PRIVACY POLICY

Oeno.match

Last updated: 19 May 2026

Courtesy translation. This Privacy Policy was drawn up in French; in the event of any discrepancy of interpretation, the French version prevails.

1. INTRODUCTION

This Privacy Policy describes how Oeno.match (hereinafter "we", "our" or the "Service") collects, uses, stores and protects your personal data when you use the Oeno.match mobile application.

Data controller: Licorice Conseil 2 rue de la Motte au Duc, 35700 Rennes, France Email: contact@licorice-conseil.com

By using Oeno.match, you accept the practices described in this policy. If you do not accept these terms, please do not use the Service.

2. DATA COLLECTED

2.1 Identification and account data

• Last name, first name
• Email address
• Password (encrypted)
• Date of birth (to verify legal age)
• Country of residence
• Preferred language
• Profile photo (optional)
• City and address (for geolocation features, optional)

2.2 Data relating to your cellar and your wines

• Information about recorded bottles (estate, appellation, vintage, grape variety, colour, quantity, price)
• Uploaded wine label photos
• Bottle storage locations
• Tasting notes
• Personal ratings and comments
• Consumption history

2.3 Usage and technical data

• Unique device identifier (Device ID)
• IP address
• Device type and operating system
• Application version
• Connection and activity logs
• In-app navigation data
• Crashes and technical errors

2.4 Location data

• Approximate location (city, region) if you have enabled this feature
• Precise GPS location only if you explicitly authorise it for specific features

2.5 Community data

• Posts, comments and interactions with other users
• Likes, shares, mentions
• Private messages (encrypted)
• Subscriptions and social relationships

2.6 Cookies and similar technologies

See the dedicated section 10 on cookies.

3. LEGAL BASIS AND PURPOSES OF PROCESSING

We process your personal data on the following legal bases, in accordance with the GDPR (General Data Protection Regulation):

3.1 Performance of the contract (Art. 6.1.b GDPR)

• Creation and management of your account
• Operation of the digital cellar
• Access to the application's features
• Customer service and technical support

3.2 Consent (Art. 6.1.a GDPR)

• Sending newsletters and marketing communications
• Use of precise geolocation
• Sharing data with affiliate partners
• Non-essential cookies

3.3 Legitimate interest (Art. 6.1.f GDPR)

• Improving the Service and developing new features
• Statistical analysis and audience measurement
• Fraud prevention and Service security
• Personalisation of the user experience

3.4 Legal obligations (Art. 6.1.c GDPR)

• Responding to requests from judicial authorities
• Retention of accounting and tax data
• Verification of legal age (18 minimum)

Detailed purposes:

• Management of your personal wine cellar
• Food-and-wine pairing recommendations via artificial intelligence (Gemini or other)
• Community features (sharing, comments, likes)
• Calculation of wine maturity and tasting suggestions
• Commercial affiliation with wine merchants whose identity may change over time
• Aggregated and anonymised statistics to improve the Service

4. DATA RECIPIENTS

Your personal data may be passed on to the following categories of recipients:

4.1 Essential technical providers

• Supabase Inc. (United States): database hosting and authentication
• Google LLC (United States): AI processing via the Gemini API for label recognition and recommendations
• OpenAI (United States): AI processing via the OpenAI API to highlight wines in the context of food-and-wine pairings
• Expo / React Native: mobile application infrastructure

4.2 Commercial partners (with your consent)

• Transmission of your wine searches for commercial affiliation (only if you click the links offered)

4.3 Other users of the Service

• The information you publish in the community section (posts, comments, public profile) is visible to other users according to your privacy settings

4.4 Legal authorities

In the event of a legal or judicial request, we may be required to pass your data on to the competent authorities.

5. TRANSFERS OUTSIDE THE EUROPEAN UNION

Some of our providers are located outside the European Union, in particular in the United States (Supabase, Google, etc.).

Safeguards in place:

• European Commission standard contractual clauses
• Privacy Shield certification (where applicable)
• Enhanced security measures (encryption in transit and at rest)

You have the right to obtain a copy of these safeguards by contacting us.

6. RETENTION PERIOD

After you delete your account, your identifiable personal data is erased within 30 days (or within 90 days depending on the complexity of the request). Published community content may be anonymised and kept to preserve the integrity of discussions.

7. DATA SECURITY

We implement appropriate technical and organisational measures:

• Password encryption (bcrypt/scrypt)
• Communications encryption (HTTPS/TLS)
• Strict access control to data in production
• Regular security audits
• Encrypted daily backups
• Two-factor authentication available
• Security incident management policy

In the event of a personal data breach presenting a high risk to your rights, we will notify you within 72 hours in accordance with the GDPR.

8. YOUR RIGHTS (GDPR)

You have the following rights regarding your personal data:

8.1 Right of access (Art. 15 GDPR)

Obtain a copy of all the personal data we hold about you.

8.2 Right to rectification (Art. 16 GDPR)

Correct inaccurate or incomplete data from your profile or by contacting us.

8.3 Right to erasure / "right to be forgotten" (Art. 17 GDPR)

Delete your account and personal data at any time:

• from the app settings (when available), or
• via the dedicated web form: /suppression-compte (email + password, then email confirmation).

Shared oenological catalogue references are retained. You may also contact contact@licorice-conseil.com.

8.4 Right to restriction of processing (Art. 18 GDPR)

Request the temporary suspension of the processing of your data in certain circumstances.

8.5 Right to portability (Art. 20 GDPR)

Retrieve your data in a structured, commonly used and machine-readable format (CSV export available in the application).

8.6 Right to object (Art. 21 GDPR)

• Objection to processing based on legitimate interest
• Objection to direct marketing at any time
• Objection to profiling

8.7 Right to withdraw your consent

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

8.8 Right to lodge a complaint

You may lodge a complaint with the CNIL (French Data Protection Authority):

• Online: https://www.cnil.fr/
• By post: CNIL, 3 Place de Fontenoy - TSA 80715, 75334 PARIS CEDEX 07, France

Exercising your rights: For any request, contact us at contact@licorice-conseil.com, enclosing a copy of your ID. We will respond within a maximum of 1 month (extendable by 2 months if complex).

9. LIABILITY FOR COMMUNITY CONTENT

9.1 User-generated content

Oeno.match is a platform that lets users share content (tasting notes, comments, photos, recommendations).

We are NOT responsible for:

• Content published by users
• Erroneous, false or misleading information shared by other users
• Food-and-wine pairing advice or recommendations given by the community
• Commercial transactions between users
• Opinions, reviews or ratings expressed by users

9.2 Moderation role

We act as a host within the meaning of the French LCEN (Act on Confidence in the Digital Economy). We intervene only:

• Upon report of manifestly unlawful content
• In the event of a flagrant violation of our Terms of Use
• At the request of a judicial authority

9.3 Reporting inappropriate content

If you identify content that is unlawful, offensive or contrary to our Terms, you can report it via the report button in the application settings. We recommend that you take screenshots of the inappropriate content when reporting, to help our teams handle it.

9.4 Your responsibilities

You are solely responsible for:

• The content you publish
• The accuracy of the information you share with the community
• The consequences of publicly disclosing your personal data (e.g. a cellar's address)
• Respecting intellectual property rights (do not publish protected photos without authorisation)

Important: Information shared publicly may be indexed by search engines and difficult to erase completely from the Internet even after deletion on Oeno.match.

10. COOKIES AND SIMILAR TECHNOLOGIES

10.1 What is a cookie?

A cookie is a small text file placed on your device when you visit. It allows your device to be recognised and improves your experience.

10.2 Types of cookies used

A. Strictly necessary cookies (no consent required)

• Authentication and user session
• Security and fraud prevention
• Remembering your language preferences
• Technical operation of the application

B. Performance and analytics cookies (consent required)

• Audience measurement and usage statistics
• Identification of the most viewed pages
• Analysis of user journeys
• Retention and engagement rates

Tools used: Google Analytics, Expo Analytics (or equivalent)

C. Personalisation cookies (consent required)

• Personalised wine recommendations
• Tailored food-and-wine pairing suggestions
• Interface personalisation

D. Advertising and targeting cookies (consent required)

• Affiliate links to our commercial partners
• Tracking of clicks on commercial offers
• Measurement of partnership performance

10.3 Similar technologies

We also use:

• Local Storage: to store user preferences locally
• Device ID: the unique identifier of your mobile device
• Third-party SDKs: Expo, Supabase, Google AI SDK

10.4 Managing your preferences

At any time you can:

• Change your cookie preferences in the application settings ("Privacy and cookies" section)
• Disable cookies in your mobile browser (this may affect some features)
• Object to advertising targeting

Cookie retention period:

• Session cookies: deleted when the app is closed
• Persistent cookies: 13 months maximum
• Consent renewal: every 13 months

11. USE OF ARTIFICIAL INTELLIGENCE

Oeno.match uses the Gemini API (Google) to:

• Automatically recognise wine labels from your photos
• Extract information (estate, vintage, appellation, grape variety)
• Provide personalised food-and-wine pairing suggestions
• Calculate wine maturity

Data transmitted to Gemini:

• Label photos (temporarily, not stored by Google)
• Wine characteristics (for recommendations)
• Taste preferences (anonymised)

Safeguards:

• No reuse by Google to train its models (under the API contract)
• Encrypted transmission
• Immediate deletion after processing
• Logs kept only to improve the accuracy of the Service

You can decline the use of AI by manually entering your wine information instead of using the automatic scan.

12. MINORS' DATA

Use of Oeno.match is reserved for people aged 18 or over, in accordance with alcohol legislation.

We do not knowingly collect personal data from minors. If we discover that an account has been created by a minor, we will delete it immediately.

If you are a parent or legal guardian and believe your child has created an account, contact us at contact@licorice-conseil.com for deletion.

13. CHANGES TO THIS POLICY

We may change this Privacy Policy at any time to reflect:

• The evolution of our practices
• Regulatory changes
• The addition of new features

Notification of changes:

• In the event of a substantial change, you will be notified by email and/or via the application 30 days before it takes effect
• The "Last updated" date at the top of the document will always be refreshed
• Your continued use after these changes constitutes acceptance

You can view the version history on our website www.oenomatch.com.

14. CONTACT US

For any question regarding this policy or the exercise of your rights:

Data controller: Mathieu Carrel 2 rue de la Motte au Duc, 35700 Rennes, France

Email: contact@licorice-conseil.com

Data Protection Officer (DPO): Not required for our structure.

15. GLOSSARY

• GDPR: General Data Protection Regulation (EU 2016/679)
• Personal data: any information relating to an identified or identifiable natural person
• Processing: any operation on personal data (collection, recording, consultation, use, etc.)
• Data controller: the entity that determines the purposes and means of processing
• Processor: the entity that processes data on behalf of the controller (e.g. Supabase)
• Consent: freely given, specific, informed and unambiguous agreement
• Profiling: automated processing to evaluate certain personal aspects
• Anonymisation: processing that makes it impossible to identify the person

Version 1.0 — 19 May 2026