Privacy Policy

1. Who is responsible for your information

INSomm is the data controller for the personal information described here. We are based in the United Kingdom and our full legal details appear at the foot of this document.

For any privacy question, or to exercise any of the rights below, email hello@insomm.co.uk. We answer requests within one month.

2. What we collect

We deliberately keep this short. We collect:

• Account details — your email address, an encrypted form of your password, the name you choose to display, when you joined and when you last changed your email.
• Membership and billing records — your membership level, billing period, renewal date, payment status and Stripe customer and subscription references. Card numbers are handled entirely by Stripe and never reach us.
• What you ask Alex — the dishes and wines you search, the pairings returned, your saved favourites, your avoid list, your taste preferences and your wine journal notes.
• Menu uploads — photographs or PDFs of menus and wine lists you choose to scan, and the text read from them.
• Technical and security information — your IP address, a device identifier used to keep your session on one device, browser and device type, timestamps, and records of errors and of requests to the service.

3. Why we hold it, and our legal basis

Under UK and EU GDPR we must have a lawful basis for each use of your information:

• To provide the service you have signed up for — your account, pairings, journal, history and menu scans. Basis: performance of our contract with you.
• To take payment and manage your membership through Stripe. Basis: performance of our contract, and our legal obligations for tax and accounting records.
• To keep Alex secure and fair — protecting sessions, limiting misuse, and preventing repeated claiming of the two welcome pairings using a one-way fingerprint of the email address. Basis: our legitimate interests in protecting the service, balanced against your privacy.
• To improve the pairing library and fix faults, using aggregated and de-identified usage patterns. Basis: our legitimate interests.
• To send service emails you need — password resets, billing notices, security alerts. Basis: performance of our contract.
• To send occasional news about Alex, only if you have asked for it. Basis: your consent, withdrawable at any time.

4. Artificial intelligence and automated processing

Alex uses AI models to compose pairings and to read the text on menus you upload. Your query, and the text of an uploaded menu, are sent to our AI provider for the moment it takes to produce your answer. Your content is not used to train publicly available AI models.

These are recommendations about food and wine only. There is no automated decision-making that produces legal effects for you, or that otherwise significantly affects you, within the meaning of Article 22 of the UK and EU GDPR. You can always ask a human — email hello@insomm.co.uk.

5. Who we share it with

We do not sell your personal information, and we do not share it for advertising. We use a small number of carefully chosen suppliers who process information on our instructions only:

• Our cloud database and authentication provider — secure hosting of your account and content, with row-level protection so no member can read another member's data.
• Stripe Payments Europe — payments, subscriptions, invoices and fraud prevention.
• Our AI provider — momentary processing of your pairing queries and menu text.
• Our email provider (Hostinger) — sending service emails such as password resets and billing notices.
• We may also disclose information where the law requires it, or to protect our rights or the safety of others.

6. Where your information is held

Our suppliers may process information in the United Kingdom, the European Economic Area, or other countries including the United States.

Where information leaves the UK or the EEA, we rely on the adequacy decisions between the UK and the EU, on adequacy decisions covering the receiving country, or on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, with additional safeguards where needed. You can ask us which safeguard applies to a particular transfer.

7. How long we keep it

We keep your account, pairing history and journal for as long as your account is open. If you close your account, we delete your personal content within 30 days.

Menu images are processed to produce your pairings and are kept in your scan history only so you can look back at them; delete a scan and the image goes with it.

Billing and tax records are kept for seven years, as UK law requires. Security and error logs are kept for up to 12 months. The one-way fingerprint of an email used to claim welcome pairings is kept so the welcome cannot be claimed twice; it cannot be turned back into your email address.

8. How we protect it

Connections are encrypted in transit and data is encrypted at rest. Passwords are stored only in hashed form. Access to member data is restricted at database level so that each account can reach only its own records, and administrative access is limited to named roles.

No system is perfect. If a breach ever put your rights at risk we would notify the relevant regulator within 72 hours and tell you without undue delay.

9. Your rights

Under the UK and EU GDPR you have the right to:

• Ask what we hold about you and receive a copy.
• Have inaccurate information corrected.
• Have your information deleted — the right to be forgotten — where we have no continuing need for it.
• Restrict or object to our use of it, including our reliance on legitimate interests.
• Receive your information in a portable, machine-readable form.
• Withdraw consent at any time, where consent is the basis we rely on.
• Not be subject to solely automated decisions with legal or similarly significant effects.

10. Complaints

Please come to us first at hello@insomm.co.uk — we would like the chance to fix it.

You can also complain to a data protection regulator. In the UK that is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EU or EEA you may complain to the supervisory authority where you live, work, or where the problem arose.

11. Children

Alex is an adults-only service and is not directed at children. We do not knowingly collect information about anyone under 18. If you believe we have, tell us and we will delete it.

12. Changes to this policy

We will update this page when our practices change, and the date at the top always shows the current version. Where a change matters to you, we will tell you by email or in the app.