Privacy Policy — SommelAI (v1.0)

Last updated: April 20, 2026

1. Overview

SommelAI, LLC (“SommelAI,” “we,” “us,” “our”) provides an AI-powered wine discovery and recommendation application. This Privacy Policy explains how we collect, use, store, and share information when you use the SommelAI mobile application (the “App”).

By using the App, you acknowledge and agree to the practices described in this Privacy Policy.

2. Account Types

The App supports three account types:

• Anonymous accounts are created automatically when you first open the App and confirm you are at least 21 years old. Anonymous accounts do not require any personal information and are limited to 3 lifetime AI-powered actions (menu scans and pairing requests combined).

• Email accounts are created when you sign up with an email address and password. Email accounts require you to provide your email, display name, date of birth, and gender.

• Apple Sign-In accounts are created using Apple’s Sign in with Apple service. Apple provides us with your email address (or a private relay address if you choose to hide your email). You also provide your display name, date of birth, and gender during sign-up.

When you convert from an anonymous account to an email or Apple Sign-In account, your existing data (scans, reviews, cellar items) is preserved and linked to your new account.

3. Information We Collect

a. Account Information

When you create an account, we collect:

• Email address (for email and Apple Sign-In accounts)
• Password (for email accounts only; stored securely using industry-standard hashing)
• Display name
• Date of birth (used to verify you are at least 21 years old)
• Gender (optional: Woman, Man, Non-binary, or Prefer not to say)
• Marketing opt-in preference (whether you want to receive wine tips and recommendations)

b. Taste Profile Information

During onboarding or at any time in the App, you may provide:

• Wine experience level (beginner, casual, enthusiast)
• Budget preferences
• Preferred wine varietals
• Flavor preferences (liked and disliked flavor notes for each varietal)
• Free-text wine preferences
• AI-generated taste profile (a summary of your palate generated from your quiz responses)

c. User Content

You may submit content through the App, including:

• Images of wine menus (up to 8 pages per scan)
• Images of wine bottle labels (front and back)
• Wine reviews (ratings, flavor notes, comments, dining location)
• Cellar inventory entries (wine details, quantity, price paid, purchase location)
• Restaurant or venue names
• Free-text prompts for wine recommendations

d. Images

Images you upload are processed for optical character recognition (OCR) and wine identification. Images are stored both on your device and in our cloud storage. We may retain images to improve our services unless you request deletion.

e. Usage and Analytics Data

We automatically collect:

• Feature usage events (approximately 40 distinct event types, including scans, recommendations, reviews, and navigation)
• App interactions and session data
• Error and crash diagnostics
• Performance metrics (e.g., scan duration, recommendation response time)
• Device type, operating system version, and app version

We use PostHog for analytics. PostHog anonymizes IP addresses by default. Your Supabase user ID is linked to your PostHog analytics profile for product improvement purposes.

f. Identifiers

• Anonymous users: We assign a persistent anonymous identifier (UUID) to your device.
• Account holders: Your account is identified by a unique user ID linked to your email or Apple ID.

Authentication tokens are stored securely on your device using iOS Keychain.

4. Information We Do Not Collect

We do not collect:

• Precise geolocation or GPS coordinates
• Contacts or address book data
• Phone numbers
• Payment or credit card information
• Health or fitness data
• Browsing history outside the App
• Advertising identifiers (we do not use ad networks)
• Cross-app tracking data

5. How We Use Information

We use the information we collect to:

• Operate and improve the App
• Verify your age (21+)
• Create and manage your account
• Generate personalized wine recommendations based on your taste profile
• Process menu and bottle label images using AI
• Store and display your wine cellar inventory
• Send you review reminders and session notifications (local notifications only; no third-party push services)
• Send transactional emails (password reset, email confirmation, email change notifications)
• Send marketing emails if you opt in
• Analyze usage patterns and improve features
• Diagnose errors and performance issues
• Train and improve our AI models
• Generate aggregated and anonymized insights

6. AI Processing and Model Training

We use third-party AI processing services to:

• Extract wine information from menu images (OCR and wine extraction)
• Identify wines from bottle label images
• Generate personalized wine recommendations from your prompts and wine list data
• Generate your taste profile summary from your stated preferences

These AI processing services act as data processors on our behalf and handle your data according to their own policies and agreements with us. We select providers whose terms state that API inputs are not used to train their general-purpose models by default. For details on their specific data handling practices, consult the current terms of the service providers listed in Section 7.

Your interactions, images, and content may be used to train and improve SommelAI’s own models and algorithms. Where possible, these processes use anonymized or de-identified data. Aggregated or derived data is not reversible to individual users.

7. Sharing of Information

a. Aggregated and De-Identified Data

We may share, license, or sell aggregated, anonymized, or de-identified data to third parties, including wine distributors, suppliers, and industry partners. This data does not identify individual users and cannot reasonably be used to do so.

Examples of aggregated data we may share or sell include:

• Wine selection trends by region or venue type
• Popularity metrics for specific wines or categories
• General user preference patterns
• Aggregate demographic distributions (e.g., age ranges, gender distributions) of our user base

b. Service Providers

We use the following third-party service providers to operate the App:

These providers process data on our behalf and are contractually obligated to protect your information.

c. Legal Requirements

We may disclose information if required by law, regulation, subpoena, or legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

8. Data Storage

a. Cloud Storage

Your account information, content, and usage data are stored in our Supabase database. Images are stored in private Supabase Storage buckets with access controls that ensure you can only access your own files.

b. On-Device Storage

The App stores certain data locally on your device:

• Authentication tokens (in iOS Keychain)
• Bottle label photos (for offline access and sharing)
• Local notification schedules

Data stored on your device persists across app updates but is removed if you delete the App.

9. Data Retention

• Account information and user content are retained indefinitely unless you request deletion.
• Images are retained indefinitely unless you request deletion.
• Analytics data is retained according to PostHog’s retention policies.
• Aggregated, anonymized, or model-derived data may be retained even after your account or content is deleted.

10. Data Deletion

You may request deletion of your account and associated data by emailing support@thesommelai.com with the subject line “Data Deletion Request.” Include your Account ID (found in the Profile tab of the App).

Upon receiving a verified request, we will delete:

• Your account and authentication records
• Your profile, preferences, and taste data
• Your scans, reviews, cellar items, and bottle scans
• Your images stored in our cloud storage

Deletion does not include:

• Anonymized, aggregated, or model-derived data
• Data that has already been incorporated into aggregate analytics
• Data we are required to retain for legal or compliance purposes

We aim to process deletion requests within 30 days.

11. Your Privacy Rights

California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the “sale” of personal information

We do not sell personal information as defined by CCPA. We may share, license, or sell aggregated, anonymized, or de-identified data that does not constitute personal information under California law. See Section 7(a) for details.

To exercise your rights, contact us at support@thesommelai.com.

Other Jurisdictions

If you are located in a jurisdiction with applicable data protection laws, you may have additional rights regarding access, correction, portability, or deletion of your data. Contact us to exercise any applicable rights.

12. Children’s Privacy

The App is intended solely for users who are at least 21 years old. We do not knowingly collect personal information from anyone under 21. If we learn that we have collected information from someone under 21, we will delete it promptly. If you believe we have information from someone under 21, please contact us at support@thesommelai.com.

13. Age Verification

We verify your age through self-attestation:

• Anonymous users must confirm they are at least 21 years old before accessing the App.
• Account holders must provide their date of birth during sign-up. The App validates that you are at least 21 before allowing account creation.

We do not use independent third-party age verification services.

14. Notifications

The App uses local notifications only. Notifications are scheduled and delivered entirely on your device using iOS notification APIs. We do not use any third-party push notification services.

Notification types include:

• Review reminders (prompting you to review a wine you indicated you were having)
• Bottle scan session reminders

You can disable notifications in your device’s Settings at any time.

15. Data Security

We use reasonable administrative and technical safeguards to protect your information, including:

• Secure authentication via Supabase Auth
• Password hashing using industry-standard algorithms (bcrypt)
• Secure token storage using iOS Keychain
• Private storage buckets with row-level security
• HTTPS encryption for all data in transit

No system is completely secure. If you become aware of a security vulnerability, please contact us at support@thesommelai.com.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by other reasonable means. The “Last updated” date at the top indicates when the policy was last revised.

Continued use of the App after changes constitutes acceptance of the updated policy.

17. Contact

Questions, concerns, or requests:

support@thesommelai.com

Document Version: 1.0