Data Protection & Imprint

Name: DWINER
Author: DWINER OG

Privacy policy and legal notice

Legal notice

DWINER OG
Buchbergstraße 14
4814 Neukirchen
Austria

Email: support@dwiner.com
Phone: +43 664 814 9750
Website: https://www.dwiner.com

Company register number: FN 600675 x
Register court: Landesgericht Wels

Bank: Raika Salzkammergut
IBAN: AT04 3451 0000 0394 8650
BIC: RZOOAT2L510

Image credits, web design and development: DWINER OG

1. Controller

The controller under Article 4(7) GDPR is DWINER OG, Buchbergstraße 14, 4814 Neukirchen, Austria, email support@dwiner.com (“we” or “DWINER”).

This notice covers the website www.dwiner.com and the DWINER app (web, iOS and Android). The app is software for managing your own wine cellar. There is no separate data protection officer. Privacy requests go to the address above.

2. Data we process

2.1 Website

When you open the website, the web server processes data that are technically required: IP address, date and time, address requested, referrer, amount of data transferred, HTTP status, browser type, operating system and language. This is needed to deliver the site and to detect abuse.

If you write to us or use the form on the business page, we process the details you enter (usually name, email address, company and message).

2.2 Account

The app needs an account. We process your email address, a password that we do not store in plain text (for email login), and profile data you create. You can also sign in with a Google account or with Apple. In the Google case, Google learns that you are signing in to DWINER; Google processes that under its own rules. With Apple you can hide your email address from DWINER (Private Email Relay). Apple processes the sign-in under its own rules. We do not use these sign-in data for advertising and we do not link them with other providers’ data for advertising.

To perform the contract we store your plan, term, scan counter and the technical identifier of your subscription.

2.3 Cellar and content you upload

What you enter in the app we store for you: wines, storage locations, stock, movements, tasting notes, lists, imports from Excel or CSV, and photos of labels, receipts and dishes. Invoices and delivery notes may contain other people’s names. You are responsible for that; upload such files only if you are entitled to do so.

2.4 AI features

The scanner, food pairing and the completion of wine or price data evaluate content with an AI service. For that we send the image and the wine fields needed to OpenAI. Suggestions can be wrong. What is stored is what you accept.

2.5 Payment

New subscriptions run through the App Store (Apple), Google Play or, on the website, through RevenueCat Web Billing (payment processing by Stripe). We do not receive the full card number, only the subscription status and a customer identifier. Existing PayPal subscriptions from the earlier app continue until they are cancelled. We no longer start new PayPal subscriptions.

2.6 Push notifications

If you allow notifications, we store a device token and send messages via Firebase Cloud Messaging (Google), for example when the scan quota resets. Without your permission in the system dialog we do not send a push notification.

3. Purposes and legal bases

Providing the website, account and app, including storage of your cellar: Article 6(1)(b) GDPR (contract) and, where you use the app free of charge, Article 6(1)(b) and (f) GDPR.
Scanner, food pairing and data enrichment as part of the app: Article 6(1)(b) GDPR.
Billing, accounting and statutory retention: Article 6(1)(b) and (c) GDPR.
Security, stability and prevention of abuse: Article 6(1)(f) GDPR.
Push notifications and any newsletter: Article 6(1)(a) GDPR (consent). You can withdraw consent, for push in the device system settings, for email via the unsubscribe link.
Service emails about the account (confirmation, password, quota notices): Article 6(1)(b) GDPR.

We do not ask for a special category of data within the meaning of Article 9 GDPR.

4. Recipients

Your cellar, account and uploaded files are not stored on the website’s web space. They are stored with Supabase. Supabase is a processor under Article 28 GDPR. Production data are stored in the London region (United Kingdom, location eu-west-2). An adequacy decision of the European Commission applies to the United Kingdom (Article 45 GDPR). Supabase’s infrastructure runs on Amazon Web Services.

The public website and the static files of the web app are hosted by conova communications GmbH in Austria. That is shared hosting and is permissible because the provider is based in the EU and no cellar or account data are stored there. What is processed are the technical access data of the website and form entries. Where conova acts on our instructions, a processing agreement is in place.

Further recipients:

OpenAI (USA): images and the wine fields needed for the scanner, food pairing, catalogue enrichment and market price. Processor. Transfer to the USA on the basis of standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Brevo (France): sending of system and service emails and, if you have agreed, information about DWINER. Processor in the EU.
Google (Google Ireland Limited and Google LLC, USA): sign-in with Google as its own controller for the Google account; Firebase Cloud Messaging for push tokens. Transfers to the USA on the basis of the Data Privacy Framework or standard contractual clauses.
Apple: Sign in with Apple as its own controller for the Apple ID. If you choose Hide My Email, we only receive a relay address. No sharing for advertising.
RevenueCat (USA): subscription status via the App Store, Play Store and web billing. Processor. The same transfer basis for the USA.
Stripe (including Stripe Payments Europe, Ireland): payment when you subscribe on the web. Own controller for the payment data, otherwise a processor of RevenueCat.
Apple and Google Play: purchase and management of in-app subscriptions. Own controllers for the store account and the payment.
PayPal (Europe, Luxembourg): only for existing legacy subscriptions.

We do not pass data to other third parties for advertising and we do not sell the data. Authorities receive data only where we are obliged to provide them.

Wine details without a personal reference (such as name, origin, vintage) may be used to maintain the shared catalogue. Price observations may feed into market-price hints in anonymised form. We do not pass your cellar, notes, photos, receipts or account data to other users.

5. Storage period

We store account data and cellar data for as long as the account exists. If you delete the account in the app, we delete these data unless a statutory duty says otherwise. Backups may continue for a limited time.

If a paid subscription ends and you do not delete the account, access to your data remains for two months so that you can export. After that we delete the cellar data unless a retention duty applies.

We keep invoices and payment data relevant to accounting for the statutory period, in Austria usually seven years.

We delete or shorten website server logs once they are no longer needed for security and operation, usually after a few weeks.

We delete push tokens when you withdraw the notification, delete the account, or the token becomes invalid.

6. Cookies

The website sets cookies and similar techniques that are needed to run it (for example display and security). We set optional cookies, in particular for statistics or marketing, only if you agree in the cookie notice. You can delete or block cookies in the browser. The app stores the sign-in locally on the device; that is required for login.

7. Duty to provide data

Without an email address and acceptance of the terms of use we cannot create an account. All further details about wines are voluntary; without them the related features are missing.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and to object to processing based on Article 6(1)(f) GDPR, and the right to withdraw consent with effect for the future (Articles 15 to 21 GDPR).

You can export lists in the app as PDF or Excel. A full export of the account is via support@dwiner.com.

Complaint to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.

We reply within one month.

9. Version

Version: 28 September 2026.