Privacy Policy

Last updated: 7 Aug 2026 · version 2026-08-07

Draft — pending legal review. This document is tailored to MakeWine (Ireland, GDPR) and now names the operating entity, but it has not yet been reviewed by a qualified solicitor. Remove this notice once it has.

This Privacy Policy explains how MakeWine (“we”, “us”), the operator of makewine.app, collects, uses and protects your personal data. MakeWine is operated from Ireland and complies with the EU General Data Protection Regulation (GDPR). For any privacy question, email privacy@makewine.app.

1. What we collect

  • Account data: your email address, display name, and a securely hashed password. We never store your password in plain text.
  • Profile data (optional): anything you add to your public maker profile — bio, location, region, website, social links, images.
  • Content you create: wines, fermentations, gravity/telemetry readings, recipes, tasting notes, vineyard and cellar records, export certificates, and provenance records.
  • Billing data: if you subscribe, payments are processed by Stripe. We store your Stripe customer/subscription identifiers and plan, but we do not store your card details — Stripe does.
  • Technical data: log and security data (e.g. IP address for rate limiting), and, if enabled, privacy-friendly analytics about how the site is used. When someone scans the voluntary provenance QR page for one of your wines, we derive a coarse country from their IP address using a lookup that runs on our own server — the IP is used only for that lookup and is not stored (and never sent to a third party); only the resulting country is kept, alongside a broad device type, with no other identifiers.

2. How we use it and our legal bases

  • To provide the service (your account, your data, subscriptions) — legal basis: performance of a contract.
  • To secure the service (authentication, rate limiting, abuse prevention) — legal basis: legitimate interests.
  • To send transactional email (verification, password reset, important account notices) — contract / legitimate interests.
  • To improve the product via aggregate analytics — legitimate interests, or consent where required.

3. Sharing & processors

We share data only with service providers (“processors”) acting on our instructions:

  • Stripe — payment processing (Stripe stores your card details; we do not).
  • Our transactional email provider — delivery of account & security emails (verification, password reset).
  • Our cloud hosting provider — server hosting and database, hosted in the United Kingdom, with encrypted backups stored in the EU (see section 6).
  • Plausible — privacy-first, cookieless analytics, loaded only if you consent; it sets no cookies and collects no personal data about you.
  • Open-Meteo — weather data for vineyard features (no personal data sent).

We do not sell your personal data.

4. Retention

We keep your data while your account is active. When you delete your account, your personal account data is removed (see your rights below). Some records may be retained where legally required (e.g. invoicing/tax). Backups are rotated and expire on a rolling basis.

5. Your GDPR rights

You have the right to access, rectify, erase, restrict and port your data, to object to certain processing, and to withdraw consent. You can exercise the main rights yourself in the app:

  • Export your data and delete your account from Account settings.
  • For anything else, email privacy@makewine.app.

You also have the right to lodge a complaint with your supervisory authority — in Ireland, the Data Protection Commission (dataprotection.ie).

6. International transfers

MakeWine is operated from Ireland. Our production servers are hosted by OVH in the United Kingdom, and our encrypted off-site backups are stored by Cloudflare in the European Union. Your data is therefore processed in the UK and the EU, and is not transferred outside the UK/EEA in the ordinary course of running the service. Where any processor sits outside the EEA, we rely on appropriate safeguards such as EU Standard Contractual Clauses. A current list of our processors is in section 3.

7. Security

We use HTTPS everywhere, hashed passwords, signed sessions, rate limiting, and least-privilege access. No system is perfectly secure, but we take reasonable measures to protect your data.

8. Children

MakeWine is intended for adults of legal drinking age in their jurisdiction and is not directed at children.

9. Changes

We may update this policy; we will revise the “last updated” date and, for material changes, notify you.

10. Contact

MakeWine, C/O Wicklow Hub, Block B, Newtown Business Park, Newtown Mount Kennedy, Co. Wicklow, A63 XV26, Ireland. Email: privacy@makewine.app.

The identity and contact details of the data controller are set out on our Contact & business details page.