Privacy Policy
Last updated 13 August 2026
1. Who is responsible for your data
Flavourpal is operated by Whiskykalendern AB (org. nr 559117-4056), Västra Storgatan 9, 633 42 Eskilstuna, Sweden. We are the data controller for the personal data described here. You can reach us at info@whiskykalendern.se.
Our supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You always have the right to lodge a complaint with IMY or with the data protection authority where you live.
2. What we collect and why
- Account data — username, email, password (stored only as a bcrypt hash), membership tier. Needed to provide the service (Art. 6(1)(b)).
- Profile data you choose to add — avatar, bio, social links, phone number. Entirely optional, based on your consent (Art. 6(1)(a)).
- Your cellar and tasting notes — bottles, ratings, wishlist, and whether each is public. Needed to provide the service.
- Community content — posts, comments, club memberships, event participation, direct messages.
- Payment data — subscription status and Stripe identifiers. We never see or store your card number. Needed for the contract and for accounting law.
- Photos and files you upload — including shelf photos and collection lists you submit for AI analysis.
- Voice audio — when you start the Flavourpal Expert voice assistant, your microphone audio is transmitted and processed to generate a reply.
- Usage analytics — which pages and items are viewed. We use this to understand what the community finds useful, on the basis of our legitimate interest in improving the service (Art. 6(1)(f)). You can object at any time by emailing us, and we will stop linking analytics to your account.
3. Our use of artificial intelligence
Three parts of Flavourpal use AI systems. We tell you this because you have a right to know when you are interacting with, or being processed by, an AI system (EU AI Act Art. 50).
- AI Shelf Scan — a photo you take of your shelf is sent to Google's Gemini model, which attempts to identify the bottles. Results are always shown to you for confirmation before anything is saved.
- AI List Import — a spreadsheet or text file you upload is sent to the same model to extract bottle names. We send only the rows needed for that task. Results are shown to you for confirmation before anything is saved.
- Flavourpal Expert — a voice assistant. You are speaking to an AI system, not a person. Your microphone audio is transmitted through LiveKit and processed by its AI model providers while a session is active. Those providers are contractually barred from retaining, logging or training on it, and we do not keep it afterwards. LiveKit publishes the full list of providers it uses.
These systems can be wrong — a bottle may be misidentified, and the assistant may say something inaccurate. Nothing they produce is applied automatically without you confirming it, and none of them make decisions that produce legal or similarly significant effects for you.
4. Who we share data with
We do not sell your personal data. We use the following processors:
| Processor | Purpose | Location |
|---|---|---|
| Neon (Databricks, Inc.) | Primary application database | United States |
| Vercel | Application hosting, serverless functions, image storage | United States (US East) |
| AI analysis of shelf photos and imported collection lists (Gemini) | United States | |
| LiveKit | Voice assistant — audio transport and AI speech processing (zero-retention) | United States |
| Stripe | Payments and creator payouts (independent controller for payment data) | United States / Ireland |
| Resend | Transactional email | United States |
The full list, including links to each company's own privacy and data-processing terms, is on our subprocessors page, which we update whenever a processor changes.
Data outside the EU/EEA: Flavourpal runs on United States infrastructure, so your personal data is transferred outside the EU/EEA. Every company we use is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection. We verified each against the official list on 13 August 2026 and re-check annually.
5. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Cellar, tasting notes, community content | Until you delete your account, or until you delete the item |
| Direct messages | Until you delete your account. Your side is then removed; the other person keeps theirs |
| Usage analytics | 14 months, then deleted |
| Payment and payout records | 7 years (Swedish Bokföringslagen) — kept even after you delete your account |
| Password reset tokens | 1 hour |
| Photos and files sent for AI analysis | Not stored by us after analysis |
| Voice assistant audio | Processed live during your session; not stored by us afterwards |
| Database backups | Up to 30 days, then overwritten |
6. What we store on your device
We do not use advertising or third-party tracking cookies, and nothing here is shared with anyone else. This is what Flavourpal keeps in your browser:
| What | Purpose | Why we may store it |
|---|---|---|
| Session cookie | Keeps you logged in | Strictly necessary |
| fp-age-gate | Records that you confirmed your age, and for which market | Strictly necessary |
| flavourpal-theme | Your chosen accent colour | Preference you set |
| flavourpal_locale | Your chosen language | Preference you set |
| fp-onboarding-done | Stops the welcome guide reappearing | Preference you set |
| fp-voice-ai-ack | Remembers that you have seen the AI notice for the voice assistant | Strictly necessary |
| waitlist-email | Remembers what you typed into the waitlist form so you do not have to retype it | Convenience — clear your browser storage to remove it |
| whiskey-runner-highscore | Your high score in the mini game on the landing page | Preference you set |
7. Your rights
You can exercise all of these from Settings, or by emailing us. We answer within one month.
- Access and portability (Art. 15, 20) — download everything we hold about you, from Settings.
- Rectification (Art. 16) — correct your profile at any time.
- Erasure (Art. 17) — delete your account. Payment and payout records are kept for 7 years because accounting law requires it; everything else is deleted or anonymised. If you run a club, blog or event, you can offer it to another member who already helps run it — they have to accept, only the administrative role moves, and your posts still become anonymous. Nothing personal to you, such as your messages or cellar, is ever passed to another member.
- Objection and restriction (Art. 18, 21) — object to processing based on our legitimate interest, including analytics.
- Withdraw consent (Art. 7(3)) — for anything you gave consent for, at any time, without affecting processing that already happened.
8. Age
Flavourpal is intended for adults and we ask you to confirm your age before using the site. The minimum differs by market — 20 in Sweden and the other Nordic countries, 21 in the United States, and 18 elsewhere. We do not knowingly collect data from anyone below the applicable age. If you believe a minor has created an account, email us and we will remove it.
9. Contact and changes
Privacy questions and rights requests: info@whiskykalendern.se. We will tell you before any material change to this policy takes effect.