1. Data controller
The data controller is Gastrona Group AB, organisationsnummer 559447-0089, Box 2656, 116 74 Stockholm, Sweden. Contact us about privacy at hello@gastrona.app. We have not appointed a data protection officer. For DSA / TCO and other legal notices, you may also use legal@gastrona.app. Company details are also on our Imprint page at gastrona.app/imprint.
2. What personal data we collect and why
- Identity and contact information When you create an account we may process your name or display name, email address, mobile number, profile picture and login identifiers, depending on how you sign in. This lets us create and secure your account and personalize the Service.
- Login methods Registration and sign-in options include:
- Mobile verification via SMS code (Firebase Phone Auth)
- Sign in with Apple
- Sign in with Google
- Sign in with Facebook
- Gastronomy activity and user-generated content If you use the log and social features we process activities you create (for example meals and pairings, wines tasted, recipes cooked, restaurant visits, cocktails), optional notes, ratings, photos and video, comments, Toasts, direct messages, follow relationships, and profile information you choose to make available. Visibility can be private, followers or public per activity; public profiles are opt-in.
- Usage, device and technical data We process app and website usage data, device and app version information, approximate diagnostics, crash logs, and similar technical data needed to operate, secure and improve the Service.
- Location data If you grant permission, we may process approximate or precise location to power restaurant and nearby features. Restaurant activity logs do not require precise location; we aim not to attach precise location to shared activities without an appropriate opt-in.
- Wine, food and preference data We process wine and food preferences, taste profile signals derived from your use, pairing interactions and related feedback to provide recommendations and improve discovery.
- AI assistant (Sophia) and chat If you use Sophia or similar in-app assistants, we process the content of your chats and related context to provide replies and maintain your conversation history for you. Chat history is treated as personal data associated with your account.
- Subscriptions and purchase signals Subscription status and entitlement signals are processed via Apple App Store, Google Play and RevenueCat. We do not receive your full payment card details.
- Website cookies and similar technologies On gastrona.app we use cookies and similar technologies as described in section 16 and on our Cookies page at gastrona.app/cookies.
3. How we use your personal data
- To provide, operate and personalize the Service, including recommendations, recipes, restaurant features and your gastronomy log.
- To enable optional social features you choose to use (profiles, follows, feed, comments, Toasts, direct messages and sharing).
- To moderate content, prevent abuse and enforce our Community Guidelines and Content Moderation Policy.
- To improve and optimize the app, website and models that support pairing and product quality.
- To send service notifications and, where permitted and you have made the relevant choices, optional marketing about wine and food — only to users who are 25 or older and only where allowed under applicable alcohol and marketing rules and GDPR.
- To process subscriptions and entitlements.
- To fulfill legal obligations, establish or defend legal claims, and prevent fraud or security incidents.
- To analyze usage (including privacy-preserving or aggregated analytics where feasible) so we can improve reliability and user experience.
4. Age, eligibility and alcohol-related content
Gastrona contains frequent references to wine and alcoholic beverages. See also gastrona.app/age-suitability.
- App store age ratings (for example 18+ on the Apple App Store) reflect platform content classification. They do not mean every person who can download the app is eligible for a Gastrona account or for wine-related marketing.
- Account registration and account-based features require that you are 25 years or older and confirm this during registration (soft confirmation today; we may strengthen verification over time).
- The Service is not intended for minors or for persons who cannot legally access alcohol-related information in their country of residence.
- In-app pairing recommendations and educational content are product features for eligible users. Promotional communications about wine or alcohol are separate and require appropriate consent or choice where required.
5. Sharing of your personal data
We do not sell your personal data. We share personal data only as needed to run the Service, as you direct through visibility settings, or as required by law. Categories of recipients include:
- Service providers (processors) We use carefully selected processors under contract, including: Microsoft Azure (hosting, storage, messaging, monitoring and AI infrastructure); Neon (Postgres database); Google Firebase (authentication, push messaging, mobile analytics/crash reporting and related Firebase services); Mixpanel (product analytics and session replay, EU); DeepL (translation); Mux (activity video processing); RevenueCat (subscriptions); Sentry (error monitoring); Cloudflare (CDN in front of media). Apple, Google and Meta (Facebook) also process data when you use their sign-in or platform services under their own terms.
- Other users Content and profile information you set to followers or public visibility, and community comments on entity pages, can be seen by other users according to those settings. Direct messages are visible to the participants.
- Legal obligations and safety We may disclose information if required by law, regulation, legal process or governmental request, or to protect the rights, safety and property of Gastrona, our users or others (including Trust & Safety reports).
- Business transfers If we are involved in a merger, acquisition, financing, reorganization or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.
- International transfers Some processors are located outside the EEA. Where we transfer personal data internationally we use appropriate GDPR safeguards, such as the European Commission’s Standard Contractual Clauses and supplementary measures where needed.
6. How long we store your personal data
We retain personal data only as long as needed for the purposes in this policy, including to provide the Service, comply with law, resolve disputes and enforce agreements. When you delete your account we follow the process on gastrona.app/delete-account: a pending request starts a grace period (currently 30 days) during which you can cancel. After the grace period we schedule deletion of account personal data. Backups may take additional time to expire (typically within 90 days). Moderated or removed media may be retained for a limited period as described in section 20 and our Content Moderation Policy. Some information you shared with others may remain in anonymized or residual form where deletion would impair others’ content (for example a comment thread); we aim to remove or anonymize identifiers where feasible.
7. Your rights under GDPR
Subject to applicable law, you have the right to:
- Request access to your personal data
- Request correction of inaccurate data
- Request deletion of your data
- Request restriction of processing
- Request data portability
- Object to processing based on legitimate interests
- Withdraw consent where processing is based on consent
To exercise these rights, email hello@gastrona.app. We respond within one month (extendable by two further months for complex requests, in which case we will tell you). You may also lodge a complaint with Integritetsskyddsmyndigheten (IMY) in Sweden or another competent EU supervisory authority.
8. Security
We take appropriate technical and organizational measures to protect personal data, including:
- Encryption of data in transit and at rest where appropriate
- Access controls and least-privilege practices for staff and systems
- Monitoring, logging and incident response processes
- Regular review of security posture as the Service evolves
9. Data quality and accuracy
We work to keep wine and product data useful and accurate:
- Processes to review and correct catalog and pairing information
- Ways for users to report incorrect information
- You can update profile and preference information in the app
10. Data minimization
We aim to collect and keep only what we need to provide the Service:
- We avoid collecting unnecessary categories of personal data
- Data that is no longer needed is deleted or anonymized according to our retention practices
- We periodically review collection practices as features change
11. User settings and preferences
You can manage many privacy-related choices in the app:
- Activity visibility defaults and per-activity visibility (private, followers, public)
- Whether your profile is public
- Notification preferences and marketing-related communication choices where offered
- Block, mute and report controls for social surfaces
12. Push notifications and local alerts
We may send push notifications for service-related updates and, where you have enabled this separately, promotional content about wine and food pairings. Service notifications support app functionality. Promotional notifications about wine or alcoholic products are sent only to users who are 25 years or older, only where you have given appropriate consent or enabled the relevant settings, and in accordance with applicable alcohol legislation. You can change notification settings in the app or on your device at any time.
13. Offline and on-device data
To improve experience, some data may be stored locally on your device:
- Cached preferences, recent activity or content needed for offline or faster use
- Synchronization when you are back online
- Local data is generally removed when you log out or uninstall, subject to OS behavior
14. Analytics, diagnostics and session replay
We use analytics and diagnostics to understand reliability and product usage:
- In the app: Firebase Analytics/Crashlytics, Mixpanel (including session replay where enabled) and Sentry
- On the website: Google Analytics 4, Ahrefs Analytics and Mouseflow (session replay / heatmaps), as further described on gastrona.app/cookies
- Where required we rely on consent or other valid GDPR bases; you can often limit analytics via OS, browser or in-app settings. Website non-essential trackers should only run with consent once our consent mechanism is enabled — until then we are working to align the site with this policy
15. Backup and recovery
We maintain backups to protect against data loss:
- Systems are backed up on a recurring schedule
- Backup copies are protected and access-limited
- After account deletion, backup expiry may lag live deletion (see section 6)
16. Cookies and similar technologies
We use cookies and similar technologies on gastrona.app for essential site functions, analytics and experience measurement. Details — including categories, providers (GA4, Ahrefs, Mouseflow) and how to control them — are on gastrona.app/cookies. You can also control cookies through your browser settings. Strictly necessary technologies may be used without consent; non-essential analytics/marketing technologies require consent where the law requires it.
17. Changes to this privacy policy
We may update this privacy policy as the Service or the law changes. We will revise the "Last updated" date and, for significant changes, provide additional notice via the app, email or the website as appropriate.
18. Applicable law and disputes
This policy is governed by Swedish law. Disputes are handled by Swedish courts, without prejudice to mandatory consumer protections that may apply in your country of residence.
19. Contact us
Privacy questions and GDPR requests: hello@gastrona.app. Trust & Safety reports: trust@gastrona.app. DSA / TCO and other legal contact: legal@gastrona.app. Postal address: Gastrona Group AB, Box 2656, 116 74 Stockholm, Sweden. See also gastrona.app/imprint, gastrona.app/age-suitability, gastrona.app/community-guidelines, gastrona.app/content-moderation and gastrona.app/delete-account.
20. Content moderation and related retention
Photos, video and related signals may be screened for safety. Restricted or removed media may be quarantined for a limited period (for example around 6 months, or longer where required for illegal content investigations) with purpose-limited access, as described in our Content Moderation Policy. Legal bases can include GDPR Article 6 and exceptions under Article 17(3). Video captions generated for screening are treated as personal data associated with the content and are included in account export and deletion where those flows apply.
Download Gastrona
Get access to all features by downloading the app from App Store or Google Play.
