Privacy Policy

Last updated: August 18, 2026

This Privacy Policy explains how Duo Vino (“Duo Vino”, “we”, “us”, “our”) collects, uses, shares and protects your personal data when you use the Duo Vino mobile app (the “App”) and this website (together, the “Service”). We collect only what we need to run the Service, we are transparent about the AI features that process your input, and we never sell your personal data.

1. Who we are (data controller)

The controller of your personal data is EduBR Wojciech Kreft, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland, with its place of business at ul. Biskupia 18/20, 04-216 Warszawa, Poland (NIP 7760001983, REGON 610003510).

For any question about this policy or your data, or to exercise your rights, contact us at support@duovino.app.

2. The personal data we collect

• Account data. To create an account we collect your email address and a password. Passwords are stored only in hashed form by our authentication provider; we never see them in plain text.
• Sign in with Apple / Google. If you choose social sign-in, we receive a stable user identifier and your email address from Apple or Google (Apple may provide a private relay email). We do not receive your Apple or Google password.
• Profile. An optional display name, and the learning goal you pick during onboarding (for example “pass WSET Level 2”).
• Learning activity. Your progress in the App: lessons completed, quiz and mock-exam results, flashcard reviews, streaks, XP and level, guided-tasting notes, and similar practice data. We use this to save and sync your progress and to power features such as the Exam Readiness dashboard.
• AI feature input and output. Duo Vino includes optional AI features powered by Google’s Gemini API (see section 4). When you use them we process: the questions you type to the “Ask Corky” tutor; the text transcript of what you say during a guided tasting (your speech is transcribed on your device; we do not upload the raw audio); and photos of wine labels you take with the Wine Scanner. Your Ask Corky conversations and Wine Scanner results are saved to your account so they can sync across your devices.
• Photos and camera. With your permission, the App uses your camera or photo library so you can add a wine-label or bottle photo. A label photo used with the Wine Scanner is sent to the AI provider for recognition; a photo you simply attach to a tasting note is handled as part of that note.
• Microphone. With your permission, the App uses your microphone so you can dictate tasting notes. Speech is converted to text on your device.
• Purchases. If you buy Premium, the transaction is processed by the Apple App Store or Google Play. We (through RevenueCat) receive your subscription status and related identifiers, not your card or bank details.
• Notifications. If you enable reminders, they are scheduled on your device.
• Technical and usage data. Our providers automatically process limited technical data needed to deliver and secure the Service, such as IP address, device/app version and server logs. On this website we use privacy-friendly, cookieless analytics (see section 9).

We do not knowingly collect special categories of data, and we ask you not to include sensitive personal information in free-text fields such as tasting notes or Ask Corky messages.

3. Why we use your data and our legal bases

Under the GDPR we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): to create and secure your account, save and sync your learning progress, provide the AI and Premium features you request, and manage your subscription.
• Legitimate interests (Art. 6(1)(f)): to keep the Service reliable and secure, prevent abuse, fix bugs, and improve the product. You can object to processing based on legitimate interests (section 7).
• Consent (Art. 6(1)(a)): for optional device permissions (camera, microphone, notifications) and for any future marketing messages. You can withdraw consent at any time, without affecting processing already carried out.
• Legal obligation (Art. 6(1)(c)): to keep limited records (for example for tax or accounting purposes relating to purchases).

4. AI features and Google Gemini

Ask Corky, guided tastings and the Wine Scanner send your input — text you type, the on-device transcript of your speech, or a wine-label photo — to Google’s Gemini API, which returns the answer, tasting card or identification shown in the App. This processing happens only when you use those features.

Google acts as our processor for these requests. Under the terms that apply to the paid Gemini API, Google does not use this input or output to train its general models. Please avoid entering personal or sensitive information you would not want processed by a third-party AI service. AI output can be inaccurate and is provided for education and entertainment, not as professional advice.

5. How your data is shared

We do not sell your personal data. We share it only with service providers (processors) that help us run Duo Vino. Each is bound by a data-processing agreement (as required by Article 28 GDPR) that requires them to protect your data and to process it only on our instructions:

• Supabase — database, authentication and backend that store your account, learning and AI-history data.
• Google — the Gemini API (AI features), Sign in with Google, and Google Play (distribution and payments).
• Apple — Sign in with Apple and the App Store (distribution and payments).
• RevenueCat — management of subscription status.
• PostHog — privacy-focused product analytics, hosted in the EU, that tells us which features are used and where people get stuck (see section 9).
• Google Workspace / Gmail — delivery of account emails such as password resets.
• Cloudflare — hosting and security for this website, including the password-reset page.

We may also disclose data where required by law, or to establish, exercise or defend legal claims, or to protect the rights and safety of our users and the Service.

6. Where your data is stored and international transfers

Our database and authentication (Supabase) are hosted in the European Union (Ireland), so your account, learning and AI-history data are stored within the European Economic Area (EEA). Some other providers process data outside the EEA, in particular Google (the Gemini AI features), Apple and RevenueCat, which operate in the United States.

For transfers outside the EEA we rely on appropriate safeguards: the European Commission’s Standard Contractual Clauses and, where the provider is certified, an adequacy mechanism such as the EU–U.S. Data Privacy Framework. You can ask us for a copy of, or more information about, these safeguards using the contact details above.

7. Your rights

Subject to applicable law, you have the right to access your personal data; to have it corrected or erased; to restrict or object to its processing; to data portability; and to withdraw consent at any time. You can view and edit your profile in the App, and you can permanently delete your account and its data at any time from Settings in the App (this also revokes the Sign in with Apple connection where used), or by emailing support@duovino.app.

To exercise any right, contact us at support@duovino.app; we respond within the time limits set by law. If you are in the EEA and believe we have not handled your data properly, you may lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). If you are in the UK, you may contact the Information Commissioner’s Office; in California, you have rights under the CCPA/CPRA, and we do not sell or “share” your personal information.

8. Data retention

We keep personal data only for as long as we need it for the purposes above:

• Account, profile, learning and AI-history data — for as long as your account exists. When you delete your account, we delete this data from our active systems without undue delay (normally within 30 days).
• Purchase and billing records — retained for 5 years counted from the end of the accounting year, as required by Polish tax and accounting law.
• Backups and security logs — kept for a limited period (generally up to 90 days) and then deleted or overwritten.
• Data needed to establish, exercise or defend legal claims — kept until the relevant limitation periods have expired.

9. Analytics and cookies

Website. This website does not use advertising or tracking cookies. We use privacy-friendly, cookieless analytics to understand aggregate traffic (for example page views), which does not identify you individually.

App. In the app we use PostHog (hosted in the EU) to understand how features are used and where people run into difficulty, so we can improve Duo Vino. We record product events — for example screens opened, features started, quizzes completed, and whether the Premium screen was reached — keyed to your account’s identifier. We do not use this for advertising, we do not record your screen, and these events do not contain the content of your tasting notes or Ask Corky messages. We rely on our legitimate interest in improving the Service (section 3); you can object using the contact details above.

10. Children

Duo Vino is about wine and is intended only for adults of legal drinking age in their country. It is not directed to children, and we do not knowingly collect data from anyone under that age. If you believe a minor has provided us with personal data, contact us and we will delete it.

11. Security

We use reputable providers and reasonable technical and organisational measures to protect your data, including encryption in transit, access controls, and row-level security on your records. No method of storage or transmission is completely secure, but we work to keep your information safe and will notify you and the relevant authority of a personal-data breach where the law requires it. We also maintain internal records of our processing activities in line with Article 30 of the GDPR.

12. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you in the App or by email. Your continued use of the Service after an update means you accept the revised policy.

13. Contact

Questions about your privacy or this policy? Email support@duovino.app and we will help.