Privacy Notice

Version 1.1

1. Data Controller Information

Data Controller: Damiano Gambitta, an individual trading as "Sommy"

Address: c/o ExpertFid & Audit SA, Strehlgasse 2, 8001 Zürich, Switzerland

Email: privacy@sommy.wine

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Data We Collect

Information You Provide:

Email Address: When you subscribe to our newsletter or create an account
Age Confirmation: We ask your date of birth once to confirm you meet the legal drinking age. We store only a yes/no "age verified" result — your date of birth itself is not retained.
Marketing Preferences: Your consent to receive marketing communications
Contact Information: Name and other details if you contact our support

Information We Collect Automatically:

Analytics Data: Page views, session duration, referral sources (opt-in only via PostHog)
Technical Data: IP address, browser type, device information
Cookies: Small files stored on your device for functionality and analytics
Geographic Data: IP geolocation for content localization

Mobile App Data:

Course Progress: Lessons completed, quiz scores, and learning streaks
Tasting Notes: Wine observations you record during tasting exercises
Wine Photos: Photos of wine labels you submit for AI analysis. They are sent to Google Gemini and saved with your tasting history in secure cloud storage until you delete the tasting or your account.
XP and Achievements: Gamification data tied to your learning progress

3. Purposes and Legal Bases

Purpose	Legal Basis
Email newsletter delivery	Consent (Article 6(1)(a) GDPR)
Product analytics (PostHog)	Consent (Article 6(1)(a) GDPR)
AI wine photo analysis (Google Gemini)	Contract performance (Article 6(1)(b) GDPR)
Customer support	Legitimate interest (Article 6(1)(f) GDPR)
Legal compliance	Legal obligation (Article 6(1)(c) GDPR)
Age verification	Legitimate interest (Article 6(1)(f) GDPR): ensuring our alcohol-related educational content is only offered to adults, in line with responsible-marketing standards and app-store requirements

4. Data Sharing and International Transfers

Service Providers:

Buttondown: Email newsletter service (USA) - transfers protected by Standard Contractual Clauses
PostHog: Product analytics (PostHog EU Cloud, hosted in the European Union) - enabled only with your consent
Google Gemini AI: Wine photo and label-text analysis (USA) - submitted content is not used by Google to train its models
Firebase: Authentication and hosting (USA, Google) - Google Cloud data processing terms apply
Railway: Application hosting and PostgreSQL database (USA)
Sentry: Error and crash monitoring (USA) - diagnostic data that may include a pseudonymous account identifier

International Transfers: Google (Firebase, Gemini), Railway, and Sentry are certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. Transfers to Buttondown, and any residual transfers by other providers (including support access to EU-hosted PostHog data), are protected by the European Commission's Standard Contractual Clauses, as amended for Swiss law and recognised by the FDPIC, incorporated in our data processing agreements. You can request a copy of these safeguards at privacy@sommy.wine.

5. Data Retention

Account data: Until you delete your account
Email subscribers: Until you unsubscribe or withdraw consent
Analytics data: 12 months (PostHog retention)
Wine photos: Retained with your tasting history until you delete the tasting or your account
Server and security logs (including IP addresses): Up to 12 months
Error and crash diagnostics (Sentry): 90 days
Contact inquiries: 3 years or until resolution of inquiry
Legal compliance data: As required by applicable law

6. Your Rights

This notice is governed by the Swiss Federal Act on Data Protection (FADP); for users in the EU/EEA, the GDPR applies in addition. You have the following rights regarding your personal data:

Right of Access (Art. 25 FADP / Art. 15 GDPR): Request a copy of your personal data
Right to Rectification (Art. 32 FADP / Art. 16 GDPR): Correct inaccurate or incomplete data
Right to Erasure (Art. 32 FADP / Art. 17 GDPR): Request deletion of your data
Right to Restrict Processing (Art. 18 GDPR): Limit how we use your data
Right to Data Portability (Art. 28 FADP / Art. 20 GDPR): Download your data in JSON format via the app
Right to Object (Art. 30 FADP / Art. 21 GDPR): Object to processing based on legitimate interest
Right to Withdraw Consent: Withdraw consent for analytics and marketing at any time

How to Exercise Your Rights:

In-app: Use "Download My Data" (Profile > Settings) for data portability

In-app: Use "Delete Account" (Profile > Settings) for erasure

Email us at: privacy@sommy.wine

We will respond to your request within 30 days.

7. Cookies and Tracking

We use cookies and similar technologies to improve your experience. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes encryption of data in transit and at rest, regular security assessments, and access controls.

9. Age Restrictions

Our services are not intended for individuals under the legal drinking age. We do not knowingly collect personal data from minors. If you are under 18 (or the legal drinking age in your jurisdiction), please do not provide us with your personal information.

10. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the updated notice on our website and updating the "Last Updated" date.

11. Supervisory Authority

If you believe we have not handled your personal data in accordance with this notice or applicable law, you have the right to lodge a complaint with your local data protection authority or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

12. Contact Us

If you have any questions about this Privacy Notice or our data processing practices, please contact:

Damiano Gambitta (Data Controller)

Email: privacy@sommy.wine

Last Updated: July 2026