Personal Information Collection Statement

What we collect

Your phone number. It is the only way to sign in — there is no password — and it is how we reach you on the day of delivery.

A delivery address, a time slot, and whatever recipient details you enter at checkout.

Your age declaration, and the time you made it.

Orders, payments and refunds. When a transfer is matched, staff record the payer’s name as it appears on the statement; if a refund is owed, the number it is sent to is recorded too.

For a dish photograph, only the flavour profile derived from it and a perceptual hash are kept — not the photograph. The one exception is a photograph you correct the match on, which is the moment it becomes a labelled example.

If you are signed in, your conversation with Sakie, the AI sommelier, is kept. If you are not, nothing of it is kept at all.

Technical data: a browser session identifier and an IP address, used for sign-in throttling and abuse limits.

If you turn on offers & new arrivals: that device’s push address and encryption keys, its kind (for example iPhone · Safari), a record that you agreed to receive them, and whether each one reached the device and whether you opened it.

Tasting notes you write: the rating, the words, and when you wrote or last changed them.

Why

To sell you a bottle, deliver it, refund you when that is owed, and to not sell alcohol to anyone under 18.

Conversations and matches are used to improve the recommendations themselves. Your data is not sold or rented to anybody.

Offers & new arrivals (direct marketing): only once you switch them on in 我的 does the shop send that device app notifications about new arrivals, allocations and offers. You can switch them off in 我的 at any time, and the shop then sends that device no more of them. Whether each one arrived and was opened is used only to see how they are doing.

Order messages — verification codes, payment confirmations, delivery dates and Tipsy Coin expiry reminders — always go by WhatsApp, or by SMS when WhatsApp cannot reach you. They never go as app notifications, and switching offers on or off does not change them.

Who sees it

Shop staff, for what an order, a reconciliation or a delivery requires.

The courier: recipient name, phone and address.

Our sake supplier: recipient name, phone and delivery address, used only to send the bottles you ordered straight to you.

SMS and WhatsApp (Meta): your number and the message — verification codes, order references, payment and delivery notices, Tipsy Coin expiry reminders.

Offers & new arrivals travel through your phone’s push service (Apple, Google or Mozilla). They are encrypted: the push service sees a device address, not the message.

Sakie and photo matching run on Anthropic’s API, on servers outside Hong Kong. What is sent is the text you typed and the profile derived from a photograph, not the photograph.

Images are hosted on Cloudflare R2; the application runs on Fly.io.

Everyone: tasting notes you write on the shop’s wines are shown publicly on that wine’s page, with a shortened name (for example 陳** or Leo W.) and the mark you chose in 我的 — never your phone number or full name. You can edit or delete yours at any time. Shop staff may hide a note that is not appropriate, and a hidden note is no longer shown.

Notes on bottles you photographed into your own cellar are not public: only you and shop staff see them. Nor are notes written before 14 September 2026, unless you save them again.

How long

Dish matches: 24 months, then deleted by a nightly job.

The number a refund is sent to: deleted once the refund clears, not held until you close your account.

Sessions and verification codes: deleted after they expire, by the same job.

Push addresses for offers & new arrivals: deleted when you switch them off, remove the app, or the push service says the device has gone.

Delivered and opened receipts for offers: kept 12 months, then deleted by the nightly job.

Tipsy Coin records: kept like order records; deleted with your account, and any unspent coins with them.

Tasting notes: kept until you delete them, which removes them from the wine’s page and from the shop’s records. Deleted with your account.

Orders, payments and the audit log: kept as long as tax and transaction records require. The audit log cannot be edited or deleted, deliberately.

Your rights

Under the Personal Data (Privacy) Ordinance you may ask for access to, and correction of, the personal data this shop holds about you.

Write to privacy@tipsycave.hk. We answer within 40 days of receiving a request.

You may also ask us to delete your account. Order and payment records are kept for the periods above; everything else goes with it.