1. Data Controller
Sommly is operated by:
Rehland ApS
CVR: 46212606
Email: admin@sommly.dk
Copenhagen, Denmark
2. What data do we collect?
We collect the following personal data when you use Sommly:
- Account information: Email, name (optional)
- Wine data: Your cellar collection, ratings, notes, scan history
- Technical data: IP address, browser type, device info (via hosting provider)
- Images: Photos of wine labels you upload for scanning
- Notification data: Push subscription and notification history
- Purchase data: Purchase history, subscription status and app user ID (when purchasing a subscription)
3. Purpose of data processing
We use your data to:
- Create and manage your account
- Store and display your wine collection
- Recognise wines from images via AI (Anthropic Claude)
- Enrich wine data with AI-generated estimates (price, drinking window)
- Send service-related emails (password reset)
- Improve our service
- Analyse use of the service (product and business analytics) to improve and further develop Sommly
- Send marketing about Sommly and related offers (only if you have given separate consent)
4. Legal basis
We process your data on the following grounds:
- Contract: To deliver the service you signed up for, including processing purchases and subscriptions
- Consent: For AI analysis of your wine images, email notifications and marketing
- Legitimate interest: To improve and further develop the service (including product and business analytics on pseudonymised or aggregated data) and to prevent misuse
5. Data processors
We share data with the following third parties who process data on our behalf:
- Supabase (USA): Database and authentication
- Anthropic (USA): AI image recognition and enrichment of wine data (drinking window, tasting profile)
- Perplexity (USA): AI search for wine data enrichment
- Resend (USA): Transactional emails (password reset, notifications)
- Sentry (USA): Error tracking and performance monitoring
- Vercel (USA): Hosting, server infrastructure and anonymised usage statistics
- RevenueCat Inc. (USA): In-app purchase management and subscription verification
All data processors comply with the EU-US Data Privacy Framework or use EU-approved Standard Contractual Clauses (SCC) as the transfer mechanism.
6. Retention
We retain your data for as long as your account is active. Upon account deletion:
- Account data is deleted within 30 days
- Wine data and scan history are permanently deleted
- Backups are deleted within 90 days
7. Your rights
You have the following rights under GDPR:
- Access: View your data
- Rectification: Correct inaccurate data
- Erasure: Have your data deleted ("right to be forgotten")
- Data portability: Export your data (CSV export available)
- Objection: Object to certain types of data processing
- Withdrawal: Withdraw your consent
Contact us at admin@sommly.dk to exercise your rights.
8. Account deletion
You can delete your account and all associated data via Settings in the app. Deletion is permanent and cannot be undone.
9. Cookies and analytics
Sommly only uses technically necessary cookies for authentication and session management. We do not currently use tracking or marketing cookies; if this changes, we will update this policy and obtain your consent where required.
We collect two forms of usage statistics: (1) anonymised, cookieless statistics via Vercel Analytics with no personal data, and (2) product analytics of your in-app interactions (e.g. viewing subscription screens) that are linked to your account and used to improve and further develop the service. The latter is not shared with third parties for their own marketing.
10. Security
We protect your data with:
- Encrypted connection (HTTPS/TLS)
- Encrypted database
- Access control and authentication
- Regular security updates
11. Changes
We may update this privacy policy. For material changes, we will inform you by email. The latest version is always available on this page.
12. Children and age requirement
Sommly is not intended for children under 18. We do not knowingly collect data from individuals under 18. If we discover that a user is under 18, we will delete the account and associated data.
13. Complaints
If you believe we are not handling your data correctly, you may file a complaint with the Danish Data Protection Agency: www.datatilsynet.dk
14. Contact
Questions about the privacy policy can be directed to:
Email: admin@sommly.dk