Privacy Policy
Last technical review: 16 August 2026.
Provisional document: public registration must not open until the controller is identified, a verified rights channel is published, and legal bases, retention, processors, and transfers are finalised.
This page transparently describes the processing carried out by the current WineTourism MATCH candidate; it does not replace the legal review required before launch.
Data processed
Account: email, authentication identifiers, and profile fields you choose to complete. Affinity: answers, questionnaire version, vector, and result. Use: saved items, inquiries, messages sent to Sommy, technical identifiers, session cookies, and security logs. These data must not be called anonymous when they can be linked to an account or device.
Purposes
Authenticate and protect the account; calculate and save a profile when requested; order experiences; maintain saved items and inquiries; answer through Sommy; prevent abuse; diagnose faults; and operate the service. Answers or conversations must not be reused for incompatible purposes without further information and a valid legal basis.
Profiling and decisions
The test creates an indicative affinity profile and automated recommendations. It does not make decisions with legal effects or claim to diagnose psychological traits. You can explore without saving the result to an account.
Technology providers
The candidate uses Supabase for data and authentication, Hetzner infrastructure for the application, and OpenRouter for Sommy. SMTP and monitoring providers must be identified when appointed. Processor terms, locations, subprocessors, and international-transfer safeguards must be finalised before launch.
Legal basis and retention
Performance of the requested service, security interests, and consent where appropriate may be relevant; the final allocation and category-specific retention periods must be documented before real users are acquired. Deletion, export, and backup processes must align with those periods.
Rights and complaints
Access, rectification, erasure, restriction, objection, and portability must be available through a verified channel that has yet to be published. In Spain, you may also complain to the Spanish Data Protection Agency.
Local storage and children
The test may use local or session storage to resume progress and temporarily preserve a result. Before launch, its duration must be documented, a minimum age defined, and consent enabled for any non-essential analytics.