Privacy
Privacy policy
How ARCLAY processes your personal data when you use the Tannin website and app. Last updated: October 27, 2026.
Data controller
The data controller is ARCLAY, a simplified joint-stock company (SAS) registered with the Bordeaux Trade and Companies Register (RCS) under number 922 105 317, with its registered office at 31 rue Capdeville, 33000 Bordeaux, France. For any questions regarding your data, write to the contact address provided in the legal notice.
Data we collect
• Account data: email address, name if provided, language, password (stored encrypted), or third-party login ID.
• Cellar data: wines, racks, slots, quantities, purchase prices, drinking windows, tasting notes, history of consumed bottles, invited guests.
• Photos: photos of labels and bottles that you take or import.
• Text and voice recordings entered for plain-language updates, transcribed, then processed.
• Payment data: processed by our payment provider; we do not store your card number.
• Technical data: IP address, device and browser type, connection logs, aggregated usage metrics.
Why we process them
• Providing the service: hosting your cellar, displaying your racks, calculating drinking windows and value, generating exports and reports (performance of the contract).
• Operating AI features: label reading, value estimation, drinking window suggestions, interpretation of typed or dictated phrases (performance of the contract).
• Managing subscriptions, billing, and accounting (performance of the contract and legal obligation).
• Ensuring service security and preventing abuse (legitimate interest).
• Keeping you informed about service updates; you can opt out at any time (legitimate interest, or consent for marketing messages).
• Measuring website and app usage on an aggregated basis (legitimate interest, or consent when non-essential cookies are used).
Sub-processors and recipients
Your data is processed by ARCLAY and the following service providers, each for the stated purpose:
• Vercel Inc. (United States): app hosting.
• Framer B.V. (Netherlands): showcase website hosting.
• Anthropic (United States): processing by its AI model of label photos, entered or dictated text, and wine data required for estimates. In the Free plan, this processing is carried out using your own API key, under your contract with this provider.
• Our payment provider: collection of subscription payments.
People you invite to your cellar can view its data, based on the access level you grant them. We do not sell your data or share it with third parties for advertising purposes.
Transfers outside the European Union
Some service providers are based in the United States. Transfers are governed by the European Commission's standard contractual clauses or by an adequacy decision. When available, we choose data hosting within the European Union.
Retention periods
• Account and cellar data: for the lifetime of your account, then deleted within thirty days of its deletion, unless otherwise required by law.
• Invoices and accounting data: ten years, in accordance with legal obligations.
• Technical logs: twelve months at most.
• Photos and text sent to the AI model: not retained by the provider beyond processing, in accordance with its commitments applicable to API use.
Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability, as well as the right to set directives regarding its handling after your death. The CSV export available in the app fulfills the right to data portability for your cellar data. To exercise your rights, write to us at the contact address; we respond within one month. You may file a complaint with the CNIL (cnil.fr), the French data protection authority.
Cookies
The showcase website uses only strictly necessary cookies and trackers, and where applicable, privacy-friendly analytics that require no consent. The app uses cookies or local storage required for your login and preferences. No advertising cookies are used.
Security
Data is transmitted in encrypted form (HTTPS) and stored with hosting providers that apply recognized security measures. Internal access is limited to the people who need it. In the event of a data breach that poses a risk to your rights, we will notify you in accordance with the applicable regulations.
Changes
This policy may change. The update date appears at the top of the page, and you will be notified of significant changes in the app.