Legal

Privacy Policy

Last updated 29 October 2026

This policy explains what personal data we collect through the Vinealto website and our two apps, Vinealto Dining and Vinealto Learning, how we use it, and the rights you have under United Kingdom data protection law. Vinealto is a brand operated by Honest Glass Group Limited, a company registered in England and Wales under company number 17202326. We are the controller of the personal data described here.

1. Who we are

The controller is Honest Glass Group Limited, registered in England and Wales, company number 17202326, registered with the Information Commissioner's Office under registration reference ZC168256. For any question about this policy or your data, email us at elise@vinealto.com.

2. The data we collect

Account: your name, email address, date of birth, the Vinealto awards you hold and your newsletter and Public Register choices, with a record of when you made or changed them, if you create an account.
Progress: your answers and progress in the Coach, your exam entries and results, and your TasterPro answers, so we can bring each question back at the right time and record your awards.
Purchases: what you bought and when, and your confirmation at checkout that you wanted access straight away. Your card details are handled by Stripe and never reach us.
Newsletter: your email address and your choice, if you ask for the Vinealto newsletter. We count an address only after you confirm it through the link we email you.
Public Register: your name, highest award and the date you achieved it, shown only if you choose to opt in.
Photographs and speech (At the Table, in the Dining app): the photographs of a wine list or menu that you take or choose, and the words of any dishes you say. See section 5.
Tutor chats (the Coach, for Certificate and Fellowship learners): what you write or say to the Tutor and its replies. See section 5.
Location (Dining app, only if you allow it): used on your phone to open the Guide map where you are. It is not sent to us.
Feedback: the notes and ratings you send us through the apps or the website, any reply address you give, and the app version and type of phone. If you are not signed in, we keep a scrambled form of your network address that cannot be turned back into the address, so we can stop misuse.
Business registrations: the restaurant or business name, your name, email address, telephone number and town, if you register for Vinealto for Business.
Technical data: the network address and time of each request, recorded by our hosting and database providers so the service runs and stays secure. We use no outside analytics or advertising tools.
Visit counts: we run our own simple counter, with no cookies. For each page viewed on the website it records the page, the site you came from, any campaign tag in the link, the type of device and the country. To count each visitor once a day, it turns your network address and browser type into a code that changes every day and cannot be turned back; your network address itself is never kept. In the Coach we count sessions started, questions answered and sets finished, and for members these counts are kept with the account. If your browser sends a Do Not Track or Global Privacy Control signal, the website counts nothing. This does not apply to the questions you answer in the Coach while signed in, which we record to run your course.
Free entries without an account: if you open a Guide entry or a pairing, or begin a TasterPro tasting, on the website without signing in, we give your browser a random code in a cookie and record which entries that code has opened and how many tastings it has begun, so we can give you two free Guide entries, two free pairings and three free TasterPro tastings. The Dining app keeps a random code of its own on your phone for the same purpose, and for one free At the Table reading; it identifies no one. We use these codes for nothing else.
Messages: anything you send us when you get in touch.

3. How we use it, and our lawful basis

To send the Vinealto newsletter, on the basis of your consent.
To run your account, your progress and any purchase or subscription you take, and to send the service and account messages that go with it (such as confirmations, results and security notices), to perform our contract with you.
To show your entry on the Public Register, on the basis of your consent (opt in).
To read the photographs and words you give At the Table and suggest wines, to perform our contract with you.
To run the Tutor in the Coach, which is part of your course, to perform our contract with you.
To use the content you send us to inform and improve our pairing reasoning and restaurant assessments, on the basis of our legitimate interests in building a good guide.
To run the service, keep it secure and stop misuse, on the basis of our legitimate interests in running a good service.
To count visits and use of the Coach, so we can see what people use and make it better, on the basis of our legitimate interests. We report these counts as totals and never sell or share them.
To meet our legal obligations where the law requires it.

4. Learning from you, to tailor what we show you

Vinealto improves with use. As you rate pairings, work through the Coach, or use the Pairing Library, we learn your tastes and preferences and use them to tailor our recommendations and the way the Coach is delivered to you, on the basis of our legitimate interests in giving you a better service, and your consent where it applies. From time to time we may ask you to tell us your preferences directly, or to update them, so that we can serve you better. You can review, change or reset your preferences in your account at any time. We do not use this to advertise to you.

5. Our use of artificial intelligence

Some of what Vinealto does is helped by artificial intelligence: for example, the engine that reasons about food and wine pairings, and parts of the Coach. AI helps us work quickly and consistently, but our published content is created and checked under human editorial control, and we do not make decisions producing legal or similarly significant effects on you by automated means alone.

When you use At the Table in the Dining app, the photographs you take or choose, and the words of any dishes you say, are sent to our server and passed to Anthropic, the AI service that reads them, so we can read the menu and wine list and suggest wines. If the service cannot be reached, your phone reads the photograph itself instead. We do not keep the photographs. Where a wine or a dish is one we do not yet recognise, we keep its name, with nothing that identifies you, so we can add it to our reference. Anthropic reads them on our instructions, does not train its models on them, and normally deletes them within 30 days under its own terms. Spoken words are turned into text by your phone's own speech service, from Apple or Google, which may process the recording on its own servers under its own terms; the recording never reaches us.

The Coach includes a Tutor for learners on the Certificate and the Fellowship. Once a day it may ask you to explain, in your own words, a few things you have already learnt. What you write or say to it is sent to our server and passed to Anthropic, which writes the Tutor's replies from the book and our own questions. Anthropic does this on our instructions, does not train its models on it, and normally deletes it within 30 days under its own terms. We keep each chat with your progress, so the Coach can bring back anything you found hard and so we can check that the Tutor's answers are right. The Tutor is optional: you can turn it off at any time with the switch on the Coach home. If you speak your answer, your phone's own keyboard turns it into text, through Apple or Google, before it reaches us.

Elise is the name of our customer desk. Replies are drafted with the help of AI, and our team checks and approves every one before it is sent. We also use AI tools, including Anthropic's Claude, to help us sort and answer the feedback and messages you send.

6. The Public Register

The Public Register is a standing page that lists individuals who hold a Vinealto Learning award and have chosen to appear, so that a potential employer can verify a candidate's qualification. Inclusion is opt in and unticked by default. An entry shows your name, highest award and the date achieved. It shows no contact details. You can remove yourself at any time in your account, and your entry comes down at once. Separately, anyone holding a certificate number and the holder's surname can check that a certificate is genuine; the check shows only the award and date.

7. Marketing

To individuals, we only send marketing email with your consent. You can withdraw it at any time in your account or by writing to us, and every newsletter will carry an unsubscribe link. We use Resend, an email delivery service based in the United States, to send our email.

Separately, we sometimes contact restaurants and other businesses we have not dealt with before: for example, to let a restaurant know it features in the Guide, or to tell it about Vinealto for Business. We do this on the basis of our legitimate interests in reaching the trade: we identify ourselves clearly, we keep it relevant to their business, and every message lets them opt out. This is business to business contact with an organisation, not consumer marketing.

We never sell your data.

8. Who we share it with

We share data with the service providers who run parts of Vinealto for us, and they may use it only to provide that service:

Supabase, which holds our database and your sign in, in Ireland.
Netlify, which hosts the website.
Resend, which sends our email, in the United States.
Anthropic, which reads At the Table photographs and words, writes the Tutor's replies in the Coach, and whose AI tools help us with our work.
Google, which runs our email mailboxes.

Stripe takes our payments. It also uses some payment data for its own purposes, such as preventing fraud and meeting its legal duties, as its own privacy notice explains. If you ask us to combine two Vinealto accounts, we move everything from one into the other and then close the empty one. We may also disclose data where we are required to by law. We do not sell your personal data to anyone.

9. International transfers

Some of our providers are based outside the United Kingdom, mostly in the United States. Where your data is transferred abroad, we rely on UK adequacy regulations for the destination country (including the UK extension to the EU and US Data Privacy Framework, where the provider is certified), or on the UK Addendum to the EU standard contractual clauses, so that your data keeps an equivalent level of protection.

10. How long we keep it

We keep account data until you delete your account, which you can do at any time on the website (see vinealto.com/delete-account). Deleting it removes your account, your progress (including your Tutor chats), your awards and anything bought on it (we keep only a short record of each award, its certificate number, award, date and name, so a certificate can still be checked), and cancels any subscription you took on the website. We keep a record of each purchase and of your confirmation at checkout for six years, without your account and with your email address scrambled, in case a payment is disputed. Feedback notes you sent in the apps stay, without your name or email address; messages you emailed us, or sent through the feedback tab on the website, stay in our mailbox for up to two years after the last message. Stripe keeps its own payment records, as the law requires. We keep newsletter data until you withdraw your consent, Public Register entries until you opt out, and business registrations until you ask us to remove them. We keep a record of each visit for 30 months. After that we keep only daily totals, which identify nobody. Where the law sets a minimum retention period, we keep data for that period. Our data retention policy sets out every period.

11. Your rights

Under UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its use, to data portability, and to withdraw consent at any time. To exercise any of these, email elise@vinealto.com.

12. Complaints

If you are unhappy with how we handle your data, write to elise@vinealto.com with "Data complaint" in the subject (see our data protection complaints procedure). We will acknowledge your complaint within 30 days, look into it, and tell you what we have found and what we will do. You can also complain to the Information Commissioner's Office at ico.org.uk.

13. Cookies

The site uses a few cookies and similar technologies, each needed for something you have asked for, such as signing in, using a code or reading your free entries. None is used for advertising or tracking. Our Cookie Policy lists each one.

14. Age

Vinealto is for adults of legal drinking age, which in the United Kingdom is 18 or over. We ask for your date of birth when you create an account and use it only to check this. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we will remove it.

15. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed.