Privacy statement

1 · Controller

The controller for the processing of your personal data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR) is Michael Bolliger, Earhart-Strasse 19, 8152 Glattpark (Opfikon), Switzerland, info@miguvino.com. There is no data protection officer.

2 · Account and sign-in

• E-mail address. When you sign in with a code, we send it to this address. The code has six digits and is valid for ten minutes and once; only a hash is stored. For each code request we record the e-mail address, the IP address and the time.
• Sign in with Apple or Google. Apple or Google sends us the identifier of your account there, your e-mail address, whether it is verified, and your name. We store the identifier, the e-mail address at the time of linking and the name as your display name. If you choose «Hide My Email» at Apple, the address is a relay address of Apple. Apple and Google are themselves responsible for signing in with them.
• Profile. Display name, profile picture, language, time zone, currency, rating scale and your settings.
• Sessions. Per signed-in device a random identifier (stored as a hash), a device identifier, a device label from the device name or the browser's user agent, and when the session started and was last used.
• Sign-in log. Registration, sign-in and linking a sign-in method with the time, the IP address and the user agent; unlinking a sign-in method, ended sessions, exports and deletions with the time. Purpose: detecting abuse.
• Plan and credits. Your plan, its term and every credit granted and debited.

3 · What you record

Cellars, places and bottles with price, origin and notes; what happens to a bottle (drunk, moved, given away, with the recipient's name if you enter it); journal entries with date, place as text, occasion, notes, photos and the people who were there; ratings; lists and tags; purchases with merchant, amounts and invoices; which wines you viewed or recorded. Purpose: showing you this data on all your devices. It is stored on your device and on our server.

4 · Voice, photos and invoices

• Voice. Your device turns what you say into text; the audio stays on the device.
• Assistant. We send the text you speak or type to a language model so it recognises what you want to record. With it go details from your account: your wines with count and place, for bottles from several purchases the merchant, purchase date and price, your lists and plans, the names of your friends, currency, rating scale and time zone. Our service for model calls also receives your account's identifier. We store the conversation: your text, the result, the model and the cost.
• Labels. We store a photo of a label and send it to an image model.
• Invoices and documents. We store an invoice you photograph, upload or share as a file. Your device or our server reads its text and sends it to a language model; names, addresses, IBANs, customer and phone numbers and e-mail addresses that fixed rules recognise are removed first. A page without readable text goes to an image model as an image.
• Invoices by e-mail. If you send an invoice to your Miguvino address, we receive the e-mail through Cloudflare and store the sender, the subject and the attachments, for an e-mail without attachments its text. Further sender addresses you confirm for this are stored with your account.
• Model calls. Every call goes through our own service to a model provider (section 10). Our service records for each call your account's identifier, the model, the cost and the time.
• Review by us. If you switch on «Improvement» in Settings, we may look at entries you undid or corrected within 90 days.

5 · Friends and shared lists

You connect with friends through an invitation link that is valid for seven days; whoever opens it signed in sees your name. A friend sees your display name and your profile picture. All your friends see a journal entry with the visibility «Friends» with the wine, date, place, occasion, the names of the people involved, your rating, notes and photos. A private entry is seen by the friends you mention in it, without photos. No friend sees your cellar, purchases, prices or your e-mail address. Someone who is mentioned can remove themselves from the entry.

If you invite someone to a list, that person sees the list, its items and notes, and the other members.

6 · Notifications

Only if you switch them on. We then store per device the address under which the device maker's or browser maker's service reaches your device (section 10). A notification contains who mentioned you and which wine, or that your export is ready.

7 · Your account on www.miguvino.com

When you sign in with a verified e-mail address, we check whether there is an account for it on the previous website www.miguvino.com and record an overview, to offer you the import: the number of entries per kind, the total of purchases per currency, notes on single entries and the names of the people you shared lists with there. If you give another address for the previous account, we send a code there. The data is taken over only when you choose «Import»: profile, cellars, bottles, purchases and invoices, journal, ratings, lists and photos. Details for which Miguvino has no field are kept unchanged with your account; they are part of your export.

8 · With every use

• IP address. Our server limits requests per IP address and keeps it in memory for this.
• Operating logs. Errors and events of the server.
• Load times of the home page. The home page sends the name and value of its load-time measurements and the path.
• Searching the wine catalog. What you type into the catalog search goes with your IP address to our search server.

9 · On your device

Your data is stored encrypted in a database on your device, for use without a connection; so are photos and invoices not yet uploaded. In the browser we use three cookies:

• mvu_session, on api.app.miguvino.com: your sign-in. Valid for at most 180 days, deleted when you sign out.
• mvu_member, on app.miguvino.com: that someone is signed in in this browser, so the home page shows your overview. Valid for 400 days, deleted when you sign out.
• mvu_lang, on app.miguvino.com: the language you chose at the bottom of a page. Valid for one year.

In addition, the browser storage holds the wine texts and offers loaded last, the wine catalog and the app's files for use without a connection. If you clear the website data in your browser, all of it is gone.

10 · Who receives the data

These service providers process personal data on our behalf:

• Hetzner Online GmbH, Germany: servers in Nuremberg for the application, database, synchronisation, catalog search and our service for model calls; backups in Falkenstein.
• Backblaze, Inc., USA, data centre Amsterdam, Netherlands: storage for photos, invoices, exports and the encrypted backups of the database.
• BunnyWay d.o.o. (bunny.net), Slovenia: delivery of the website and the wine catalog; sees the IP address and the requested address.
• Scaleway SAS, France: sending our e-mails; as a fallback Resend, Inc., USA.
• ImprovMX Incorporated, USA: forwarding e-mails sent to info@miguvino.com.
• OpenRouter, Inc., USA: forwarding model calls (section 4) to the model providers, only to those that do not store inputs and results after the response and do not use them for training.
• Cloudflare, Inc., USA: receiving invoices by e-mail (section 4).
• Apple Inc., USA, Google LLC, USA, Mozilla Corporation, USA, and Microsoft Corporation, USA: delivering notifications to devices and browsers (section 6).

The model providers to which OpenRouter forwards a call change and can be located outside Switzerland and the EU, including the USA. Whether a recipient in the USA is certified under the Swiss-U.S. or EU-U.S. Data Privacy Framework or offers standard contractual clauses has not been checked for any recipient; without such a basis the USA is not a country with adequate data protection. Beyond this we pass on personal data only when you trigger it (for example to your friends) or when the law requires us to.

11 · Legal bases

Where the GDPR applies, we process your data based on:

• the contract with you (Art. 6(1)(b) GDPR): account, sign-in, your entries, friends, assistant, synchronisation, export and deletion;
• your consent (Art. 6(1)(a) GDPR): notifications and «Improvement»; you can withdraw it at any time in Settings;
• our legitimate interest (Art. 6(1)(f) GDPR): sign-in log, request limits, operating logs, measuring load times, offering the import from www.miguvino.com;
• legal obligations (Art. 6(1)(c) GDPR).

There is no automated individual decision-making.

12 · How long

• Account and entries: until you delete your account. When you delete it, it is signed out at once and deleted 14 days later with all entries, files and credits; if you sign in before then, the deletion is cancelled.
• Deleted entries: 30 days after deletion.
• Files of deleted photos and invoices: until the account is deleted.
• Photos and documents from a conversation that you do not keep: 24 hours after the conversation ends, seven days after the last input of an open conversation; photos you take and never send, until the account is deleted.
• Conversations with the assistant: as long as the account exists. After 90 days we remove your text and the text read from photos and documents.
• Text of an invoice for reading: until the import is complete.
• Log of model calls (identifier, model, cost, time): without time limit.
• Check of the account on www.miguvino.com: until the account is deleted.
• Sign-in codes and code requests: at the latest one day after the code expires.
• Sessions: seven days after they expire or you sign out.
• Sign-in log: 180 days, also after the account is deleted.
• After the account is deleted a hash of your e-mail address remains, without time limit. Purpose: an account on www.miguvino.com is not imported afterwards if it or your new Miguvino account has this address.
• Invitation links: 30 days after they expire.
• Export: seven days, then deleted.
• Deleted files at Backblaze: as a hidden version with no period set by us; no longer retrievable through Miguvino, still accessible to us.
• Device addresses for notifications: until you sign out on the device, remove the device, delete the account or the maker's service reports them as invalid.
• Database backups: restorable for up to 42 days; after that they stay encrypted as a hidden version at Backblaze, with no period set by us.
• Backups of the log of model calls: up to twelve months.
• Operating logs: until rotation overwrites them.

13 · Your rights

You have the right of access, rectification, erasure, restriction of processing, receiving your data in a common format, and objecting to processing. Under Settings → Account, «Export my data» downloads all your data and «Delete account» deletes your account. For anything else an e-mail to info@miguvino.com is enough.

You can complain to the Federal Data Protection and Information Commissioner (FDPIC) in Bern and, if you live in the EU, to the data protection authority of your country.

14 · Changes

We adapt this statement when something about Miguvino changes. The version published here applies; the date below names the last change.