Your data, your palate.

1. Scope

This Privacy Policy applies to personal information we collect from users of our services in the United States. The Service is intended exclusively for users who are 21 years of age or older.

2. Data We Collect

We collect the following categories of personal information from you and about you:

• —Account data: email address, age verification, username, and password.
• —Wine preference and tasting data: wine tastes, reviews, ratings, and generated palate profiles.
• —Dietary and health-adjacent data: dietary restrictions, sulfite sensitivity, alcohol tolerance, or other preferences you voluntarily provide.
• —Device identifiers: IP address, device type, operating system, browser type, RAM, and screen resolution.
• —Usage and behavioral data: pages viewed, time spent, navigation paths, and feature interactions.
• —Photos and images: user-uploaded photos of wine labels, bottles, or other content, and associated metadata.
• —Geolocation data: precise GPS data, if applicable and authorized by you in your device settings.
• —Communications data: messages or feedback you send us.

3. Aggregated & Pseudonymized Data

We may use and commercialize aggregated and pseudonymized data derived from user activity. This is the sole manner in which Palatora monetizes user data.

IMPORTANT: This data does not directly identify individuals. We implement safeguards to prevent re-identification and contractually prohibit re-identification by partners. We do NOT sell identifiable personal data.

4. Data Sharing

We share personal data only in the circumstances described below. We do not sell identifiable personal data to third parties.

• —Service Providers: Third parties that provide services on our behalf under contract, including hosting, information technology, customer support, email delivery, and website analytics.
• —Analytics Partners: Third-party analytics providers that help us understand how our Service is used, under contractual restrictions that prohibit re-identification.
• —Aggregated Data Recipients: Business partners who receive only aggregated and pseudonymized data for market research and industry analysis.
• —Business Transferees: We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in or financings of Palatora, public stock offerings, or the sale, transfer, or merger of all or part of our business, assets, or shares). In such cases, we will require the recipient to honor this Privacy Policy.
• —Authorities and Others: Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate to comply with applicable law, legal process, or governmental requests; to enforce our Terms of Service; or to protect the rights, property, or safety of Palatora, our users, or others.
• —Other Users and the Public: Parts of your profile and user-generated content (such as wine reviews you choose to make public) will be visible to other users of the Service and the public.

5. User Rights

You have the following rights with respect to your personal data. To exercise any of these rights, you may use the in-app settings or contact us at privacy@palatorawines.com. We will verify your identity before processing your request.

• —Access: You may review and update certain account information by navigating to your Profile page in the app.
• —Correction: You may correct inaccuracies in your profile directly in the app on your Profile page.
• —Deletion: You may delete your account and personal data from your Profile page using the "Delete Account" button, or by emailing privacy@palatorawines.com.
• —Withdraw Consent: You may opt out of marketing emails by following the unsubscribe instructions at the bottom of any marketing email. You may disable geolocation access in your device settings at any time.
• —Opt-Out of Data Sale (CCPA): We do not sell identifiable personal data. If this practice changes, we will update this Policy and provide a Do Not Sell My Personal Information mechanism.

Response Timelines: We will respond to verifiable consumer requests within the time required by applicable law. If we require additional time where permitted, we will inform you of the reason and extension period in writing.

Do Not Track: We currently do not respond to "Do Not Track" or similar signals. If our practices change, we will update this Policy accordingly.

6. Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by applicable law. The following specific retention periods apply:

• —Account data: retained for the life of your account and deleted within 30 days of account deletion.
• —Wine preference and tasting data: retained for the life of your account; anonymized within 30 days of account deletion.
• —Device and usage data: retained for up to 24 months from collection, then deleted or anonymized.
• —Photos and images: retained for the life of your account and deleted within 30 days of account deletion.
• —Aggregated and anonymized data: may be retained indefinitely for research and business purposes, as it cannot be used to identify individuals.

Upon account deletion, identifiers are removed within 30 days. Remaining data is anonymized and may be retained indefinitely for research and business purposes.

7. Security

We implement industry-standard security measures to protect your personal data, including encryption in transit and at rest, access controls, and monitoring and logging. However, no method of transmission over the internet or method of electronic storage is 100% secure.

8. Updates to This Policy

We reserve the right to change this Privacy Policy at any time. We will notify users of material changes by placing a notice on our site, sending an email to the address associated with your account, or via in-app notification. The effective date of the current version is stated at the top of this Policy. Continued use of the Service after the effective date of changes constitutes acceptance of the updated Policy.