Stimanda

Privacy policy

Last updated: 6 November 2026

This privacy policy explains which personal data is processed when you use Stimanda, for what purposes, who can see it, how long it is kept, and which rights you have. It applies to the website stimanda.app and the Stimanda app for iPhone.

  1. Controller and contact

    The controller responsible for processing personal data in connection with Stimanda is Stefano Peduzzi (the “Operator”):

    Stefano Peduzzi, Via Campagnora 72, 6532 Castione, Switzerland. Email: support@stimanda.app

    Questions about data protection and requests to exercise your rights can be sent to this address. The Operator is not required to appoint a data protection officer and has not done so.

    Representative in the EU and the United Kingdom: for persons in the EU, Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria, is the Operator’s representative under Art. 27 GDPR. For persons in the United Kingdom, it is Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom, under Art. 27 UK GDPR. Data protection requests can also be made through the representative: https://app.prighter.com/portal/12784810077

  2. Personal data processed

    Depending on how you use Stimanda, the following personal data is processed:

    • Account data: email address and password. For every new account, including an anonymous one, the confirmation that the person is at least 18 years old, and the time of that confirmation. The password is stored only as a one-way cryptographic hash and cannot be read by anyone, including the Operator.
    • Profile data: the display name, whether other participants of a class may see it (the “Show my name to others” setting, off unless you turn it on), a profile photo if you add one, and the wine certification you state, with whether it has been verified.
    • Tasting data: the answers given in a tasting, the resulting score, the level, the language used, the start and completion times, and, if you enter it, the place where you tasted, in your own words. When a completed tasting is edited, the previous version is retained with it. Statistics on your profile are calculated from these tastings.
    • Wine data: information recorded about a wine, such as producer, name, vintage, colour, country, region, grape varieties, alcohol content, price, whether you own it, have tasted it or want to try it, how many bottles you have, and photos of its label if you add them.
    • Class data: for teachers, the classes and sessions they create, the class list with the names, email addresses and levels they enter for the people they invite, and the answers submitted by the participants. For participants, the name entered for a class or session, the answers, the mark, and the times of joining and handing in. For teachers who join a school, the membership of that school.
    • Anonymous accounts: a class can be joined without signing up, and the iPhone app can be used without signing up. In that case Stimanda creates an anonymous account without email address or password, identified only by a random identifier stored in the browser or on the device. If the person later creates an account or signs in, the data recorded under the anonymous account can be transferred to the personal account.
    • Certification proof: if you ask Stimanda to verify a certification, an identity document and a diploma or certificate. Section 5 describes this in full.
    • Feedback: the message you send with the feedback form, together with the app version, the device or browser, the language, the level and the screen you were on.
    • Anonymous usage data: counts of how the app is used, which cannot be linked to a person. Section 6 describes this in full.
    • Technical data: the IP address transmitted with every request, and a log of sign-ins including the IP address, kept by the authentication service to protect accounts against misuse.

    Stimanda never asks for the location of the device and does not read contacts or other content of the device. Photos and documents are processed only when you choose them yourself. Before a photo leaves the device, the app redraws it, which removes the information stored in the file by the camera, such as the location.

  3. Purposes and legal bases

    Personal data is processed for the following purposes:

    • Providing the service: managing the account, storing tastings, wines and photos, and conducting classes and sessions.
    • Service emails: the code that confirms the email address, the code that resets the password, and the class invitations a teacher sends from Stimanda. Stimanda sends no newsletters and no advertising.
    • Verifying a certification: checking the documents you upload for this purpose, as described in section 5.
    • Answering feedback: reading your message, answering it and fixing the problem it describes.
    • Security and operation: detecting faults, preventing misuse and keeping the service stable, based on request and sign-in logs.
    • Improving the service: evaluating tastings in aggregated form, for example how often a suggested score is changed, and the anonymous usage data of section 6, in order to improve the questions, the scoring and the app. These evaluations are not used for advertising and are not disclosed to third parties.

    The processing complies with the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, the legal bases are: the performance of the contract with the user (Art. 6(1)(b) GDPR) for providing the service, the service emails to users and answering feedback; consent (Art. 6(1)(a) GDPR) for verifying a certification; the Operator’s legitimate interest in a secure, functioning and continuously improved service (Art. 6(1)(f) GDPR) for security, operation and improvement; and the teacher’s legitimate interest in putting together their class (Art. 6(1)(f) GDPR) for invitations to people without an account. A teacher who enters the email address of a person in order to invite them is responsible for being allowed to do so.

  4. Who can see your data

    Access rules in the database decide on every request what an account may read. They work as follows:

    • Your tastings, wines, label photos and statistics are visible only to your own account. One exception: when at least three other people have finished a tasting of the same wine, the statistics of each of them compare their own result with the middle result of the others. Your finished tasting then counts towards these figures, which are shown only as counts and medians, without your name, the date or any single answer. Tastings of anonymous accounts and of a session that has not ended are not counted. Photos of wines in the shared wine list of Stimanda, which only the Operator adds, are visible to every signed-in user.
    • The teacher of a class or session sees the name entered for it, the answers, the mark and the progress of each participant across the sessions of the class. The teacher sees a participant’s profile photo only if that participant has turned on “Show my name to others”.
    • Other participants of a session see your name and profile photo only if you have turned on “Show my name to others”. Otherwise you are only counted. They never see your individual answers; when a question is revealed, only the combined distribution of all answers is shown.
    • The management of a school that a teacher has joined sees that teacher’s classes, how many people are on each class list, and the same results of the sessions that the teacher sees, including the names of the participants. It does not see participants’ own tastings outside the class, their individual answers, or email addresses. A teacher’s classes become visible to a school only once the teacher has accepted the invitation to join it.
    • A person invited to a class sees the name of the teacher and of the class.
    • The administrators are the Operator and the contracted developer. They see the list of accounts with email address, display name, date of sign-up and of last sign-in, whether the account may teach, and how many tastings and classes it has, but no answers, wines or class content. Requests to verify a certification are reviewed by the Operator, as described in section 5.
    • The Operator reads feedback messages. The Operator and the contracted developer read the database itself only where needed for operation, support or the correction of an error.

  5. Certification proof

    In your profile you can state a wine certification you hold, for example a WSET level. As long as Stimanda has not checked it, it is shown as stated by you. If you want it verified, you can send proof. This is voluntary: Stimanda can be used without a verified certification; only levels expressly reserved for a verified certification are then not available.

    • What is asked for: two documents, an identity document (passport, identity card or driving licence) and the diploma or certificate that shows the certification, with your name on it. On the identity document you may cover everything except your name, including the photo, the date of birth, the document number and the address. Each document is a photo or a PDF of at most 10 MB. Nothing is sent without your express consent, which you give with a tick box that is never ticked in advance, and the time of that consent is recorded with the request.
    • What is checked: only that the name on both documents is the same, and which certification the diploma proves. Nothing is compared with a face.
    • Where the documents are stored: in a private storage area of the database provider Supabase, in Zurich, Switzerland, which nobody can reach without signing in, and only in a folder of your own account.
    • Who sees them: you, and the Operator, who reviews the request while it is open. The Operator opens a document through a personal link that is valid for ten minutes. The contracted developer has technical access and opens a document only where needed to correct an error. Nobody else sees the documents, other users never do, and they are not passed to anyone else.
    • When they are deleted: as soon as the Operator decides on the request, you withdraw it, or you delete your account. The database removes the record of the documents at once and the files within seconds, at the latest within one hour. If nothing has been decided 30 days after you sent the request, it is closed and the documents are deleted in the same way. A file that was uploaded but never became a request, for example because the connection dropped, is deleted after one hour.
    • What is kept: the request itself: which level was asked for, which level was confirmed, when it was sent, when and how it was decided, and for a refusal the reason given. It is kept, like the rest of the profile, until the account is deleted. Who decided is recorded in an internal log.

    Documents are not part of the data download (section 11): while a request is open, the download lists them by file name; after the decision it holds only the request. The backups of the database (section 10) do not contain the documents, only the record of the request with the file names. The file names can remain in a backup for up to seven days after deletion.

  6. Anonymous usage measurement

    To learn where Stimanda is hard to use, the website and the app count a few events in Stimanda’s own database, for example that a tasting was started or completed, which question was on screen, that a help text was opened, or how an aroma was chosen. No analytics service of a third party is used, and nothing is stored in the browser or on the device for this purpose.

    Each event carries the platform, the app version, the language of the app, the level and question concerned, the hour, and a random number that is created when the app is opened, is kept only in memory and is replaced after 30 minutes of inactivity. Events carry no account, no name, no email address, no IP address, no device identifier, no location and no answer. They are sent without the sign-in, so they cannot be linked to an account, nor one visit to the next. To limit misuse, the number of events arriving from the same network on one day is counted. Only a value calculated from the IP address with a random key is stored for this; the key and the counts are deleted the following day, after which the value can no longer be linked to any network. The landing page and these legal pages are not counted. Events are deleted after 400 days.

  7. Processors

    The Operator uses processors for development and maintenance, hosting, the database, the storage of files, sending email and the mailbox of the contact address. They are bound by contract to confidentiality and may process personal data only on the Operator’s instructions. The following processors are used:

    • A contracted developer: development, maintenance and operation of Stimanda, with access to the database and the stored files where needed for this.
    • Supabase (Supabase Pte. Ltd., Singapore): database, storage of photos and documents, user accounts and authentication, and the daily backup. The database, the stored files and the backups are located in Zurich, Switzerland, in data centres of Amazon Web Services.
    • Cloudflare (Cloudflare Inc., USA): hosting and delivery of the website, protection against attacks, and storage of the encrypted backup copies in the EU. Cloudflare processes the IP address of every request, in data centres worldwide.
    • Resend (Plus Five Five, Inc., USA): sending the service emails and class invitations, and forwarding feedback to the Operator. Resend processes the email addresses and the content of these emails.
    • Infomaniak (Infomaniak Network SA, Switzerland): the mailbox of the contact address support@stimanda.app. Emails to the Operator and forwarded feedback are received there. The data is stored in Switzerland.
    • Prighter (Prighter GmbH, Austria): receiving and forwarding requests from data subjects made through the representative. The data is stored in data centres of Hetzner Online GmbH in the EU.

    Apple (Apple Inc., USA, through Apple Distribution International Ltd., Ireland) distributes the iPhone app through the App Store and TestFlight and processes personal data in doing so on its own responsibility and under its own privacy policy. Feedback and screenshots that testers send through TestFlight reach the Operator through Apple.

    Personal data is not sold. It is disclosed to other third parties only where the law requires it.

  8. Disclosure abroad

    The database, the stored photos and documents, Supabase’s daily backups and the mailbox of the contact address are located in Switzerland, and the encrypted backup copies at Cloudflare in the EU. Supabase may access them for operation and support from Singapore, the United States and other countries. Cloudflare processes personal data in data centres worldwide, Resend in the United States. For the United States, the disclosure is based on the certification of the provider under the Swiss-U.S. and EU-U.S. Data Privacy Framework or, where this does not apply, on the standard contractual clauses of the European Commission as recognised by the Federal Data Protection and Information Commissioner (FDPIC). For Singapore and other countries without adequate data protection, it is based on these standard contractual clauses, which are part of the contracts with the providers.

  9. Cookies and local storage

    Stimanda does not use advertising cookies, third-party analytics tools or tracking technologies. Only the following technically necessary data is stored in the browser:

    • Sign-in session: in the browser’s local storage, until the user signs out.
    • Language setting: in a cookie named degusto_locale, for one year, once a language has been selected.
    • Answers not yet sent: each answer of a tasting is kept in local storage until the server has received it, so that nothing is lost when the connection drops.
    • Display settings: for example whether the list of questions is open during a tasting and the filters of the wine list, in local storage.
    • Notice seen: the date on which the note on responsible drinking was shown, so that it is not shown again, in local storage.
    • Transfer note: a one-time note that allows the data of an anonymous account to be transferred to a personal account at sign-in, in session storage, deleted when the tab is closed.

    The iPhone app stores equivalent data on the device, the sign-in in the device’s keychain. As only technically necessary storage is used, no consent is requested.

  10. Retention period

    • Account and associated data: until the account is deleted. What you delete earlier, such as a tasting, a wine or a photo, is deleted at that moment.
    • Anonymous accounts: until the account is deleted in the app, at the latest twelve months after it was last used.
    • Photos: a profile photo that is replaced or removed is deleted within seconds, at the latest the next day. Label photos are deleted with the photo, the wine or the account; a file that is left over after an interrupted connection is removed at the latest after one month.
    • Certification documents: as described in section 5, at the latest 30 days after the request was sent.
    • Answers in a class session: until the teacher deletes the session, the class or their own account, or the account of the participant is deleted. The tasting that a session creates in the participant’s own history stays with the participant’s account.
    • Names and email addresses on a class list: until the teacher removes the person or deletes the class, or the person leaves the class.
    • Feedback: in the database until the account is deleted. The email that forwards it remains in the Operator’s mailbox until the matter is settled, for at most one year.
    • Record of administration: when an administrator suspends an account, lifts a suspension or removes an account, the record keeps who did it and when, with the email address of the account and, for a suspension, the reason. This entry is kept after the account is deleted, so that it remains clear who removed an account. Only administrators can see it.
    • Anonymous usage data: 400 days.
    • Logs of the service providers: for the limited period set by each provider.
    • Backups: the database is backed up once a day, and each backup is kept for seven days. In addition, an encrypted copy of the database and of the stored photos is placed with Cloudflare in the EU every night and deleted after seven days at most. Deleted data can therefore remain in a backup for up to seven days. Backups are used only to restore the database after a fault. After a restore, every deletion made since the backup is carried out again from a list of the deleted ID numbers; this list is kept for 35 days.

    After an account is deleted, only records that no longer refer to the person are kept, for example the bare identifier of a completed tasting, so that it cannot be sent a second time. The one exception is the record of administration, when an administrator removed the account.

  11. Rights of data subjects

    Within the limits of the applicable law, every data subject has the right to:

    • obtain access to the personal data processed about them;
    • have incorrect personal data corrected;
    • have personal data deleted;
    • have the processing of their personal data restricted;
    • receive their personal data in a common electronic format or have it transferred to another controller;
    • object to processing based on legitimate interest;
    • withdraw a consent at any time, with effect for the future, for example by withdrawing an open request to verify a certification.

    The account can be deleted at any time on the profile page of the website or in the Profile tab of the app. All associated data is then deleted immediately and permanently, including photos and certification documents. Records can remain in the backups of the database for up to seven days (section 10). A copy of the account’s data can be downloaded at any time on the profile page of the website or in the Profile tab of the app. It comes as one ZIP file holding a table of the tastings for a spreadsheet and a complete copy in a common machine-readable format (JSON). Photos and documents are listed in it by file name; the files themselves can be requested by email. Other requests, such as for access or correction, can be sent from the email address of the account to support@stimanda.app. Requests are answered within 30 days and free of charge. Persons in the EU and the United Kingdom can also submit their requests through the representative’s form: https://app.prighter.com/dsr/12784810077. The display name, the “Show my name to others” setting and the profile photo can be changed on the profile at any time.

    Data subjects also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, with the supervisory authority of their country of residence.

  12. Data security

    The Operator takes appropriate technical and organisational measures to protect personal data. All connections are encrypted, and the database and the stored files are encrypted at rest. Access to the database and to the stored files is checked on every request against the identity of the requesting account, so that each account can read only what section 4 describes. Photos and documents lie in private storage areas that cannot be reached without signing in. Should a breach of data security pose a high risk to data subjects, the Operator will inform the affected persons and the competent authority as required by law.

  13. Minors

    Stimanda is intended for persons aged 18 or over, as set out in the terms of use. With every new account, the person confirms that they are at least 18 years old. The Operator does not knowingly process personal data of persons under 18. If it becomes known that a person under 18 has created an account, it will be deleted.

  14. Changes

    The Operator may amend this privacy policy. The version published on this page, with the date stated at the top, applies. Users are informed of material changes by email or in the app before they take effect.

    This privacy policy is available in German, English, Italian and French. In the event of any discrepancy, the German version prevails.