Privacy Policy

1. Data controller

The controller responsible for processing your personal data is:

• PYNAR Sàrl
• Chemin du Courtil 13, 1241 Puplinge, Switzerland
• Contact: anthony.cecchetto@pynar.ch

PYNAR Sàrl is committed to processing your personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the European General Data Protection Regulation (GDPR).

2. Data collected

Depending on the features you use, we collect the following categories of data:

• Email address (primary identifier)
• Username
• Password (stored as a bcrypt hash — never in plain text)
• Avatar (uploaded image)
• Google OAuth identifier (uid) and associated email
• Apple Sign In identifier (uid) and associated email

• Interface language (fr/en)
• Preferred currency (CHF, EUR, USD)
• Cellar capacity (number of bottles)
• Temperature unit (Celsius / Fahrenheit)

• Bottles in cellar (wine, vintage, quantity, price, location)
• Movement history (addition, removal, consumption, sale, gift…)
• Tasting notes and ratings (1 to 5 stars)
• Tasting dates
• Proof of purchase (PNG/JPG/PDF images, max 10 MB)
• Tracking of opened bottles (date, closure method, glasses consumed)

• Business name and establishment type (wine merchant, distributor, restaurant…)
• Full address, postal code, city, country
• Phone number and public email
• Website
• GPS coordinates (automatic geocoding of the provided address)
• Cover image

• Stripe customer identifier (stripe_customer_id)
• Subscription identifier and status (Stripe, Apple App Store, Google Play)
• Transaction history (amount, currency, status, date)
• No bank card data is stored by Pynar — payments are handled entirely by Stripe, Apple, or Google.

• IP address (connection, actions)
• User agent (browser/device type)
• Referrer URL
• Connection timestamps

• Expo push token (iOS/Android) for sending mobile notifications
• Notification preferences by channel (email, push) and by type

• Excerpt of prompts sent to AI services (wine recommendations, chat)
• AI provider used and tokens consumed

3. Purposes and legal bases

4. Third-party services (processors)

Pynar uses the following service providers to deliver its services. Each is contractually bound to respect the confidentiality of your data:

Transfers of data to third countries (in particular the USA) are carried out on the basis of standard contractual clauses approved by the European Commission or equivalent mechanisms recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

5. Cookies and local storage

The pynar.ch site uses technical cookies strictly necessary for its operation:

• Session cookie — keeps you logged in while browsing (deleted when the browser is closed)
• "Stay signed in" cookie — keeps your session active between visits (duration: 14 days, optional, enabled only if you check the corresponding box)

No advertising cookie, third-party tracker, or external analytics tool (Google Analytics, etc.) is used on this site.

• Native Secure Store (encrypted by the OS): JWT access token, refresh token
• Async Storage: UI preferences and Redux cache (non-sensitive data)

6. User rights

In accordance with the Swiss FADP and the European GDPR, you have the following rights:

• Right of access — obtain a copy of the personal data concerning you
• Right of rectification — correct inaccurate or incomplete information
• Right to erasure — request the deletion of your account and your data
• Right to portability — receive your data in a structured, machine-readable format
• Right to object — object to the processing of your data for direct marketing purposes
• Right to withdraw consent — at any time for processing based on consent, without affecting the lawfulness of prior processing

To exercise these rights, contact us at: anthony.cecchetto@pynar.ch

We are committed to responding within 30 days. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland or the competent supervisory authority in your country of residence.

7. Security

PYNAR Sàrl implements appropriate technical and organizational measures to protect your data:

• Passwords hashed with a robust hashing algorithm — never stored in plain text
• Authentication tokens cryptographically signed with automatic expiration
• Active rotation of long-lived session tokens
• All communications encrypted via TLS (HTTPS)
• Sensitive tokens stored in the mobile operating system's native Secure Store
• Audit logs of administrative actions
• Data isolation between users

8. Retention period

9. Contact

For any question regarding your personal data or to exercise your rights, contact:

• PYNAR Sàrl
• Chemin du Courtil 13, 1241 Puplinge, Switzerland
• Email: anthony.cecchetto@pynar.ch

We are committed to processing your request as promptly as possible, and no later than 30 days after receiving it.