Privacy Policy – sellawine.com

Last updated: October 24, 2026

1. Data Controller

Protecting your personal data is important to us. This Privacy Policy explains how personal data is collected, processed, stored and, where applicable, shared when you use sellawine.com (the "Platform").

The data controller responsible for processing personal data is:

Jaeger Digital Labs
Büelstrasse 39
8132 Hinteregg
Switzerland
Email: info@sellawine.com
Website: https://sellawine.com

For any privacy-related inquiries, including requests to access, correct or delete personal data, please contact us using the email address above.

2. Applicable Data Protection Laws

We process personal data in accordance with applicable data protection legislation, particularly the Swiss Federal Act on Data Protection (FADP) and its implementing regulations.

Where the European Union General Data Protection Regulation (GDPR) applies to our activities, we also comply with its applicable requirements.

For users located in other jurisdictions, we additionally observe any mandatory data protection provisions applicable to our processing activities.

Personal data means any information relating to an identified or identifiable natural person.

3. Personal Data We Collect

Depending on how users interact with the Platform, we may collect and process the following categories of personal data.

3.1 Registration and Account Information

• Name, username or profile name.
• Email address.
• Authentication information and securely protected password data.
• User ID and account preferences.
• Registration date and, where applicable, last login information.
• Telephone numbers or additional contact details voluntarily provided.
• Account verification information and account status.

3.2 Listings and Product Information

• Listing titles, descriptions and prices.
• Photographs of wine bottles and other advertised products.
• Information about producers, vintages, origins, condition and provenance.
• Location information, including country, region or city.
• Listing availability and publication history.
• Additional information voluntarily submitted by users.

3.3 Communications Between Users

When users communicate through the Platform, we may process:

• Sender and recipient information.
• Message content and any attachments.
• Dates, timestamps and technical delivery status.
• Associations between messages, listings and user accounts.

Messages are processed to facilitate communication between buyers and sellers, operate the Platform and, where necessary, investigate fraud, misuse or suspected legal violations.

We strongly recommend that users do not share passwords, credit card information, identity documents or other particularly sensitive information through the messaging system.

3.4 Merchant and Business Information

For professional merchants and business accounts, we may additionally process:

• Company names and business addresses.
• Business contact information.
• Company websites and business descriptions.
• Logos, cover images and other profile information.
• Information used to verify business identity or website ownership.
• Statistics relating to listings, profile views and inquiries.

3.5 Technical Usage Information

When accessing or using the Platform, certain technical information may be collected automatically, including:

• IP addresses.
• Dates and times of access.
• Browser type, browser version and operating system.
• Device type and language preferences.
• Pages visited and files requested.
• Technical error reports and security-related information.
• HTTP requests and technical connection data.
• Approximate geographical location derived from IP addresses, where applicable.

This information is primarily used for technical operation, security, troubleshooting, fraud prevention and improvement of our services.

4. Purposes of Data Processing

We process personal data for the following purposes:

• Providing, operating and maintaining the Platform.
• Registering, authenticating and managing user accounts.
• Publishing and managing listings.
• Facilitating communication between buyers and sellers.
• Providing AI-powered wine identification and listing creation tools.
• Generating indicative wine valuations and market price estimates.
• Managing merchant profiles and business-related functionality.
• Providing search, filtering, favorites and notification features where available and used.
• Responding to inquiries and providing customer support.
• Detecting and preventing fraud, spam, security attacks and unlawful activities.
• Moderating listings and investigating reported content.
• Identifying technical errors and improving user experience.
• Complying with legal and regulatory obligations.
• Establishing, exercising and defending legal claims.

We generally process personal data only for the purposes for which it was collected or for other compatible or legally permitted purposes.

5. Legal Bases for Processing

Where the GDPR applies, we process personal data based on one or more of the following legal grounds:

• Article 6(1)(b) GDPR – Contractual necessity: Processing necessary to perform a contract or take steps requested before entering into a contract, including managing accounts, listings, messaging and requested Platform features.
• Article 6(1)(c) GDPR – Legal obligations: Processing necessary to comply with applicable legal requirements.
• Article 6(1)(f) GDPR – Legitimate interests: Processing necessary for legitimate interests, including Platform security, fraud prevention, technical troubleshooting, abuse prevention and the establishment or defense of legal claims.
• Article 6(1)(a) GDPR – Consent: Processing based on consent, including where required for optional analytics, marketing technologies, non-essential cookies or other specifically identified features.

Where processing is based on consent, users may withdraw their consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Where only Swiss data protection law applies, processing is conducted in accordance with the applicable data processing principles and, where required, an appropriate legal justification.

6. Technical Infrastructure, Hosting and Database

We use external technology and infrastructure providers to operate sellawine.com.

6.1 Cloudflare

The Platform uses Cloudflare services for website delivery, technical infrastructure, performance optimization, security and protection against malicious or abusive traffic.

Cloudflare may process the following information:

• IP addresses.
• HTTP requests and technical connection information.
• Browser and device information.
• Access timestamps and requested resources.
• Security-related information used to identify automated, suspicious or malicious requests.

Such processing supports website availability, performance optimization, protection against distributed denial-of-service attacks and the secure operation of the Platform.

Cloudflare operates a globally distributed infrastructure. Depending on the services used and their technical configuration, personal data may be processed outside Switzerland and the European Economic Area.

Further information:

https://www.cloudflare.com/privacypolicy/

6.2 Bolt and Supabase

The Platform uses a Supabase-based database and backend infrastructure provided through or connected to Bolt.

This infrastructure may be used to process and store:

• User accounts and authentication information.
• Profile and contact information.
• Listings and product information.
• Uploaded images and files.
• Messages and communication data.
• Merchant profiles and associated information.
• Technical information, access logs and security records.

The technical infrastructure may involve services operated by Bolt or StackBlitz, Supabase and their contractually engaged subprocessors.

Primary data storage is determined by the technical configuration and hosting region assigned to the database project.

Additional processing may occur for technical support, maintenance, security, infrastructure management and system logging.

Further information:

Supabase Privacy Information
Supabase Legal Information
Bolt Platform Information

7. Artificial Intelligence and Automated Processing

sellawine.com may use artificial intelligence to identify wines, analyze product images, generate listings, create product descriptions and estimate market values.

When users access these features, information they submit, particularly photographs, text and product characteristics, may be processed by the relevant technical systems and, where applicable, external AI service providers.

Where technically necessary, such information may be transmitted to contracted AI providers. The specific processing activities depend on the technologies used and the applicable data protection agreements.

Users should avoid submitting unnecessary personal data or sensitive personal information when using AI-powered features.

In particular, uploaded photographs should not contain private documents, identification records, personal information relating to third parties or other unnecessary personal content.

AI-generated valuations and recommendations are intended to assist users. They do not, by themselves, constitute legally binding decisions regarding the purchase or sale of wine.

Where required by applicable law, we will provide additional information about automated individual decisions that produce legal effects or similarly significantly affect individuals.

8. Public Listings and User Profiles

Certain information is deliberately made publicly available to enable the Platform to function as a classified advertising marketplace.

Such information may include:

• Public usernames or merchant names.
• Published listings and product descriptions.
• Uploaded product photographs.
• Advertised prices.
• Locations provided by users.
• Public profile information.
• Reviews, verification badges or other publicly visible trust indicators, where available.

Publicly published information may be viewed by other internet users and indexed by search engines.

Even after a listing has been deleted, copies may temporarily remain in search engine caches, internet archives or third-party systems. We may not be able to remove such externally stored copies directly.

Users are responsible for avoiding the disclosure of unnecessary personal information in publicly visible listings.

9. Messaging and User Communications

The Platform may provide an internal messaging system through which buyers and sellers can communicate.

Messages are stored and technically processed to enable their delivery, display and management.

Messages are generally intended for the participating users. However, access by appropriately authorized Platform personnel may be necessary in certain circumstances, including:

• Reported fraudulent activities.
• Suspected illegal content.
• Customer support requests.
• Technical problems.
• Compliance with legal obligations.
• Establishing, exercising or defending legal claims.

Any such access is restricted according to applicable permissions and the requirements of the relevant purpose.

The internal messaging service is not represented as an end-to-end encrypted communication service.

10. Cookies and Similar Technologies

The Platform may use cookies, local storage technologies and similar technical mechanisms.

Cookies are small files or data elements stored on a user's device or used to retain information relating to previous interactions.

10.1 Strictly Necessary Cookies

Strictly necessary cookies and local storage technologies may be used for:

• User login and session management.
• Authentication and account security.
• Storage of essential user preferences.
• Protection against automated attacks and abuse.
• Maintaining essential Platform functionality.
• Recording privacy preferences and consent choices.

These technologies are used where necessary to provide services requested by users or to maintain the secure operation of the Platform.

10.2 Cloudflare Security Cookies

Depending on the Cloudflare configuration, security cookies may be used to detect automated traffic, perform security checks or manage security clearances.

Where the corresponding features are enabled, these may include cookies named "__cf_bm" or "cf_clearance".

The actual cookies used depend on the Cloudflare services and security features enabled.

10.3 Optional Analytics and Marketing Technologies

If we use analytics, statistics or marketing technologies that are not strictly necessary, we will provide information about the relevant providers, processing purposes and retention periods.

Where legally required, such technologies will be activated only after the user has provided the necessary consent.

Users may withdraw consent at any time with effect for the future through the privacy settings made available on the Platform.

Users may also manage or delete cookies through their browser settings. Disabling certain technologies may limit some Platform features.

11. Contact Forms and Customer Support

When users contact us through a contact form, email or other available communication channels, we process the information submitted.

This may include:

• Name.
• Email address.
• Subject and content of the inquiry.
• Attachments or additional information voluntarily provided.
• Technical information necessary to process the inquiry.

We use this information to respond to inquiries, communicate with the individuals concerned and carry out any necessary follow-up actions.

Information is generally retained only for as long as necessary to process the inquiry, pursue related legitimate purposes or comply with applicable legal retention obligations.

12. Notifications and Emails

We may send service-related emails and notifications concerning:

• Account registration and verification.
• Password resets and security alerts.
• Messages or inquiries from other users.
• Listing activities and listing status.
• Search, price or other notification features activated by users.
• Important technical or legal changes affecting the Platform.

Service-related communications are processed where necessary to provide the relevant functionality or comply with legal obligations.

Promotional emails and newsletters are sent only where a valid legal basis exists and, where required, the recipient has provided consent.

Users may unsubscribe from optional marketing communications through the unsubscribe mechanisms provided or by contacting us.

External email delivery providers may be used to send messages and may process the contact information necessary for delivery.

13. Merchant Verification and Fraud Prevention

To improve Platform security and trustworthiness, we may verify information relating to professional merchants.

This may involve processing company names, websites, business email addresses and other necessary information.

Verification may include confirming ownership or control of a website, verifying business email addresses or requesting other suitable evidence.

To prevent and investigate fraud or misuse, we may also review relevant account information, listings, messages, user reports and technical security data where legally permitted and necessary.

Such processing is carried out to protect legitimate interests in Platform security and user protection and, where applicable, to comply with legal obligations.

14. Recipients and Disclosure of Personal Data

Personal data may be shared with third parties where necessary to provide our services, comply with legal obligations or pursue other lawful purposes.

Potential categories of recipients include:

• Hosting, infrastructure and cloud service providers.
• Database and backend service providers.
• IT security and network service providers.
• Technical providers of artificial intelligence services.
• Email delivery and communication service providers.
• Technical support and maintenance providers.
• Other users, where information is deliberately shared through listings, profiles or messages.
• Public authorities, courts and other authorized entities where a legal obligation or other valid legal basis exists.

Where service providers process personal data on our behalf, they are contractually required to comply with appropriate data protection and security obligations in accordance with applicable law.

We generally limit disclosures to the personal data necessary for the relevant purpose.

15. International Transfers of Personal Data

The Platform operates internationally and uses technology and infrastructure providers with global operations.

Consequently, personal data may be processed outside Switzerland and the European Economic Area or accessed from other countries.

Depending on the service providers, subprocessors and technical configuration, processing may take place in Switzerland, countries within the European Economic Area, the United States and Singapore, among other locations.

The primary database location and any additional recipient countries depend on the infrastructure deployed and the contractual arrangements with our service providers.

Where personal data is transferred to countries without a legally recognized adequate level of data protection, we implement appropriate safeguards where required.

Such safeguards may include recognized standard contractual clauses, supplementary technical and organizational measures or other legally permitted transfer mechanisms.

Individuals may request further information regarding relevant international transfers and applicable safeguards using the contact details provided in this Privacy Policy.

16. Data Retention

We generally retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal retention obligations or protect legitimate interests where legally permitted.

In particular:

• User accounts: Account information is generally retained while an account remains active. Following account deletion, personal data is removed or anonymized unless further lawful retention grounds apply.
• Listings: Listing information is retained during publication and, where necessary, for a subsequent administrative or security-related period.
• Messages: Messages are retained for as long as necessary to support communication, maintain security, investigate reported incidents or fulfill other lawful purposes.
• Contact inquiries: Information is generally deleted after an inquiry has been resolved and any applicable retention requirements have expired.
• Technical logs: Logs are retained only for as long as necessary for operations, security, troubleshooting or legal compliance.
• Security and abuse information: Such data may be retained longer where necessary to investigate incidents, prevent repeated abuse or establish legal claims.
• Backups: Deleted information may temporarily remain in technically necessary backup copies and will be removed according to applicable backup retention and deletion cycles.

Mandatory legal retention periods, including those applicable to relevant business and accounting records, remain unaffected.

When the relevant retention period expires, information is deleted or anonymized where technically possible and legally required.

17. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration or unlawful disclosure.

Depending on the processing activities, these measures may include:

• Encrypted data transmission using HTTPS/TLS.
• Technical access restrictions and permission management.
• Protected authentication procedures.
• Security features provided by the database and cloud infrastructure.
• Protection against automated attacks and unauthorized activity.
• Technical monitoring and error analysis.
• Appropriate backup and recovery procedures.
• Periodic review of security-related configurations.

The specific safeguards implemented depend on the nature, scope and risks of the relevant processing activities.

Despite appropriate security measures, absolute security of information transmitted or stored over the internet cannot be guaranteed.

This statement does not exclude any liability that cannot legally be excluded.

18. Data Subject Rights

Depending on the applicable data protection legislation, individuals may have the following rights:

• Right of access: The right to obtain information about the processing of their personal data.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of personal data where the applicable legal requirements are met.
• Right to restriction: The right to request restriction of certain processing activities under applicable conditions.
• Right to data portability: The right to receive personal data in an appropriate format or request its transfer where legally applicable.
• Right to object: The right to object to certain processing activities under applicable law, including processing for direct marketing.
• Right to withdraw consent: The right to withdraw previously granted consent at any time with effect for the future.
• Rights relating to automated decisions: Applicable rights to information, review and human involvement concerning automated individual decision-making.

To exercise these rights, please contact:

info@sellawine.com

We process valid requests within the time limits prescribed by applicable law.

To protect personal information, we may request appropriate verification of identity before responding where reasonably necessary.

These rights may be subject to lawful exceptions and restrictions, including the protection of third-party rights, overriding legitimate interests and legal retention obligations.

19. Account Deletion

Users may request deletion of their account by contacting info@sellawine.com.

Following an account deletion request, we will delete or anonymize personal information unless legal obligations or other lawful grounds require further retention.

Certain information may be retained temporarily, for example to investigate fraud, resolve ongoing disputes or comply with statutory retention obligations.

Information previously stored by other users or external search engines may not be entirely removable by us.

20. Children's Privacy

The Platform is intended exclusively for individuals aged 18 years or older.

We do not knowingly seek to create accounts for minors or process personal data from minors for their independent use of the Platform.

If we become aware that an individual is using the Platform in violation of these age requirements, we may suspend the corresponding account and delete the relevant personal information in accordance with applicable legal requirements.

Concerns regarding unauthorized use of the Platform by minors may be reported to info@sellawine.com.

21. External Websites and Services

The Platform may contain links to external websites, merchant profiles, social media networks, payment providers and other third-party services.

Personal data processing by independent operators of those services is governed by their respective privacy policies.

We do not exercise comprehensive control over the data protection practices of independent third parties.

Our responsibilities regarding the selection and integration of our own service providers, as well as mandatory legal obligations, remain unaffected.

22. Changes to This Privacy Policy

We may update this Privacy Policy, particularly when legal requirements, technologies, services or data processing practices change.

The latest version will be published on the Platform.

Where required by applicable law, we will notify users of material changes or obtain any necessary consent.

The date of the most recent update is indicated at the beginning of this Privacy Policy.

23. Supervisory Authorities and Complaints

Individuals are welcome to contact us directly regarding any privacy-related concerns.

Depending on the applicable law, individuals may also have the right to lodge a complaint with a competent data protection supervisory authority.

In Switzerland, the relevant authority is:

Federal Data Protection and Information Commissioner (FDPIC)
Switzerland
Website: https://www.edoeb.admin.ch

Where the GDPR applies, individuals may also lodge complaints with a competent supervisory authority in the European Union or European Economic Area.

24. Contact for Privacy Inquiries

For questions about the processing of personal data, the exercise of your data protection rights or this Privacy Policy, please contact:

Jaeger Digital Labs
Büelstrasse 39
8132 Hinteregg
Switzerland
Email: info@sellawine.com

We handle privacy inquiries confidentially and respond in accordance with applicable legal requirements.