Privacy Policy

Digital Companion Oy
Business ID (Y-tunnus): 3607674-4
Espoo, Finland
Privacy contact: privacy@winiapp.ai

Digital Companion Oy is the controller (GDPR Art. 4(7)) for the personal data processed through this service. We have not appointed a statutory Data Protection Officer, as we are not required to under GDPR Art. 37; the contact above handles all privacy matters.

• Account data: name, email address, and a hashed password (if you register).
• Authentication data: where you sign in with Google, Facebook, or Microsoft, the basic profile and email those providers return.
• Service content: menu photos you upload and the dish/wine text you enter, processed to generate pairings.
• Saved data: wine pairings, favourite wines, and session history you choose to save.
• Usage & analytics data: with your consent, anonymised activity such as the dish and wine types you pair and the recipe/store links you open, used to understand trends and improve recommendations.
• Technical data: IP address, device/browser type, and security logs, processed to keep the service secure and available.

We do not sell your personal data, and we do not use it for third-party advertising.

• Providing the service (accounts, generating and saving pairings) — performance of a contract, Art. 6(1)(b).
• Analytics and product improvement — your consent, Art. 6(1)(a); you can withdraw it at any time.
• Marketing communications (if any) — your prior opt-in consent, Art. 6(1)(a).
• Security, fraud prevention, and service integrity — our legitimate interests, Art. 6(1)(f), balanced against your rights.
• Complying with legal obligations (e.g. responding to data-subject requests) — Art. 6(1)(c).

To generate wine pairings, the menu photos and text you submit are sent to Anthropic (Claude API), acting as our processor. Anthropic does not use your data to train its models. Menu photos are processed in memory only and are not stored on our servers.

WINi's recommendations are informational suggestions; you always make the final decision. This processing does not constitute solely automated decision-making producing legal or similarly significant effects, and therefore does not fall under GDPR Art. 22.

AI transparency (EU AI Act). WINi is an AI system that interacts directly with users. In line with the transparency obligation of Art. 50 of the EU AI Act (Regulation (EU) 2024/1689), we make clear that you are interacting with an AI sommelier and that pairings are AI-generated. WINi is a limited-risk AI system and is not a prohibited or high-risk system under that Regulation.

We share personal data only with processors who act on our instructions under a data-processing agreement:

• Anthropic — AI analysis of menus/dishes (United States). Privacy.
• Microsoft Azure — application hosting and database (EU, North Europe region). Privacy.
• Resend — transactional email (e.g. password reset, contact replies). Privacy.

When you click a link to an external retailer (e.g. Viinikellari, Vivino), you leave WINi and we do not share your personal data with them; their own privacy policies apply.

Your data is hosted within the EU (Azure North Europe). Where a processor is located outside the EU/EEA — currently Anthropic and Resend (United States) — transfers are safeguarded under GDPR Art. 46 by Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework, providing a level of protection essentially equivalent to that within the EU. You may request a copy of the relevant safeguards from privacy@winiapp.ai.

• Account data: kept until you delete your account.
• Saved pairings & favourites: kept until you delete them or your account.
• Menu photos: processed in memory only, never stored.
• Analytics events: anonymised after 24 months, then deleted.
• After account deletion: active data removed within 1 day; encrypted backups purged within 7 days.

We apply appropriate technical and organisational measures: passwords hashed with bcrypt, encrypted session tokens, HTTPS/TLS for all connections, EU-region hosting, and access controls on production data. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the supervisory authority of any breach as required by GDPR Art. 33–34.

Subject to the conditions in the GDPR, you have the right to:

• Access your data and obtain a copy (Art. 15) — export it from Account settings.
• Rectify inaccurate data (Art. 16) — edit your profile any time.
• Erase your data (Art. 17) — delete your account, or see our Data Deletion page.
• Restrict or object to processing (Art. 18, 21).
• Data portability (Art. 20) — download your data as JSON.
• Withdraw consent (Art. 7(3)) at any time, without affecting prior processing.

To exercise any right, contact privacy@winiapp.ai. We respond without undue delay and within one month (GDPR Art. 12(3)).

If you believe we have processed your data unlawfully, you may lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman: tietosuoja.fi.

We use essential cookies for authentication and to remember your consent choices. Optional analytics cookies are set only with your explicit opt-in via our cookie banner, which you can change at any time.

WINi is intended for adults. You must be at least 18 years old to use the service (see our Terms of Service). We do not knowingly process the data of anyone under 18.

We may update this Policy from time to time. Material changes will be communicated via the service or by email, and the “Last updated” date above will change.

Privacy questions or data-subject requests: privacy@winiapp.ai.