House documents

Privacy policy

What we collect (not much), why (so you can have a profile and get what you asked for) and what we never do (sell your data — this place is not for sale).

1. What we collect, and nothing more

It depends on what you do here. Browsing the site asks nothing of you: no sign-up, no login.

a) If you leave your e-mail in “let me know”: we keep only the e-mail, to send you the house news (every new Garimpo pick, every issue of Contrarrótulo, the grape of the week on Mondays and whatever else opens up). Legal basis: your consent under the LGPD, the Brazilian data protection law (art. 7, I), given when you send it.

b) If you create your cellar (member profile): we ask for your name, public nickname, e-mail, password, date of birth, country, state (or district) and city. Each one has a reason:

• Name and nickname: the nickname is what the community sees; your name stays with the house only.
• E-mail and password: they’re the key to your account. The password is stored encrypted by our authentication provider — not even we can see it.
• Date of birth: this is a site about alcoholic drinks. We need to confirm you’re 18 or older, as the law and common sense require.
• Country, state and city: to know where the people at the table come from and to organize things by region (the Carta de Vinho, for example, goes by city). If you live outside Brazil you pick the country; in Portugal, the district and the municipality; in the United States, the state and the city.

Legal basis: carrying out the sign-up you asked for yourself (LGPD, art. 7, V) and, for your age, complying with a legal obligation (art. 7, II). The two optional opt-ins on the form (news and future perks) are consent (art. 7, I), and you can untick them right there or ask to withdraw later, without losing your account or your badge.

About the FOUNDER badge: it belongs to the profile, so it needs this data to exist — there’s no way to have the badge without signing up. But “needing the data” means only that: keeping it so your account stays up and running. It doesn’t become a list to sell, or a profile for advertisers.

c) If you send us a wine list: we keep the restaurant's name, city/state, the photo or PDF of the list and, if you want the credit, your email. The wines and prices on the list become public information for the community, checked by us; the photo stays with us, and so does your email.

c2) If you tell us something about a published list ("Is this your restaurant?" and "Tell us", on each list): we keep the request (correction, take-down or mistake), what you wrote, the list and, if you leave it, the email. To correct or take down a list, we first confirm through the restaurant's email; the email is used only for that and never goes on any list. Legal basis: the procedure you requested (LGPD, art. 7, V).

c3) If you tell us a wine was missing from a list ("Missing a wine on this list?", on each list), or search a restaurant's list and find nothing: we keep the wine you typed or searched, the list, the date, whether it was a request or a search, the language of the page, and the same two anonymous codes as in item d3 (one for the device and one derived from your internet address, never the address itself), so the same person counts only once. No email or sign-up needed. If you are signed in to your cellar, the request and the search are linked to your account: we see your nickname and the city and country from your profile next to them; the restaurant never does. It lets us know what people look for at each restaurant and, one day, tell the restaurant in aggregate numbers, never who asked. Everything is deleted after 1 year.

d) If you suggest a label for the Garimpo or the Rankings and leave your e-mail: we use it just once, to let you know (and thank you) if your suggestion makes it onto the site. It doesn’t go on any list. Legal basis: your consent (LGPD, art. 7, I), given when you send it. For a Taça em Tela tip (a film, series or book the house should see) we don’t ask for an e-mail: we keep the tip and, if you write one, your nickname, which only appears as credit if the tip makes it onto the page. The same goes for a question or term you send in the Glossary (the e-mail is optional and only used to reply; the nickname or name, only as credit if the question becomes an entry or a post) and for a place you suggest for the Trips map (nickname or name, only as credit if it makes it onto the map). The question you suggest on the wine questions page also goes without an e-mail: we keep the question and, if you write one, your nickname, and it only appears on the site if it makes it onto the page. Like the other suggestions, they stay in the Netlify dashboard, which the house reads and can delete from.

d2) If you point out a mistake on a wine page or a Guide page ("Spotted something wrong? Flag it to the house"): we keep the text you wrote, the page’s address and title and your nickname, if you choose to leave one. No e-mail, no sign-up (what Netlify records on every form is in item 2). It’s so the house can check the source and fix it; the nickname is just so we can thank you.

d3) If you tell us on a wine page whether the price is right ("O preço bate?"): we keep your answer (cheaper, within the range, pricier, or the range you saw it in), whether it was in a shop or a restaurant, the wine and the date. No e-mail, no sign-up. So the same person can’t repeat an answer on the same wine, we also keep an anonymous device code (the same one used for cheers) and a code derived from your internet address (IP), scrambled with a secret key only the database knows: the IP itself isn’t stored, and there’s no way back from the code to it. Everything is deleted after 180 days. It’s only so the house knows when to check the price in shops again; none of it appears on the site. Legal basis: the house’s legitimate interest in keeping the price range honest and free of fraud (LGPD, art. 7, IX).

d4) If you rate a wine (the "community rating", in the search and on each wine's page): only people signed in to their cellar can rate, from 1 to 5, one rating per wine. We keep the rating, the wine, its name and the date, tied to your account. What the community sees is the average, from the first rating on, and how many people rated only once they pass ten; your own rating, with your nickname, is seen by nobody but you (and the house, in the Balcão, to watch for abuse). You can change or remove your rating whenever you like, on the wine's page or in your cellar: removing deletes the row. It earns points (+10 for the first rating of each wine). Legal basis: performance of the contract (it is part of the cellar) and legitimate interest in preventing abuse. A wine someone posts that the search doesn’t have yet becomes a “community wine”, grouped by the name as written, so it can get ratings the same way; the database records who created each one, only for the daily limit and for the house, and none of that appears beyond what the post already shows. When the house links that wine to a search entry, the ratings move with it.

d5) If you are a wine’s producer and send the official spec sheet ("Are you this wine’s producer?", on each wine page, or the producer fields in "Missing a wine?", in search): we keep the winery’s name and your role, the e-mail, the text you wrote, the link and the file you attached (the spec sheet, as a PDF or photo), the wine, the date and your permission for the house to use that information. To publish, correct or take the wine down, the house first confirms by replying to the e-mail; the e-mail is used only for that and never goes on any list. The file and the e-mail stay with the house only; what appears on the site are the facts from the sheet, rewritten in the house’s own words, with the producer as the source. No sign-up (what Netlify records on every form is in item 2). Legal basis: the procedure you requested (LGPD, art. 7, V).

e) If you join in at the table (Open Bottle, À mesa, cheers, games): we keep what you post (text, the boxes you tick and the photo, if you send one, shrunk on your device and stripped of location data), your profile photo if you pick one, your points, your Label of the Day plays and your shelf. Everything shows up with your nickname, never your name: the Label of the Day ranking, on the game page, shows the nickname of cellar players with their solved labels, games played and day streak, and nothing else. A cheers is recorded with an anonymous code (hash), with no e-mail or IP; if you have a cellar, you show up with your nickname. Legal basis: carrying out the sign-up (art. 7, V). Cellar holders can get four e-mails from the house, each with its own switch in “My emails and alerts”: a heads-up when someone replies to you or comments on your bottle in À mesa, a cheers heads-up (one a day, at most), the Label of the Day reminder and the Monday e-mail (the grape of the week, with the Mesa da Semana digest when the conversation takes off). Nothing beyond that, except the one-off alert you ask for yourself with the label photo (item e3).

e2) If you turn on phone alerts (in “My emails and alerts”, in your cellar): your device’s browser asks for your permission, and only if you say yes does it create an alert address with its notification service (Google’s on Android and Chrome, Apple’s on iPhone, Mozilla’s on Firefox). We keep that address, the two keys that encrypt the message, the page language and the device type (for example, “Android · Chrome”), linked to your cellar. It is used only to let you know that someone replied to you, commented on your bottle or cheered you, or that the wine you asked to hear about is now in the search (item e3); the text travels encrypted and the notification service cannot read it. Turning it off in the same place (or removing the permission on the device) deletes the address. Legal basis: your consent (art. 7, I), given on the device.

e3) If you use label reading by photo ("Photo of the label" in the search, "Read the label from the photo" in your cellar): the photo, shrunk on your device and stripped of location data, goes to Anthropic (the company behind Claude, in the United States) only to read what is written on the label, and comes back as text. The house does not keep the photo from that reading; it keeps how many readings you did that day (the quota), how much the house spent and the name of the wine that was read, not linked to you, so it can add to the database the wines it does not have yet. If you tap “Let me know when it comes in” (when the wine that was read is not in the search yet), that reading is linked to your account until the alert goes out: when the wine comes in, the house lets you know once, by e-mail and on your phone (on the devices where you turned on alerts, item e2), and the link is removed. If the wine doesn’t come in within a year, the link is removed all the same. Legal basis: your request (consent, art. 7, I). Under Anthropic’s rules for this service, what goes through it is not used to train its models. The photo you choose to post on a bottle is still covered by item e). Legal basis: carrying out the sign-up (art. 7, V). If you tap “Not this one” and point to the right wine, we keep what the AI read, the wine you pointed to and your account: it’s a vote, and it only counts for everyone once the house confirms it in the Balcão (where it sees your nickname). Legal basis: legitimate interest (improving the reading). Without a cellar, reading works too, up to 2 a day: to count them, the house keeps only a code derived from your network's internet address (the IP) and the date, which changes every day (the IP itself is never stored), and how many reads came from it that day, and deletes this the next day; your device remembers how many are left today. Legal basis: legitimate interest (the house's spending cap).

e4) If you use the barcode ("Barcode" in the search and in "What wine is this?"): the camera and the photo of the barcode are read on your own device, and only the number (the digits under the bars) leaves it. The house looks that number up in Open Food Facts, the open, collaborative product database (a non-profit association in France), through the house's server: your IP address does not go along. The house keeps the number, the name Open Food Facts gives the product and the search wine matched to it, without linking any of it to you (no account, no device), so the next scan of the same barcode goes straight there and so the house can add a wine it does not have yet. No cellar needed. Legal basis: legitimate interest (art. 7, IX). Product names come from Open Food Facts, under the ODbL license.

e5) If you use Vinhozinho in your AI assistant (Claude, ChatGPT or another, through vinhozinho.com.br/mcp): the assistant sends the house only what it needs to look something up (the search phrase, the name of a wine, a grape or a term), and the house answers with what it has. The house does not receive your conversation, does not know who you are and does not keep what was looked up. To prevent abuse, it counts how many lookups each network makes in a day using a code derived from the IP address, which cannot be turned back into it and disappears the next day; and it counts, with no data about who used it, how many times each tool was used. No cellar or sign-up needed. What the assistant does with the answer follows its own company's policy. Legal basis: legitimate interest (LGPD, art. 7, IX).

e6) My readings (the list of labels you photographed or read by barcode, and the card to post): each reading is kept on your device, with the wine that was read, the color of the result (the house found it, wasn't sure, or it is new to the house), the wine the house found in the search, and the time. The photo stays only on your device (a thumbnail and, for the 12 most recent readings, a reduced copy for the card to post) and never goes to the server; the card is drawn on the device itself. With a cellar, the list is also kept in your account, without the photo, so you can find it on any device, and whatever was only on the device comes along when you sign in. You delete each reading whenever you like, in the list itself. Legal basis: performance of the registration (art. 7, V).

e7) If you take the taste quiz ("Your taste", in My Cellar): we keep your answers (the kinds of wine you drink most, sweet or dry, light or full-bodied, which of two well-known wines you would order again, and one wine you love), tied to your cellar, and only you see them. The chance you’ll like a wine, shown in the label reading and on the wine page, is an estimate calculated on your own device from those answers, the ratings you gave and the bottles you posted; the calculation happens on your device, which keeps a copy so it doesn’t have to ask for everything again; the number shown for each wine is kept in your cellar only so the house can check later whether it got it right (see the continuation just below). It is used for that alone: nothing goes to the mailing list, to advertising or to anyone. Delete the quiz whenever you like, in My Cellar, “Your taste”, “Delete the quiz” (you remove ratings on each wine page). Legal basis: consent (art. 7, I, LGPD), given when you take the quiz.

e7, continued: the taste that learns. The chance also learns from what you already left on your device (label scans, “I opened this one”, “Let me know”, cheers, Compare and the last wine page you opened), and the weights of the estimate adjust to your own ratings, on the device. When the house shows the chance for a wine, the guess (the wine and the number) is kept in your cellar, together with your “I liked it / I didn’t like it” answer and any reasons you tick, so the house can check whether it got it right: only you see yours, and the house sees only everyone’s combined accuracy, and only once there are 5 people. Undo any answer right away or in “What the house already knows about you”; deleting your account deletes all of it. Legal basis: for the guesses, answers and ratings of people with a cellar, performance of the sign-up (art. 7, V, LGPD), since they are part of the cellar service; for the quiz, consent (art. 7, I), given when you take it.

e7, the sentence: “Tell us in one sentence”. After “I liked it / I didn’t”, you can, if you want, tell us in one sentence what you thought of the wine (up to 140 characters). First your own device reads the sentence, with the house’s list of expressions. Before storing it, the house tries to discard a sentence that seems to talk about health, medicine, pregnancy or pain, or to include someone’s name, an email, a phone number or a social media handle: in that case the sentence isn’t stored, your answer stays, and the screen tells you why. It is an attempt, not a guarantee: whatever gets through stays in your cellar, tied to that answer, and the people who see it are you and the house. What the list doesn’t understand goes, overnight and without your name, your nickname or any account data, to Anthropic (the company behind Claude, in the United States) to read the taste words (sweet, acidic, oak…); under Anthropic’s rules for this service, what goes through it is not used to train its models. When that reading notices a person’s name, the raw sentence is deleted and only the reading stays; when it notices health, both the sentence and the reading are deleted. The reading is stored without any link to who wrote it, for up to 180 days, so that the same sentence, written by someone else, doesn’t need to be read again; the text of the sentence only stays with that reading when three or more people wrote the same thing. When the house turns one of these repeated sentences into a dictionary rule, its text stays, linked to no one, for as long as the rule exists. You remove the sentence on the spot (“remove”), by undoing the answer, or by deleting the test in “Your taste”; deleting the account deletes everything. Legal basis: consent (art. 7, I), given when you write the sentence.

e8) If you photograph the back label (the back of the bottle, when the front reading doesn’t find the wine or isn’t sure): the photo, reduced on your device and without location data, goes to Anthropic only to read what the producer wrote there, and comes back as text. The photo is not kept. The house keeps only that text (producer, region, grapes, alcohol, vintage, type, importer and volume), together with the front reading and what you checked or corrected, to decide in the Balcão whether the wine joins the search. Without a cellar, nothing is linked to you: the daily count uses a network code that changes every day, without your IP. With a cellar, the back label is linked to your account only for the +20 points when the wine joins the search, and the link goes away when it does or after one year; meanwhile, the house sees your nickname next to the reading. Legal basis: legitimate interest (adding to the base the wine it doesn’t have yet) and, for the points, performance of the sign-up (art. 7, V).

f) Audience measurement: we use GoatCounter and Umami, which count visits and clicks without cookies and without identifying you (your IP address isn’t stored). And the list of cities in the sign-up form comes from the public API of IBGE (Brazil’s statistics institute), which receives only the state’s abbreviation — none of your data; the lists for Portugal (the official administrative map, CAOP) and the United States (Census Bureau) are stored on the site itself. To know whether people come back, your device keeps, on the device only, the date of your first visit and counts each return milestone (1, 7 and 30 days) once, along with the day of that first visit, like any other click: nothing that identifies you. And the label-reading log (made for the house to track down phone bugs) only records on a device that has opened the address with #diag-foto: the last 80 lines of what the photo and the pages did, on that device only, never sent over the network; the “Limpar” (Clear) button erases it. And when the house shows the chance you’ll like a wine, the counter receives only its range (in steps of 20, like “chance-60”), without the wine tied to you and without anything that identifies you. In the same way, it receives only taste categories (whether a checked guess was right, wrong or in between; the reason ticked, such as “too sweet”; the button tapped), never the wine linked to you.

2. Where the data lives

Profiles and passwords are kept at Supabase; forms and hosting, at Netlify; the e-mails the house sends go out through Resend. All of them are infrastructure providers, working under their own data protection agreements — they process data on our behalf, they don’t own your data. When Netlify receives any form from the site (wine list, suggestion, tip, error report, let me know), it also records the IP address, the browser and the page the submission came from: that’s how the service works. The house doesn’t use these three pieces of data for anything and doesn’t copy them anywhere, with one exception, spam (just below); they stay only in the Netlify dashboard, which the house reads and can delete.

Spam. When a submission is spam (advertising, scams, adult content), the house can block whoever sent it: it keeps a code derived from the IP address (the IP itself is not stored, and the code can’t be turned back into an IP), the e-mail typed in and the domain of any links in the text. Later submissions that match are deleted on arrival. Only the house sees this list and can unblock. Legal basis: the legitimate interest in keeping the forms clean (LGPD, art. 7, IX).

3. What we NEVER do

• Sell, rent, trade or hand over your data to third parties. Never. Not for any amount of money: our opinion is not for sale, and your details even less so;
• Hand your data over to an advertiser, brand, winery or importer;
• Send spam — you get the essentials, and not much more;
• Use advertising tracking cookies;
• Show your name, e-mail, age or address publicly: what the community sees is the nickname you chose.

4. How long we keep it

For as long as your account exists, or as long as you want to get the e-mails. Asked to leave? We delete it — and whatever the law requires us to keep, we keep only for the period it sets, and no longer.

5. Your rights (LGPD)

You can ask, at any time and free of charge, for: confirmation that we hold your data, access to it, correction, portability, withdrawal of consent and deletion of your account and your data. Just get in touch at contato@vinhozinho.com.br or on Instagram at @vinhozinho — we sort it out with no red tape.

6. Minors under 18

This site is for people aged 18 and over and doesn’t create profiles for minors. If we find a sign-up from someone under 18, we delete it.

7. Changes to this policy

If anything changes, this page gets updated, with a clear note of what changed and the date at the bottom. On September 24, 2026 item e) was added, about Open Bottle, À mesa, cheers, games and the e-mails for cellar holders, along with the Taça em Tela tip in item d). On September 25, 2026, Umami joined item f), alongside GoatCounter. On September 26, 2026 item d2) was added, about reporting a mistake on a wine page, and item 2 began to say what Netlify records on every form. On September 28, 2026 item b) started to include the country (people who live in Portugal, the United States or another country can also create a cellar), item f) says where the city lists for those countries come from, and item d3) was added, about “O preço bate?” on each wine page. Also on September 28, 2026, item e) went to four e-mails (the cheers heads-up, one a day at most, and the one for comments on your bottle were added), and items e2), about phone alerts, and e3), about label reading by photo, were added. On 29/09/2026, item d4) came in, about the community rating. On 30/09/2026, item d5) came in, about producers sending a wine’s official spec sheet. On 01/10/2026, item 2 began to say what the house keeps about people who send spam. On 06/10/2026, item e3) began to say what happens when you ask “Let me know when it comes in” on a label photo, and items e) and e2) mention that alert. Also on October 6, 2026, item d2) began to cover the Guide pages (the grapes and the regions got the same button to report a mistake), and items a) and e) began to mention the grape of the week, the Monday e-mail. On October 13, 2026, item d) began to mention the question or term sent in the Glossary and the place suggested for the Trips map. On October 16, 2026, item e) began to mention the Label of the Day ranking, which shows the nickname of cellar players. On October 23, 2026, item d4) began to show the average from the first rating on, and the number of people only above ten. On October 31, 2026, item f) began to mention the return marker kept on the device. On November 1, 2026 item e4) was added, about the barcode. Also on November 1, 2026, item f) began to say that the return milestone carries the day of the first visit, and to mention the label-reading log. On November 4, 2026, item d) began to mention the question suggested on the wine questions page. On November 9, 2026, item e5) was added, on Vinhozinho in your AI assistant. Also on November 9, 2026, item e3) began to say what the house keeps when someone reads a label without a cellar, items e6), about My readings and the card to post, and e7), about the taste quiz and the chance you will like a wine, were added, and item f) began to say that the range of that chance goes, anonymously, to the counter. Also on November 9, 2026, item e7) began to say that the chance learns from what is on your device and from your “I liked it / I didn’t like it” answers, that the guesses are kept in your cellar and the legal basis of each part, and item f) began to list the taste categories the counter receives. On November 10, 2026, item e7, the sentence, was added: the optional sentence after “I liked it / I didn’t”, read on your device and, without any link to you, by Anthropic. Also on November 10, 2026, item e8) was added, about the photo of the back label.

Last updated: November 10, 2026.