This Privacy Policy explains how PorteVin OÜ handles personal data when you visit winegate.app, use WineGate on the web or in our iOS and Android apps, or write to us.
Contents
Who we are
WineGate is a business-to-business platform for the European drinks trade, operated by PorteVin OÜ, registry code 17473145, Karusambla tee 25, Leppneeme küla, 74009 Harju maakond, Estonia. PorteVin OÜ is the controller of the personal data described here. Contact: privacy@winegate.app.
WineGate is used by companies. The personal data we handle is mostly that of the people who work for them: the account holder, colleagues they invite, and the contact people on orders.
What we collect
| Category | Examples |
|---|---|
| Account | Name, work email, password (stored as a hash), sign-in with Apple or Google identifiers, role in the company, notification settings |
| Company and review | Company name, type, country, VAT number, excise (SEED) number, address, company documents you upload, the result of our review |
| Market activity | Lots, photographs, prices, requests, quotes, offers, bids, watchlist, partnerships, the company page |
| Messages | Messages and attachments exchanged with other companies on WineGate |
| Orders | Order contents, contact person, delivery address or excise warehouse, invoices attached to the order, claims |
| Fees | Fee invoices, billing contact and payment status, handled through Stripe |
| Tax reporting (sellers) | Legal name, address, VAT and tax identification numbers, registration number, number of paid orders, amounts and fees per quarter |
| Acceptance records | Which version of our terms you accepted, for which company, when, and the IP address and browser the acceptance came from |
| AI requests | Questions you ask the assistant and labels, price lists and documents you give it to read |
| Support | Messages you send us and our replies |
| Technical | Device and app version, IP address, push-notification tokens, error logs |
We do not sell personal data and do not use advertising trackers.
Why we use it
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Running your account and the Service: the market, messages, orders, tools, the assistant, notifications | Contract (6(1)(b)) |
| Reviewing companies before they trade, and keeping the market free of fraud and abuse | Legitimate interests (6(1)(f)): a market of real companies |
| Invoicing fees | Contract (6(1)(b)); accounting law (6(1)(c)) |
| Reporting sellers to the tax authority under DAC7, keeping accounting records | Legal obligation (6(1)(c)) |
| Keeping a record of the terms you accepted | Legitimate interests (6(1)(f)): proving our contracts |
| Answering support requests and sending service notices | Contract (6(1)(b)) |
| Fixing errors and improving the Service | Legitimate interests (6(1)(f)) |
Where we rely on legitimate interests, you can object at any time by writing to privacy@winegate.app.
What other companies see
- Your company page (app.winegate.app/@handle) is public: company name, country, type, the Verified mark and the lots you show there.
- Lots, requests and quotes show your company's name to the companies allowed to see them.
- Messages are read by the members of the companies in the conversation.
- Orders: the seller sees the buyer's company name, VAT number and country, the name and contact details of the person who placed the order and the delivery address or excise warehouse; the buyer sees the same about the seller. Each uses them for that order and its own legal duties.
Service providers
These providers process personal data for us under written agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage | EU (Frankfurt) |
| Vercel Inc. | Hosting of the web app, the website and the server functions | EU and global edge |
| Anthropic, PBC | The AI assistant and reading of labels, price lists and documents | USA |
| Stripe Payments Europe, Limited | Fee invoices | EU (Ireland) |
| Resend, Inc. | Service emails | USA |
| Google LLC (Firebase Cloud Messaging) | Push notifications on Android | USA |
| Apple Inc. | Push notifications on iOS, Sign in with Apple | USA |
| Google LLC | Sign in with Google | USA |
Anthropic processes what you send to the assistant to produce an answer and, under its commercial terms, does not use it to train its models.
Tax authorities
Under Council Directive (EU) 2021/514 (DAC7), we report information about sellers once a year to the Estonian Tax and Customs Board, which passes it to the tax authorities of the member states concerned. Sellers receive a copy of what we report about them. We also disclose data when another law, a court or a competent authority requires it.
Transfers outside the EEA
Some providers above are in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
How long we keep it
- Account, company and market data — while the account exists; deleted when you delete the account, except as below.
- Orders, invoices and fee records — 7 years from the end of the year, as Estonian accounting law requires.
- Tax reporting data — for the period the DAC7 rules require, up to 10 years.
- Acceptance records — for the life of the contract and the limitation period after it, up to 10 years; your name is removed and your email kept with the record.
- Messages — while either company in the conversation has an account.
- Error logs — up to 90 days.
Your rights
You can ask for access to your personal data, its correction or deletion, a restriction of its use, a copy in a portable format, and you can object to processing based on legitimate interests. You can delete your account yourself in the app (Account → Delete account). Write to privacy@winegate.app; we answer within one month. You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or the authority in your own country.
Security
Data is encrypted in transit and at rest on our providers' platforms. Each company's data is separated at the database row level, staff access needs two-factor authentication, and we record administrative actions. If a breach puts your data at risk, we tell the Estonian Data Protection Inspectorate within 72 hours and you without undue delay. More on the Security & data page.
Age
WineGate is a service for businesses trading in alcohol. People under 18 may not use it.
Cookies
The Cookie Policy explains the cookies and local storage we use.
Changes
We tell you about material changes by email and in the app before they take effect. Each version carries its date at the top of this page.
Contact
Controller: PorteVin OÜ, registry code 17473145
Address: Karusambla tee 25, Leppneeme küla, 74009 Harju maakond, Estonia
Email: privacy@winegate.app