Who we are
Enori ("the app", "we", "us") is a mobile application that helps adults choose food-and-drink pairings from a restaurant menu. Enori is operated by Alpine Apps GmbH ("the company"), the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
- Data controller: Alpine Apps GmbH
- Contact: privacy@enori.wine
This policy explains what we collect, why, who we share it with, how long we keep it, and the rights you have over your data.
The short version
- The app is for adults of legal drinking age only.
- We collect the minimum we need: your sign-in identity, your taste preferences, the menu photos you scan, the recommendations we return, and your feedback.
- We do not sell your data, and we do not use it for advertising. The app contains no ads and does not use an advertising ID.
- We do not use your photos or your free-text reviews to train AI models without your explicit, separate consent (which is off by default).
- You can delete your history or your entire account from inside the app at any time.
1. Data we collect and why
| Category | Examples | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Identity | Email and the user ID from your Google (or Apple) sign-in | Create and secure your account; sync across devices | Contract |
| Profile | Optional display name, legal-age confirmation, language/locale | Personalisation; legal-age compliance | Contract / Legal obligation |
| Preferences | Style, budget, adventurousness, explanation depth, dietary notes | Personalise recommendations | Contract |
| Scans | The menu photo, extracted text, OCR confidence, detected language | Generate your pairing and keep your history | Contract |
| Recommendations | The structured result we returned to you | Your history; quality improvement | Contract / Legitimate interest |
| Feedback | Your rating of a saved pairing and optional free-text review | Improve recommendation quality | Legitimate interest |
| Subscription | Your entitlement state (active / inactive) from our payments provider | Unlock premium features | Contract |
| Technical logs | Endpoint, model, tokens, latency, cost — no message content, no personal data | Cost accounting and reliability | Legitimate interest |
| Security logs | Event codes for auth, access-denied, age-gate, deletion — no content, no personal data | Security and abuse prevention | Legitimate interest |
What we do not collect
- Phone number, postal address, or contacts.
- Payment card details — handled by our payments provider (RevenueCat / the app store); we never see or store them.
- Location — the app does not request or collect your location.
- An advertising ID — the app does not use one.
- Health data.
2. Who we share data with
We do not sell your personal data and we do not share it for advertising. We use a small set of service providers who process data on our behalf, under data-processing agreements:
- Supabase — authentication, database, file storage, and backend functions.
- RevenueCat — subscription receipts and entitlement state (no message content).
- Anthropic (Claude API) — receives the menu text, and optionally the menu image, only for the duration of a single request, to generate your recommendation. Processing occurs in the United States under Anthropic's Data Processing Agreement and Standard Contractual Clauses. Anthropic's commercial terms include a no-training-on-customer-data commitment for this traffic.
- Google / Apple — sign-in, app distribution, purchase receipts, and store-level crash reporting.
Each provider is bound to use the data only to provide the service to us.
3. International transfers
Some processing (notably the AI step via Anthropic) takes place in the United States. Where we transfer personal data outside the EU/EEA, we rely on Standard Contractual Clauses and the providers' data-processing agreements. This arrangement is appropriate for the closed beta and will be re-evaluated before public launch.
4. How long we keep data
| Data | Default retention | Your control |
|---|---|---|
| Menu photos | 30 days, then deleted from storage | Delete any time in the app |
| Extracted text & recommendations | Kept while you keep the history item | Delete with history |
| Feedback | Kept; pseudonymised after you delete the related history | — |
| Technical logs (no personal data) | 90 days | — |
| Security logs (no personal data) | 365 days | — |
When you delete your account, we remove your data within 30 days, keeping only a pseudonymised record that an account once existed (for accounting and abuse prevention) and aggregated, non-identifying statistics. See how to delete your account and data.
5. Your rights
Under the GDPR you have the right to access, correct, delete, restrict, object to, and port your personal data, and to withdraw consent at any time.
- Delete in-app: the Settings screen lets you delete your history or your entire account.
- Data export: available on request.
- Requests & complaints: contact privacy@enori.wine. You may also lodge a complaint with your local data-protection authority.
6. AI training and your content
We do not use your photos or your free-text reviews to train AI models without your explicit, separate consent. This consent is off by default and can be toggled in the app's privacy settings; turning it off also excludes your prior content from future training runs. We never share your images or review text with third-party model trainers.
7. Children
Enori is intended for adults of legal drinking age and is not directed to children. We do not knowingly collect data from children; if we learn that an account belongs to a minor, we delete it.
8. Security
- In transit: all traffic uses HTTPS.
- At rest: encryption managed by our infrastructure provider.
- Secrets: payment and AI-provider credentials are kept on the backend only and never ship inside the mobile app.
No method of transmission or storage is perfectly secure, but we work to protect your data using industry-standard measures.
9. Changes to this policy
We may update this policy as the product evolves. We will revise the "Effective date" above and, for material changes, notify you in the app or by email.
10. Contact
Questions or requests about your data: privacy@enori.wine
Alpine Apps GmbH — data controller for Enori.