no personal data sent).

We do not sell your personal data.

4. Retention

We keep your data while your account is active. When you delete your account, your personal account data is removed (see your rights below). Some records may be retained where legally required (e.g. invoicing/tax). Backups are rotated and expire on a rolling basis.

Records you have published are a separate decision, and it is yours. A bottle record or electronic label is published so that a consumer holding the bottle can read it, and a bottle can be opened years after the winery has closed. Deleting your account therefore does not silently decide the fate of those pages. Closing your account is a step that lists each published page and lets you choose, for each one, whether it stays and which details stay with it — your winery name, your logo or image, and each of the other details the page shows — or whether it is removed entirely. Keeping them is what happens if no choice is made.

Whichever you choose, your personal information is deleted: your photograph, your biography, an individual’s name where it is not the business name, and your contact email. What stays on a page you chose to keep is what you chose to leave on it. A page you remove has its content deleted, and a code already printed on a bottle then shows only that the record was withdrawn, with the date. We keep our log of what was changed and when, because it is what evidences a label’s content on a date, but your identity is removed from it — the entries are attributed to a closed account, not to you. The full terms of this are in section 12 of our Terms.

5. Your GDPR rights

You have the right to access, rectify, erase, restrict and port your data, to object to certain processing, and to withdraw consent. You can exercise the main rights yourself in the app:

Export your data and delete your account from Account settings. Deleting an account is a step rather than a single action, because it asks you what should happen to anything you have published — see Retention above.
For anything else, email privacy@makewine.app.

You also have the right to lodge a complaint with your supervisory authority — in Ireland, the Data Protection Commission (dataprotection.ie).

6. International transfers

MakeWine is operated from Ireland. Our production servers are hosted by OVH in the United Kingdom, and our encrypted off-site backups are stored by Cloudflare in the European Union. Your data is therefore processed in the UK and the EU, and is not transferred outside the UK/EEA in the ordinary course of running the service. Where any processor sits outside the EEA, we rely on appropriate safeguards such as EU Standard Contractual Clauses. A current list of our processors is in section 3.

7. Security

We use HTTPS everywhere, hashed passwords, signed sessions, rate limiting, and least-privilege access. No system is perfectly secure, but we take reasonable measures to protect your data.

8. Children

MakeWine is intended for adults of legal drinking age in their jurisdiction and is not directed at children.

9. Changes

We may update this policy; we will revise the “last updated” date and, for material changes, notify you.

10. Contact

MakeWine, C/O Wicklow Hub, Block B, Newtown Business Park, Newtown Mount Kennedy, Co. Wicklow, A63 XV26, Ireland. Email: privacy@makewine.app.

The identity and contact details of the data controller are set out on our Contact & business details page.