1. Who we are
Grape is operated by Grapemind ApS, based in Copenhagen, Denmark. If you have any questions about this policy, contact us at hello@grapemind.com.
2. What data we collect
We collect the following categories of data when you use Grape:
- Account information — your name and email address when you register.
- Wine ratings and feedback — the ratings you give wines (Love, Really Like, Like, Meh, Dislike) and any preferences you express in the taste quizzes.
- Taste profile — a derived profile based on your ratings, capturing preferences across attributes such as body, sweetness, tannins, acidity, and alcohol. This is calculated by us from your ratings data.
- Scanned wine labels — if you use the camera feature to scan a bottle, we process the image via GPT-4 Vision to identify the wine. Images are stored temporarily during processing and then deleted; a text record of the detected wine and its link to your account is retained.
- App usage data — which stores and wines you browse, which recommendations you act on. This is used to improve your recommendations and the service.
- Device and session data — information your device or browser sends automatically, such as device type, OS version, and session tokens needed to keep you logged in.
3. How we use your data
We use the data we collect to:
- Provide and personalise the Grape recommendation service.
- Improve the accuracy of your taste profile and the wines we surface to you.
- Send you onboarding and product emails if you have not opted out (you can unsubscribe at any time via the link in any email).
- Operate and improve the Grape app and backend services.
- Comply with legal obligations where required.
We do not use your data for advertising purposes or share it with advertisers. We do not sell your personal data to any third party.
4. Legal basis for processing (GDPR)
We are based in Denmark and process your data in accordance with the EU General Data Protection Regulation (GDPR). Our legal bases are:
- Contract — processing necessary to provide you with the Grape service you signed up for (Article 6(1)(b)).
- Legitimate interests — improving the service, detecting misuse, and communicating relevant product updates (Article 6(1)(f)).
- Consent — for optional email communications; you may withdraw consent at any time.
5. Third-party services
We use a small number of third-party services to operate Grape:
- Resend — for sending transactional and onboarding emails. Your email address is shared with Resend only for this purpose. See Resend's privacy policy.
- OpenAI — for AI-powered wine label detection (GPT-4 Vision). Images you submit for scanning are sent to OpenAI for analysis. OpenAI does not use your data to train its models by default. See OpenAI's privacy policy.
- Neon (PostgreSQL) — our database provider, used to store your account and preferences data securely.
- Replit Object Storage — for storing wine and store images. No personal data is stored here.
6. Data retention
We retain your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required by law to retain it for longer.
Scan images are deleted from our processing pipeline after identification. Text records of scanned wines linked to your account are retained as part of your activity history.
7. Cookies and local storage
The Grape mobile app uses secure local storage on your device to store your session token so you stay logged in. We do not use advertising or tracking cookies. The Grape website (grapemind.com) uses only a session cookie required for authentication to the admin panel; no third-party tracking cookies are used.
8. Your rights
Under GDPR, you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate data.
- Deletion — ask us to delete your personal data ("right to be forgotten").
- Portability — request your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — for any processing based on consent (e.g. marketing emails) at any time.
To exercise any of these rights, email us at hello@grapemind.com. We will respond within 30 days. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.
9. Data security
We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS) and hashed passwords. Access to personal data is limited to those who need it to operate the service. No system is completely secure, and we cannot guarantee absolute security, but we take our responsibility seriously.
10. Children
Grape is an app about wine and is intended for users aged 18 and over. We do not knowingly collect data from people under 18. If you believe a minor has created an account, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify registered users by email. The updated policy will always be available at grapemind.com/privacy.
12. Contact
For any privacy-related questions or requests:
Grapemind ApS
Copenhagen, Denmark
hello@grapemind.com