Privacy and data handling policy.

1. Controller and Legal Entity

This platform and service are operated by Vinora Technologies Ltd ("Vinora", "we", "us", or "our"), registered in England and Wales. For all data protection inquiries, data subject access requests, or deletion notices, contact our data protection team at support@vinorawine.com.

2. Operational Data We Process

Vinora collects and processes operational data strictly required to deliver our account-scoped menu intelligence workspace, including:

• Account & Contact Information: Name, email address, password hashes, and team role assignments.
• Venue Metadata: Venue name, establishment type, currency, timezone, and trial/subscription status.
• Source Menu Files & Metadata: Uploaded menu documents (PDF, PNG, JPEG, WebP), file names, MIME types, text extractions, and version histories.
• Governance & Audit Records: Action logs detailing menu approvals, internal publishing destinations, team invitations, and venue settings modifications.

3. Source Menu Storage and Retention

Uploaded menu documents are stored under encrypted, venue-isolated object storage keys. Source files are retained for a default retention period of 365 days from upload to enable historical review and seasonal comparison, after which they are automatically purged. Venue operators must not upload files containing personal data or sensitive individual information.

4. Sub-Processors and Integration Partners

Vinora relies on vetted third-party infrastructure providers to fulfill specific operational functions:

• Stripe Inc.: Handles subscription checkout, payment processing, billing portal management, and invoicing. Vinora retains only Stripe customer and subscription IDs; card details, CVVs, and full billing addresses remain solely with Stripe.
• Amazon Web Services (AWS) / Local Isolated Storage: Provides secure, encrypted storage for venue documents and database backups.
• OpenAI LLC: Processes uploaded menu images and PDF documents via strict, non-training API endpoints solely to execute verbatim text extraction and structured parsing.
• Resend Technologies: Delivers transactional emails, team verification notices, and pilot enquiry notifications.

5. Data Subject Rights and Deletion Requests

Under applicable data protection laws (including UK GDPR and EU GDPR), venue users and account owners maintain rights to access, rectify, port, or request deletion of their personal data. To request full workspace data export or account closure, submit a verified request to support@vinorawine.com. Upon account closure, all associated venue documents, audit histories, and team memberships are permanently deleted within 30 days.

6. Security and Compliance

Vinora enforces strict tenant isolation, encrypted HTTPS data transit, secure session token handling, and multi-tier role permissions (Owner, Manager, Sommelier, Staff). We maintain baseline security controls and regular vulnerability reviews to safeguard venue operations.

7. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any disputes arising in connection with data protection or privacy shall be subject to the exclusive jurisdiction of the courts of England and Wales.