Privacy Policy

Governing law and language. winegod.ai is operated from Brazil. This English version is an official version of this document. The service and the processing of personal data are governed by Brazilian law, including the LGPD (Lei Geral de Proteção de Dados). In case of any discrepancy between versions, the Brazilian Portuguese version (pt-BR) prevails.

1. Who we are

winegod.ai is an AI service focused on wine, accessible at chat.winegod.ai. This document describes how we handle data from the people who use the product.

The controller of personal data processed by the service is WINEGOD AI DESENVOLVIMENTO DE SOFTWARE LTDA, a Brazilian legal entity registered under CNPJ 68.259.953/0001-02. For privacy and data protection matters: legal@winegod.ai.

2. Data we collect

2.1 Account and sign-in data

When you sign in with Google, we receive your name, email, and profile picture from the chosen provider. The product may also use an email magic link. We never receive your password.

Facebook, Apple, and Microsoft may be available as sign-in providers when enabled for the product. Availability may vary.

2.2 Usage data

• Messages you send in the chat (text, photos, videos, PDFs)
• Record of credits consumed (amount, type, date)
• Session identifier and IP address

2.3 Local storage

We use localStorage and sessionStorage in your browser to keep the session alive and to display the current session's chat history. That data stays on your device.

3. How we use your data, and on what legal basis

We use your data to:

• Provide personalized wine answers and process what you send (messages, photos, videos, PDFs) — legal basis: performance of our contract with you
• Track usage credits (daily cap) and maintain your account — legal basis: performance of our contract
• Improve the quality of the service, ensure security and fraud prevention, and keep technical access logs for usage control — legal basis: legitimate interests
• Keep financial and tax records required by law — legal basis: compliance with a legal obligation
• Send optional communications when you opt in — legal basis: consent, which you can withdraw at any time

We use public information available in our base to present an informational reference about the wine. This reference may vary with the information available.

We do not sell your personal data.

4. Third-party services

To function, winegod.ai relies on external providers that act as processors and handle data under our instructions, in the following categories: hosting and infrastructure, database, cache, artificial intelligence models (text and visual reading of photos and PDFs), authentication, email delivery, product usage analytics, and payments when enabled.

Each provider has its own privacy policy and its own data protection commitments. We share with them only what is necessary to run the service.

5. International data transfers

Our servers are located in the United States. When you use the service, your data is transferred to and stored there. This transfer is necessary to perform the contract between you and winegod.ai. We choose infrastructure providers among services that offer their own data protection commitments, though this does not mean we have signed a specific international-transfer instrument with each of them.

6. Data retention

• Account and profile — While your account exists; purged within 30 days of deletion.
• Conversations and files you send — While your account exists; removed when the account is deleted.
• Technical access logs (IP, session, timestamp) — With an account: kept while the account exists and anonymized when you delete it; without an account (guest use): we keep a minimal technical record for usage control, with no automatic purge deadline today; hosting infrastructure follows its own provider's policies.
• Credit and usage records — While your account exists; afterwards, only in anonymized form.
• Financial and tax records — 5 years, under applicable legal deadlines.

Records needed to comply with a legal obligation or to defend a legal claim may be kept for the duration of that obligation. You can request deletion of your data as described at Data deletion.

7. Security and incidents

We apply technical and administrative measures to protect your data, including encryption in transit, access control to our systems, and sign-in through external providers (we never store a password of yours). No system is 100% immune; if a security incident occurs that may cause you relevant risk or harm, we will notify the competent data protection authority — in Brazil, the ANPD — and the affected users, as required by law.

8. Your rights

As a data subject, you may ask us for:

• Confirmation that we process your data
• Access to your data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data
• Portability of your data
• Deletion of data processed on the basis of your consent
• Information about who we share your data with
• Information about the option not to give consent and its consequences
• Withdrawal of any consent you have given

To exercise these rights, write to legal@winegod.ai. We respond within 15 calendar days. You may also lodge a complaint with the competent data protection authority in your jurisdiction; in Brazil, the ANPD.

9. Privacy contact channel

winegod.ai is a small-sized personal data processing agent and, as such, is exempt from appointing a formal Data Protection Officer, under ANPD Resolution CD/ANPD No. 18/2024 (Brazil). We maintain a permanent communication channel for data subjects and for the Brazilian data protection authority (ANPD) to submit requests and complaints: legal@winegod.ai.

10. Cookies and usage analytics

We use a minimal set of cookies to make the product work, plus a usage analytics tool that also writes its own cookies to measure, in aggregate, how the product is used. We do not run advertising or cross-site tracking. The full list is in our Cookies Policy.

11. Children and teenagers

winegod.ai is intended only for people of legal drinking age and is not directed at children or teenagers. If we identify an account belonging to a minor, it will be terminated and the data deleted.

12. Changes

This policy may be updated. Material changes will be announced at least 15 days in advance, through a notice in the product and/or an email to your account. Minor changes take effect upon publication, indicated by the date at the top of the page.