Privacy policy

This policy explains what personal data Vinpit collects, why, who sees it, how long we keep it and how you can see, correct or delete it. It is also our Personal Information Collection Statement under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Please read it before you create an account or send us your details.

1. Who we are

Vinpit is run by LET'S DRINK NATURAL COMPANY LTD ("Vinpit", "we", "us"), [To confirm with Amy: address]. We are the data user responsible for your personal data. You can reach us at info@vinpitwines.com or through the contact page.

2. What we collect

When you create an account

• Your first name, last name (optional) and email address.
• A password, which we store only in a scrambled (hashed) form we can't read. If you sign in with Google instead, we receive your name, email address and a Google account identifier from Google.
• The versions of this policy and our terms you accepted (accepting the terms includes confirming that you are 18 or over), with the time, your IP address and your browser type, as a record of what you agreed to.
• How you found us, if you arrived through a tagged link (for example from Instagram or a QR code) or told us you met us at the Hong Kong International Wine & Spirits Fair.
• A profile photo, if you add one.

What you must give us. Your name, email address, a password (or Google sign-in) and your acceptance of these documents, which includes confirming that you are 18 or over, are needed to open an account. Without them we can't open one. Everything else is optional.

When you use the site

• Adoptions: the vine adoption you reserve, how you choose to pay (deposit or in full), its reference, amounts, status and the updates about your vine.
• Payments: when online payment opens, card and wallet payments are handled by our payment provider. We receive the result and the amount, never your full card number. [To confirm with Amy: payment provider and methods at launch.]
• Bookings: the call or meeting you book, its time and anything you write in the note.
• Community: posts, comments, photos and video links you share, what you like or save, and reports you make about content.
• Ask Vinpit: the questions you ask our assistant and its answers.
• Your settings: your language and whether you want email updates.
• Technical data: our servers record basic request information (such as IP address, browser type and time) to keep the site secure and working.

When you write to us

The contact form asks for your name, email address and message. It is sent to our inbox so we can reply. It is not stored on the website. We use it only to answer you, and keep the email for as long as we need it to deal with your question. [To confirm with Amy: how long contact emails are kept.]

3. Why we use it

• To open and run your account and keep it secure.
• To reserve and look after your vine adoption, take payment, prepare your wine and label, and send you updates about your vine.
• To arrange the calls and meetings you book.
• To run the community: show your posts and comments to other members, and deal with reports.
• To answer your questions, through Ask Vinpit or by email.
• To send service emails you need, such as sign-in and password emails, booking confirmations and adoption updates.
• To send news and offers, only if you have said yes (section 4).
• To understand which channels bring new members, using the referral source only.
• To meet our legal duties, including the rule that alcohol is not sold or supplied to anyone under 18, and keeping business records.

We don't use your personal data for any other purpose without your consent, unless the law allows or requires it.

4. News and offers (direct marketing)

We would like to send you occasional emails about the harvest, events (including our booth at the Hong Kong International Wine & Spirits Fair), new wines and offers. We can only do this with your consent. Email updates are off until you turn them on in your account. If you turn them on, we use your name and email address for these emails.

You can turn email updates off at any time in your account, through the link in any of these emails, or by writing to us, free of charge. We never give or sell your personal data to anyone else for their own marketing.

5. Who we share it with

We don't sell your personal data. We share it only as needed with:

• Service providers who run Vinpit for us, under contracts that require them to protect it: website hosting (Vercel), database and file storage (Supabase), scheduled tasks (Upstash), email delivery [To confirm: email provider at launch], online payments (Stripe, once payments open), Google (Google sign-in, and the calendar used for bookings once connected), and Anthropic (the AI provider that answers questions you ask Ask Vinpit).
• The vineyard and winemakers we work with, only what they need to prepare your adopted vine's wine and label. [To confirm with Amy: whether adopters' names are shared with the vineyard, for example on labels.]
• Other members, who can see the community posts and comments you share, with your name and profile photo.
• Professional advisers (such as accountants and lawyers), and authorities when the law requires it.

6. Storage outside Hong Kong

Some of our service providers store or process data outside Hong Kong, for example in the United States, the European Union or Singapore. [To confirm: the hosting regions chosen at launch.] We choose providers that protect data to a standard comparable to Hong Kong's, and we stay responsible for your data while they handle it.

7. Cookies and storage in your browser

We use only what the site needs to work. We don't use analytics or advertising cookies. If that changes, we will ask you first and update this policy.

What	Why	How long
Sign-in cookies	Keep you signed in securely	Minutes for the access cookie; up to 30 days for staying signed in
Google sign-in cookie	Complete a Google sign-in safely	The sign-in only
Language	Show the site in the language you chose	1 year
Referral source	Remember where you came from, only when you arrive through a tagged link	30 days
Age answer	Remember that you confirmed you are 18 or over	1 year, or until you close the browser if you don't ask us to remember
Cookie choice	Remember that you have seen the cookie notice	180 days
Cart (browser storage)	Keep a visitor's cart before signing in	Until cleared
Unsent post (browser storage)	Keep a community post you haven't published yet	Until published or discarded, ignored after 14 days

You can delete cookies in your browser settings. If you block them, you won't be able to sign in.

8. The community

• Posts, comments and photos you share can be seen by every signed-in member. They are not shown to people who aren't signed in.
• You can edit or delete your own posts and comments at any time.
• Any member can report a post or comment. We review reports and can remove anything that breaks the house rules in our terms of use.
• Please don't share other people's personal details, and only post photos of people who have agreed.
• When you delete your account, your posts, comments and their photos are deleted too.

9. How long we keep it

• Your account is kept until you delete it.
• When you delete your account, we delete your profile photo, posts, comments, likes, saves, cart and sign-in details straight away, and replace your name and email address with "Deleted member". We keep the records we need by law, linked to that anonymised account: adoptions and payments for our accounts, booking dates (without your note), and the record of which policy versions you accepted (without your IP address and browser).
• Accounting records (adoptions, payments, orders) are kept for as long as Hong Kong law requires business records to be kept. [To confirm with Amy: the retention period, for example 7 years.]
• Ask Vinpit conversations and server logs are kept only as long as needed to run and secure the service. [To confirm: retention periods.]

10. How we protect it

We use encrypted connections (HTTPS), store passwords only in hashed form, limit staff access to what each person needs, and choose service providers that keep data secure. No system is completely secure. If something goes wrong that affects your data, we will act quickly and tell you where we should.

11. Your rights

• See your data. You can see most of it in your account. You may also ask for a copy of the personal data we hold about you (a data access request). We will reply within 40 days. We may charge a fee that is not excessive for a copy.
• Correct it. You can change your name and settings in your account, or ask us to correct anything that is wrong (a data correction request).
• Delete your account from your account page (see section 9). An account can't be deleted while it has a paid or deposit-paid adoption in progress, or if it is a staff account: write to us and we will help.
• Stop email updates at any time (section 4).

Send requests to our Data Protection Officer [To confirm with Amy: name or title] at info@vinpitwines.com or [To confirm with Amy: address]. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

12. Over 18s only

Vinpit is about wine. Under the law of Hong Kong, intoxicating liquor must not be sold or supplied to a minor in the course of business. Our site and services are only for people aged 18 or over, and we don't knowingly collect personal data from anyone younger. If you think someone under 18 has given us their details, please tell us and we will delete them.

13. Changes to this policy

When we change this policy we publish a new version here, with the date it took effect. If a change matters to how we use your data, we ask you to read and accept the new version the next time you sign in. Earlier versions you accepted are listed in your account.

14. Languages

This policy is available in English and Chinese. If the versions differ, the English version applies.