Privacy policy

Vinkretsen is the data controller for the processing of personal data that takes place within the Vinkretsen platform, unless otherwise stated.

The data controller is Sharpbox Technologies AB, organisation number [ORG-NR]. Contact: privacy@vinkretsen.se

This means Vinkretsen is responsible for how your personal data is processed in connection with, for example, accounts, bookings, tastings, the digital cellar, tasting notes, notifications, payments and platform features.

Wine importers and other external parties may in some cases be independently responsible for personal data they process outside Vinkretsen — for example in their own newsletters, customer registers or external systems.

We process different types of personal data depending on how you use Vinkretsen.

Account data

• name;
• email address;
• password or authentication information;
• profile picture if you add one;
• user role;
• account status;
• date of registration and last activity.

Account type

When you use the platform you may be asked whether you are a private consumer or a wine professional. This classification (account type) is used to tailor your tasting experience — for example, professionals may access the WSET-format evaluation form. Your classification is stored with your profile and, for anonymous tasting guests, with your tasting session record.

Profile and community data

• public display name;
• optional profile bio;
• followed importers;
• followed users;
• tasting groups;
• comments;
• reports and moderation history.

Booking and tasting data

• booked tastings;
• participant status;
• ticket or tasting-pass type;
• payment status;
• check-in status for in-person events;
• participation in online tastings;
• LiveKit / room-related access information;
• reminder and calendar information.

Digital cellar

• saved wines;
• producer;
• vintage;
• region;
• number of bottles;
• your own notes;
• drinking window;
• images you upload;
• links to tastings or wine lists.

Your cellar is private by default.

Tasting notes and ratings

• tasting notes;
• scores;
• drinking window;
• "would buy again";
• images attached to tasting notes;
• note visibility: private, shared, group-shared or public.

Tasting notes are private by default.

Payment and order data

For paid tastings we process the data needed to handle the booking, payment status, receipt and any refund.

The platform does not process or store payment card information. A "paid" indicator on event registrations is managed manually by the event host and does not involve any payment transaction through Vinkretsen.

Communication and notifications

• email notifications;
• booking confirmations;
• tasting reminders;
• in-app notifications;
• push notification settings if you enable them;
• consents and notification preferences.

Technical information

• IP address;
• browser;
• device type;
• session information;
• logs;
• cookies;
• debugging data;
• security events;
• approximate usage statistics.

Our infrastructure providers (Supabase, Cloudflare) may log your IP address as part of standard server operations. These logs are retained according to each provider's own data retention policy and are not stored in our application database.

Analytics and aggregated statistics

We may process data on how features are used, for example:

• wine views;
• clicks to product pages at Systembolaget;
• additions to cellar;
• created tasting notes;
• tasting participation;
• responses to feedback / NPS.

We also collect interaction data during tastings, such as when you submit a rating, advance between wines, or engage with tasting questions. This data is used in aggregate to help importers understand tasting engagement patterns and is not shared in individually identifiable form beyond what is described in section 5.

For their own tastings, importers can see individual guest ratings and tasting notes as well as whether the guest identified as a private consumer or a wine professional. Outside an individual tasting, this data is only shared in aggregate form. See section 5 for details on what importers can see.

We process personal data in order to:

• create and manage your account;
• let you book and join tastings;
• handle private and community tastings;
• give you access to LiveKit tasting rooms;
• save your digital cellar;
• save tasting notes and scores;
• show relevant tastings, importers and wines;
• send booking confirmations and reminders;
• handle payments, receipts and refunds;
• enable importer profiles and wine portfolios;
• let importers save your tasting ratings and give you personal wine recommendations, if you have consented to this;
• show aggregated statistics to importers;
• improve the platform;
• prevent abuse and protect security;
• comply with legal obligations;
• handle support, reports and moderation.

We log when importer team members access guest profile information, for accountability and data protection purposes.

If a tasting host enables the private import feature, guests who opted in may receive an email with instructions for purchasing wines through Systembolaget's private import service. This email is based on the wines included in the tasting, not on your individual ratings or preferences.

We monitor for abusive or fraudulent use of the platform, including rate-limiting of data export requests and tracking of unusual access patterns. This processing is based on our legitimate interest in maintaining platform security.

We process personal data on the following legal bases.

Contract

When you create an account, book a tasting, use your cellar or join a tasting we process data in order to provide the service.

Consent

We may ask for consent for certain types of cookies, analytics, marketing emails or push notifications.

You can withdraw consent at any time where processing is based on consent.

If you consent, an importer may save your tasting ratings from their tastings in order to give you personal wine recommendations. You can withdraw this consent at any time via your account settings.

Legitimate interest

We may process certain data for security, debugging, product improvement, aggregated statistics, abuse prevention and relevant in-platform communication.

Legal obligation

We may need to process certain data to comply with legal requirements — for example accounting requirements or handling of legal claims.

We do not sell your personal data.

We share personal data only when needed to provide Vinkretsen, to comply with legal requirements or to protect the platform.

Recipients may be:

• payment provider;
• email provider;
• hosting and database services;
• video technology provider;
• analytics and error reporting tools;
• support and security tools;
• authorities where required by law.

Importers do not get access to your private notes, your private cellar, private tastings they have not arranged, or your personal payment data.

For their own tastings, importers can see individual guest ratings and tasting notes, as well as whether the guest identified as a private consumer or a wine professional. In addition, importers see aggregated statistics about their own tastings, wines and profiles — for example number of bookings, participants, wine clicks, cellar additions, average ratings and feedback.

Access to guest data within an importer organisation is controlled by role. Only team members with the editor, admin or owner role can view individual guest information. Viewer-role team members see only aggregated statistics.

Team members with the admin or owner role can also see which other team members have accessed information about individual guests.

If you have consented to profile sharing, importers that have arranged tastings you participated in can see your tasting history and ratings beyond a single tasting. All access to guest profiles is logged and can be disclosed to you on request.

Vinkretsen may show neutral links to public product pages at Systembolaget — for example "View at Systembolaget".

Vinkretsen does not sell alcohol, does not handle orders and has no shopping cart for alcoholic beverages.

Any purchase, order and pickup happens separately at Systembolaget or another legal external channel.

We use cookies and similar technologies to:

• make the website work;
• handle login and security;
• save settings;
• analyse usage if you accept analytics cookies;
• improve the service.

Necessary cookies are used for the service to function. Analytics and marketing cookies are used only if you consent where such consent is required.

You can change cookie settings via the website's cookie settings.

We keep personal data for as long as needed for the purposes set out in this policy.

Examples:

• account data is kept as long as the account exists;
• booking and payment data is kept according to legal and accounting rules;
• private cellar data and tasting notes are kept until you delete them or delete your account;
• logs are kept for a limited time for security and debugging;
• consents are kept as long as needed to demonstrate that consent was given or withdrawn.

If you opt out of email communication, your email address is kept on a suppression list to make sure you are not contacted again, even if a new account is created with the same address.

When data is no longer needed it is deleted or anonymised.

You have the right to:

• information about how your data is processed;
• request access to your personal data;
• request rectification of inaccurate data;
• request deletion in certain cases;
• request restriction of processing;
• object to certain processing;
• obtain certain data in a structured format;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Some rights may be limited — for example if we need to keep data to comply with legal requirements.

You can request deletion of your account via account settings. The account is then scheduled for deletion and anonymised within 30 days. During this period you cannot undo the action.

When an account is deleted some data may need to be kept for a limited time or anonymised — for example payment history, accounting records, security logs or content that needs to be preserved for community context.

Private cellars, private tasting notes and private tastings are deleted or anonymised according to our deletion process.

We use technical and organisational security measures to protect personal data.

This includes, among other things:

• access management;
• role-based access;
• Row Level Security in the database where applicable;
• server-side handling of secrets and tokens;
• encrypted communication;
• logging of important admin actions;
• limited access to sensitive data;
• protection against unauthorised access.

Some providers may process personal data outside the EU/EEA. In such cases appropriate safeguards must be used — for example standard contractual clauses or another lawful transfer mechanism.

We may update this privacy policy. For significant changes we inform you in an appropriate way — for example via the website or email.

The latest version is always available on Vinkretsen.