Last updated: October 3, 2026
This Privacy Policy describes how WineFlow CRM ("we", "us", or "our") collects, uses, and shares your personal information when you use our website and services (collectively, the "Service"). We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
1. Information We Collect
1.1 Information You Provide
We collect information you provide directly to us, including:
- Account Information: When you create an account, we collect your name, email address, company name, VAT number (optional) and password. We store the password only as an Argon2id hash. For billing we also keep your billing email, country, applicable VAT rate, plan and subscription status, and the customer and subscription identifiers issued by our payment processor, Stripe.
- Profile Information: The display name, profile picture (a preset or an image you upload), language and interface preferences you set, and your answers to the optional onboarding questionnaire (company type and size, main focus, first goal and experience level). Your company's address, VAT number and contact email are stored on your company account.
- Customer Data: Information about your customers, prospects and suppliers that you upload, import (for example from Monday.com or a spreadsheet) or create in the Service, including names, company or private-customer status, contact details, postal addresses, tax code, VAT number, e-invoicing identifiers (SDI code, PEC address), offers, orders, shipments and newsletter subscription status, together with leads that the Service finds on your request in public business listings. We process Customer Data on your behalf and under your instructions (see Section 4.2).
- Communications: When you write to us by email, through the contact form on our website or through the support area of the Service, we collect your name, email address and message and, if you provide them, your company, phone number and the plan you are interested in, as well as any attachments you send by email. Contact-form submissions are delivered to our mailbox, confirmed to you by an automatic reply, and recorded in our security audit log together with your IP address and browser user agent for up to 12 months.
- AI Assistant and AI Features: If your company enables the AI features, the questions you type into the assistant, and the records it retrieves from your account to answer them (which may include customer names, email addresses and phone numbers), are sent to our AI providers to generate a reply. The conversation is kept for 24 hours so that the assistant can follow it, and then deleted automatically. AI-generated sales reports send customer and product names together with sales figures; lead enrichment sends a business's name, address and website.
- Third-Party Account Credentials: If you connect third-party accounts — your SMTP mail server, FattureInCloud, Monday.com, Wine-Searcher or a critic subscription such as James Suckling — we store the usernames, passwords, API keys or tokens you provide, encrypted with AES-256-GCM, and use them only to connect to those services on your behalf.
1.2 Information We Collect Automatically
When you access or use our Service, we automatically collect:
- Log Data: For every request that creates, changes or deletes data, and for form submissions, we record the date and time, your IP address, browser user agent, the address of the request, its outcome and, when you are signed in, your user and company identifiers and email address. Our web servers and our network provider (Cloudflare) also process technical request data, including IP addresses, to deliver and protect the Service.
- Usage Data: A record of the actions you take in the Service (for example creating an offer, changing a customer record or sending a campaign), kept in an audit trail for security, accountability and support. We do not measure the time you spend on the Service and do not use analytics tools.
- Email Engagement Data: Campaign, newsletter and offer emails sent through the Service contain a small tracking image and tracked links, unless the sender has switched tracking off. When a recipient opens such an email or clicks a link, we record the time, the recipient's IP address and email client or browser user agent and, for clicks, the link followed, and make this information available to the sender. After 30 days the user agent is deleted and the IP address is truncated; the time and the link are kept for the sender's statistics. Newsletter emails to subscribers who are not customers of the sender are not tracked. When someone subscribes through a sender's newsletter form, we keep the date, the method and the truncated IP address of their confirmation as proof of consent. We process this data on behalf of the customer who sent the email.
- Cookies and Similar Technologies: We use only cookies and browser storage that are strictly necessary or that remember a choice you made. See our Cookie Policy for the full list.
2. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our Service
- Process transactions and send related information
- Send technical notices, updates, security alerts, and support messages
- Respond to your comments, questions, and requests
- Keep aggregate statistics about each account (for example the number of users and records) to operate, support and bill the Service
- Detect, investigate, and prevent fraudulent transactions and abuse
- Provide the features you enable, such as the AI assistant and reports, lead search and enrichment, market price checks and critic score monitoring
- Deliver the campaigns and offers you send and report to you whether recipients opened them or clicked their links
- Keep an audit trail of changes to your account for security, accountability and the resolution of disputes
3. Legal Basis for Processing (GDPR)
Under the GDPR, we process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to provide you with our Service and fulfill our contractual obligations.
- Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Service, preventing fraud, and ensuring security.
- Consent: Where a specific processing activity relies on your consent, which you can withdraw at any time.
- Legal Obligation: Processing necessary to comply with applicable laws and regulations.
4. Data Sharing and Disclosure
We may share your information in the following circumstances:
- Service Providers: With vendors who process data on our behalf to host and deliver the Service (hosting, network security and content delivery, payment processing, AI processing and web search), listed in Section 4.1.
- Business Transfers: In connection with a merger, acquisition, or sale of assets.
- Legal Requirements: When required by law or to protect our rights, privacy, safety, or property.
- With Your Consent: In any other circumstances where you have given consent.
4.1 Third-Party Services
We use the following third-party services that may process your data:
- OVHcloud: Hosts our servers, databases and backups in a data centre in Milan, Italy. Market price checks also run on a workstation that WineFlow operates in Italy.
- Cloudflare: All traffic to our website, application and API passes through Cloudflare's network, which provides DNS, TLS encryption, caching and protection against attacks, and therefore processes IP addresses and the content of requests in transit.
- Stripe: Processes subscription payments. Card details are entered on Stripe's pages and never reach our servers; we share your company name and billing email with Stripe.
- OpenRouter: Routes requests from our AI features to the AI model that generates the answer (currently a Google Gemini model), and receives the content described under "AI Assistant and AI Features".
- Perplexity: Researches wines and businesses for lead enrichment, newsletters and the AI assistant.
- SerpAPI: Runs the lead searches and web searches you request; it queries Google Search and Google Maps and returns public business listings. It receives the search terms, not your account data.
- FattureInCloud: If you enable the invoicing integration, invoice data and the invoiced customer's identification and tax details are sent to FattureInCloud to issue Italian electronic invoices, and your sales records are imported from it.
- Monday.com: If you connect it, customer and product records are imported from and synchronised with your Monday.com boards.
- Wine-Searcher: If you use market price checks, wine names and vintages — and, if you provide them, your Wine-Searcher login details — are used to retrieve prices from Wine-Searcher.
- Critic publications (James Suckling, Robert Parker Wine Advocate, Vinous): If you use score monitoring, wine names are searched on these sites, with the subscription login details you provide where a site requires them.
- Your mail server: Campaigns, offers and newsletters are sent through the SMTP server you configure, whose provider processes recipients' addresses and message content under your own agreement with it. Until you configure one, and for account emails such as password resets, we send from our own mail server.
- Shipping carriers (DHL, UPS, FedEx, GLS, BRT): If carrier credentials were configured for your account, shipment tracking numbers are sent to the carrier to retrieve delivery status.
- Single sign-on (Okta, Microsoft): If your company signs in through single sign-on, your identity provider confirms who you are and shares your name and email address with us.
4.2 Data We Process on Behalf of Our Customers
For the customer, prospect, supplier and email-recipient data that our customers store in or send through the Service, the customer company is the data controller and WineFlow acts as its processor under Article 28 GDPR, processing that data only on the customer's instructions. If you are a customer, prospect or email recipient of a company that uses WineFlow, please address requests about your data to that company; we will assist it in responding.
5. Data Retention
We retain your personal data for as long as necessary to:
- Provide you with our Service
- Comply with legal obligations
- Resolve disputes and enforce agreements
Specifically:
- When your company account is closed, all of its data — users, customers, offers, orders and every other record — is permanently deleted within 30 days of closure.
- When a user is deleted, their personal data is anonymised within 30 days of deletion, including in our audit trail; the anonymised record is kept only so that the documents that user created still make sense, and security log entries keep the IP address and browser user agent for the audit retention period below.
- Backups containing your data are deleted within 90 days of being taken.
- Audit trail entries are kept for 30, 90, 180 or 365 days depending on your plan (Starter, Business, Professional or Enterprise); security events for 36 months, AI-related events for 60 months and entries about invoices, proformas, payments and sales or purchase orders for 84 months.
- Contact-form submissions and other log entries not linked to a customer account are kept for 12 months.
- AI assistant conversations are deleted automatically 24 hours after the last message.
- Email engagement records, notifications and deleted customer records are kept until your company account is closed and its data deleted as described above.
When you delete your account, we will delete or anonymize your personal data within 30 days, unless retention is required by law.
6. Your Rights Under GDPR
If you are a resident of the European Economic Area (EEA), you have the following rights:
- Right to Access: Request a copy of your personal data.
- Right to Rectification: Request correction of inaccurate data.
- Right to Erasure: Request deletion of your personal data ("right to be forgotten").
- Right to Restrict Processing: Request limitation of how we use your data.
- Right to Data Portability: Request a machine-readable copy of your data.
- Right to Object: Object to processing based on legitimate interests or for direct marketing.
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise these rights, please contact us at [email protected]. We will respond within 30 days.
If your data was entered into WineFlow by a company that uses our Service (for example because you are its customer, a prospect or a recipient of its emails), that company is responsible for your data: please send your request to it. WineFlow provides it with tools to find, export and anonymise your data and will assist it in responding.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit using TLS
- Encryption at rest, with AES-256-GCM, of the passwords, API keys and tokens you give us for third-party services
- Secure password hashing using Argon2id
- Role-based access controls
- Separation of each company's data, enforced on every database query by our application
- Rate limiting of requests and an audit trail of security-relevant events
8. International Data Transfers
Our own servers are in the European Union, but some of the providers listed in Section 4.1 — Cloudflare, Stripe, OpenRouter and the AI model providers it routes to, Perplexity, SerpAPI and, if you connect it, Monday.com — are based in or may process data in the United States or other countries outside the EEA. For these transfers we rely on:
- Adequacy decisions of the European Commission, including the EU-U.S. Data Privacy Framework for providers certified under it
- Standard Contractual Clauses approved by the European Commission, where no adequacy decision applies
9. Children's Privacy
Our Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email.
11. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
12. Supervisory Authority
If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.
For Italy: Garante per la protezione dei dati personali - www.garanteprivacy.it