CupBearer privacy policy

Last updated: 18 October 2026

This policy explains what personal data the CupBearer app processes, why we process it, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who is responsible

CupBearer is published by TortieByte Studio, Ozan Temiz, Munich, Germany (“we”, “us”), the controller for the processing described here. Full contact details are in the Imprint. For privacy questions, email hello@tortiebyte.com. We are not required to appoint a data protection officer.

2. Adults only

CupBearer is about alcoholic beverages and is intended only for people aged 18 or older, or of legal drinking age in their country if that is higher. The app asks you to confirm your age before you use it. We do not knowingly process data of minors. If we learn that an account belongs to a minor, we delete it.

3. Using CupBearer without an account

You can use CupBearer without an account. Your favorites, taste preferences, and settings are then stored only on your device and are removed when you delete the app.

When CupBearer loads product, price, and shop information, your device connects to our servers. This transmits technical data such as your IP address, device type, operating system, and app version. We use it only to deliver content and to keep the service stable and secure. Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

4. Your account (optional)

If you create an account, we process:

• Account details: your email address, your password in protected form, your date or year of birth, and the country and city you enter.
• Optional profile details: your name and gender, if you choose to add them.
• Your CupBearer activity: the products you scan, favorite, or rate, the taste preferences you set, and the shop offers you open through CupBearer.

We use this data to provide your account, keep your data available when you sign in, confirm that you meet the minimum age, show products, prices, and shops relevant to where you live, and personalize recommendations. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Optional profile details are processed with your consent (Art. 6(1)(a) GDPR). You can edit or remove them at any time.

5. Personalized recommendations

CupBearer builds a taste profile from the products you scan, favorite, and rate, the preferences you enter, and the shop offers you open. It compares this profile with product characteristics such as type, flavor notes, and strength to suggest drinks you may enjoy. You can review and adjust your taste preferences in the app.

Recommendations are suggestions only and have no legal or similarly significant effect on you. CupBearer uses your activity to understand your taste. It does not assess your health or how much you drink.

6. Scanning

CupBearer uses your camera only when you start a scan, and only if you have granted camera permission. Bottles, shelves, and menus are recognized on your device wherever possible.

Product and price data from scans

To keep product and price information up to date and to improve recognition, CupBearer may send de-identified scan data to us, such as images of products and price labels or the product and price details extracted from them, together with an approximate location (such as the city) and time. This data is not linked to your account or your device, and image metadata is removed before storage. Please do not scan people.

Legal basis: our legitimate interest in providing accurate, current product and price information and improving CupBearer (Art. 6(1)(f) GDPR). Because this data is not linked to you, we generally cannot tell which items came from you, so we cannot provide access to or delete them individually (Art. 11 GDPR). You can object at any time; see section 14.

7. Shop links and affiliate partners

CupBearer earns money through affiliate marketing. When you open a shop offer, you leave CupBearer and go to the shop’s website. If you buy something, the shop may pay us a commission. This does not change your price, and your purchase is a contract between you and the shop.

To attribute a purchase to CupBearer, shop links pass through an affiliate network. The network and the shop may store cookies or similar identifiers in your browser and process data such as the time of the click, the offer you opened, your IP address and browser details, and, if you buy, order details such as order value. We work with these affiliate networks:

• Awin (Awin AG, Berlin, Germany, and its group companies). Privacy policy (German version).
• ADCELL (Firstlead GmbH, Berlin, Germany). Privacy policy.
• Adtraction (Adtraction AB, Stockholm, Sweden), including the former Affiliate Future network. Privacy policy.

We open shop links through affiliate networks only with your consent, which CupBearer asks for before you open your first shop offer. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG; in the UK, the Privacy and Electronic Communications Regulations). You can withdraw your consent at any time in the app or by emailing us. Shop links will then open without affiliate tracking where possible. Withdrawal does not affect processing that took place before it.

For tracking through Awin, we and Awin are joint controllers (Art. 26 GDPR). We are responsible for informing you and for obtaining your consent in the app. Awin is responsible for operating the tracking and for the data it processes. You can exercise your rights with either of us. Whoever receives your request handles it, with the other’s support. ADCELL and Adtraction process tracking data as independent controllers under their own privacy policies.

Inside CupBearer, we record which offers you open so we can improve your recommendations (section 5). We do not pass your name, email address, or profile to shops or affiliate networks, and we do not use the networks’ sales reports to build profiles of you.

8. Improving CupBearer and training models

We use de-identified scan data (section 6) and pseudonymized or aggregated information about how CupBearer is used, such as which products are scanned, favorited, and opened, to fix problems, improve recommendations and recognition, and develop and train the machine-learning models behind these features. Wherever possible, we use aggregated or de-identified data rather than data linked to your account.

Legal basis: our legitimate interest in improving CupBearer (Art. 6(1)(f) GDPR). You can object at any time; see section 14.

9. Aggregated insights for partners

We may share anonymous, aggregated statistics with partners such as shops, brands, and affiliate networks, for example “this style of wine is popular in Munich”. These statistics never identify you and never contain data about individual users. We create them only from groups large enough that no individual can be singled out. Legal basis: our legitimate interest in working with partners (Art. 6(1)(f) GDPR).

We do not sell your personal data.

10. Emails about your account

If you have an account, we send emails needed to run it, such as sign-up verification codes, password resets, and important notices about your account or our terms. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

11. Service providers, recipients, and international transfers

We use carefully selected service providers that process data on our behalf, follow our instructions, and are bound by data processing agreements (Art. 28 GDPR). These include providers of hosting and databases, user authentication and email delivery, and IT security and operations. Apple and Google distribute the app and process data under their own privacy policies when you download it. Other recipients are the affiliate networks and shops described in section 7. We disclose data to authorities only where the law requires it (Art. 6(1)(c) GDPR).

Account data is currently stored in the European Union. If a provider processes personal data outside the EU/EEA or the UK, we make sure it is adequately protected, through an adequacy decision of the European Commission or the UK government (such as the EU-US Data Privacy Framework and its UK Extension) or through standard contractual clauses.

12. How long we keep data

• Account data and activity: for as long as your account exists. When you delete your account, we delete this data within 30 days. Backup copies are overwritten in the regular backup cycle.
• Inactive accounts: we may delete accounts after an extended period of inactivity. We will email you before doing so.
• Data on your device: until you delete it in the app or uninstall CupBearer.
• Technical connection data such as IP addresses in server logs: only briefly, as needed for security and operations.
• Consent records: for as long as we need them to demonstrate that consent was given.
• De-identified and aggregated data: may be kept without a fixed time limit, as it does not identify you.

We keep data longer only where the law requires it or where it is needed to establish, exercise, or defend legal claims.

13. Deleting your account

You can delete your account at any time in the app’s account settings, or by emailing us from the address linked to your account. This deletes your account and the associated data as described in section 12.

14. Your rights

Under the GDPR and the UK GDPR, you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• withdraw consent at any time, with effect for the future (Art. 7(3));
• lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA). You can also contact the authority where you live or work; in the UK, the Information Commissioner’s Office (ICO).

To exercise your rights, email hello@tortiebyte.com. We respond within one month and may ask you to confirm your identity first.

15. Security

We protect your data with appropriate technical and organizational measures, including encrypted connections (TLS), access controls, and collecting only the data CupBearer needs.

16. What CupBearer does not do

• No third-party ads or ad networks in the app.
• No sale of your personal data.
• No access to your precise (GPS) location.
• No sharing of your name, email address, or profile with shops or affiliate networks.

17. Changes to this policy

We update this policy when CupBearer or the law changes. The date at the top shows the current version. We will tell you about significant changes in the app and ask for your consent again where required.