Privacy Policy.

1. Data Controller

The data controller responsible for your personal information is:

2. Data We Collect

We collect the following categories of information when you use the App:

Information you provide

• Email address and account information (upon registration)
• Wine bottle data (name, vintage, region, tasting notes, photos)
• App preferences and settings

Information collected automatically

• Device identifiers and technical information (model, iOS version, language)
• Usage and interaction data (features used, frequency of use), only if you turn on usage analytics — this is off by default
• Crash reports, only if you choose to share them with app developers in your iPhone's settings (provided by Apple)

Camera data

• The App may access your camera for two features: scanning a wine label to add a bottle to your cellar, and photographing a restaurant wine list for the Caviste. In both cases, the photo is sent to our AI provider, Anthropic (Claude), in the United States, and used only to identify the wine or read the wine list — see Section 10 for details on our providers. Photos are not stored by Thirsty Cellar.
• Wine label scanning has its own consent, asked in the App before you use it. You can turn it off at any time in Profile → Privacy.
• Wine-list scanning is part of the Caviste and requires the Caviste consent. It is limited to 30 scans per day.

Caviste data

• To answer, the App sends your question and the recent messages of the conversation (up to the last 10) to an AI model provider in the United States: Fireworks AI, or Anthropic (Claude) if Fireworks is unavailable. Photos of wine lists go to Anthropic so they can be read.
• For cellar recommendations (Thirsty membership), we also send the wines in your cellar (name, producer, vintage and style, up to 50 bottles) and a short summary of your taste, drawn from your ratings and wishlist (for example, the styles you rate highly or low).
• We never send your name, email or account. Email addresses and phone numbers in your messages are removed before they are sent.
• The providers don't use your data to train their models. We keep your conversations in your Thirsty Cellar account so you can reopen them (History), until you delete your account.
• The App asks for your consent before you first use the Caviste, and asks again whenever the consent text changes. You can withdraw your consent at any time in Profile → Privacy.

Location

If you allow location, the Caviste uses the city you're in to suggest wine bars and bottles near you. Your phone works out the city using Apple's location service; only the city and country are sent to Thirsty Cellar and passed to our AI provider with your question. Your exact position is never sent to us or to the AI provider, and the city is not stored. You can refuse or withdraw location access at any time in your iPhone settings; the Caviste then asks where you are instead.

3. How We Use Your Data

Your data is used for the following purposes:

• Provide, maintain, and improve the App's features
• Manage your account and personal cellar
• Answer your questions and make recommendations through the Caviste
• Enable wine label scanning and recognition, and wine-list reading
• Send service-related notifications (updates, important changes)
• Analyze App usage for improvement purposes, only if you opt in to usage analytics
• Ensure security and prevent abuse

4. Legal Bases for Processing

In accordance with the General Data Protection Regulation (GDPR) and Quebec's Law 25, we process your data on the following bases:

• Performance of contract: processing is necessary to provide you with the App's services
• Consent: when you expressly agree to certain processing (e.g., the Caviste, wine label scanning, usage analytics, camera access, notifications)
• Legitimate interest: to keep the App secure and working properly (e.g., preventing fraud and abuse)

5. Data Sharing

We do not sell your personal information. We may share your data with:

• Service providers: technical partners who help us operate the App (hosting, AI processing, subscriptions, analytics), bound by confidentiality obligations — see Section 10
• Legal obligations: when required by law or in the context of legal proceedings

No data is transferred for advertising or commercial profiling purposes.

6. Data Retention

Your data is retained for as long as your account is active or as needed to provide the App's services.

Caviste conversations are kept in your account so you can reopen them (History), until you delete your account.

Photos of wine labels and wine lists are not stored by Thirsty Cellar: they are sent to Anthropic for processing only.

If you delete your account, your personal information will be erased within 30 days, except for data we are required to retain under applicable law.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, loss, destruction, or alteration, including:

• Encryption of data in transit (TLS/SSL)
• Restricted access controls to personal data
• Continuous system monitoring

8. Your Rights

Depending on your place of residence, you have certain rights regarding your personal data:

Rights under Quebec's Law 25 and the GDPR (Europe)

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request the deletion of your data
• Right to portability: receive your data in a structured, machine-readable format
• Right to object: object to certain processing of your data
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing
• Right to file a complaint: with the Commission d'accès à l'information du Québec (CAI) or the data protection authority of your country

Rights under CCPA / CPRA (California)

• Right to know: what personal data is collected, used, and shared
• Right to deletion: request the deletion of your personal data
• Right to opt out of sale: we do not sell your personal data
• Right to non-discrimination: you will not be penalized for exercising your rights

To exercise any of these rights, please contact us at support@thirstyc.com. We will respond to your request within the timeframes required by applicable law.

9. Children's Data

The App is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@thirstyc.com so we can delete that information.

10. Third-Party Services

The App relies on the following service providers (sub-processors) for its operation. Several are located in the United States, which means your information may be processed outside Quebec. These services have their own privacy policies and we encourage you to review them.

• Supabase — United States (AWS us-west-2, Oregon). Hosts the App's database and runs its server functions: your account, your cellar and your Caviste conversations are stored there.
• Fireworks AI, Inc. — United States. Primary AI model provider for the Caviste. Receives your question, the recent messages of the conversation and, for cellar recommendations, your cellar wines and taste summary, as described in "Caviste data" in Section 2.
• Anthropic (Claude API) — United States. Answers Caviste requests when Fireworks AI is unavailable, reads photos of restaurant wine lists, and identifies wines from label photos. Photos are not stored by Thirsty Cellar.
• RevenueCat. Manages in-app subscriptions and purchases.
• PostHog. Product analytics, off by default and used only if you opt in (Profile → Privacy).

These AI providers don't use your data to train their models.

The App may also contain links to external websites or services. We are not responsible for the privacy practices of these third parties.

11. Changes to This Policy

We may update this privacy policy from time to time. In the event of a material change, we will notify you through the App or by email before the changes take effect.

We encourage you to review this page regularly to stay informed about our privacy practices.

12. Contact Us

For any questions or requests regarding this privacy policy or the processing of your personal data, please write to us: