Privacy.

Valmont is operated by Collecta Technologies Limited, a company registered in England and Wales (company number 17022135), with its registered office at 105 Piccadilly, London, W1J 7NJ. In this policy, "we", "us", and "Valmont" refer to that entity.

For any question about your data, write to hello@valmont.app.

What you give us directly

• Account details such as email address, name, handle, and date of birth for age checks.
• Taste preferences, saved wines, pours, restaurant activity, reservations, social choices, and anything you ask The Nod.
• Bottle or wine-list images and profile images you choose to upload.
• For nominations, a short private label chosen by the nominator and the resulting status. The label is not a verified identity.
• For invite codes and Rewards, the code you apply (if any), when you applied it, and the progress of the member who invited you. See Invite codes and Rewards.
• Anything you choose to send us when you contact us.

What the app, browser, and service provide

• App version, device and operating-system information, locale, approximate network location, page or screen interactions, and performance diagnostics. Website campaign analytics run only after cookie consent.
• Standard request logs (IP address, user-agent, timestamp) kept short-term by our hosting provider for security and abuse prevention. We also derive a one-way hash of your IP address to rate-limit form submissions; it is stored only briefly by our database processor (Supabase).
• Subscription and Valmont Pro entitlement status from Apple and RevenueCat. We do not receive your full card details.
• Precise location only when you grant the app permission, to find nearby restaurants. You can revoke that permission in device settings.

What we do not collect

• We do not collect advertising identifiers for optional iPhone advertising measurement unless you opt in and allow Apple's tracking permission. See App advertising measurement.
• Nominations do not read or upload your Contacts or address book, and do not ask for a nominee's phone number or email.
• Opaque nomination tokens, full nomination URLs, private labels, and QR codes are excluded from product analytics, diagnostics, and session replay.

• Account and product. To create your account, verify age, provide recommendations, save your choices, and deliver the features you request.
• Nominations. To create one-person links, show the nominator an owner-only status label, enforce five successful grants and one redemption per recipient account, and place three months of Pro through RevenueCat.
• Security and support. To rate-limit abuse, reconcile uncertain grants, investigate failures, and answer requests without exposing bearer credentials.
• Measurement. To understand reliability and product use. Website campaign analytics require cookie consent; app analytics are minimised and exclude nomination secrets.

Every member has an invite code and an invite link. If you share it, the page a friend sees shows your first name only, never your surname, username, email address or photo. When someone joins using a code, we record which code was used, when, and whether the 30 days of free access were granted, together with the progress of the person who invited them (how many friends have counted, which Rewards they have reached, and the state of each reward). We do not tell you who joined with your code and we do not tell a friend more than your first name. Notifications about Rewards never name the friend. Codes, links and names are not sent to our analytics tools.

On Android, if you install Valmont from a friend's invite link, Google Play passes the code in the link to the app once, so we can apply it for you. We do not use it for advertising.

Keeping the programme fair

To let each person use a code only once, we keep one-way digests of a new member's sign-in account identifier, verified email address and verified phone number. A digest is a keyed (HMAC) hash. It cannot be turned back into your email address or phone number. We keep these digests after you delete your account, because otherwise deleting and re-creating an account would let the same person claim a code again. They are kept for as long as the Rewards programme runs and for 24 months after it ends, and used for no other purpose. We also keep a log of each step of the programme (for example, that a code was applied or a reward was granted), which does not contain names, email addresses, phone numbers or codes entered in failed attempts. Our lawful basis is our legitimate interest in preventing misuse of the programme.

When you delete your account

Your invite code is retired and will not be issued to anyone else, so an old link can never credit a stranger. Your account details are deleted or anonymised as described in How long we keep it, apart from the digests in this section.

The full programme rules are in our Rewards terms.

When website measurement is enabled and you accept optional cookies, AppsFlyer Smart Script prepares a measured App Store link. We use permitted campaign, ad-set and ad IDs, a Meta or TikTok click ID (fbclid or ttclid), and a limited placement value. A campaign record in your browser's session storage expires after two hours and helps keep the same campaign attached when you move between public pages. We remove it when you withdraw or enter a private route; closing the tab also clears session storage.

Using the measured download link sends these identifiers to AppsFlyer so that a campaign may be connected to an installation and later consented app activity. Loading the script and following the link also exposes ordinary network and browser information, such as IP address and user agent, to the service handling the request. We do not give Smart Script the full landing URL, full referrer, private nomination tokens or form contents. If you decline, or measurement is unavailable, the download button still works through an ordinary App Store link.

Website cookie consent does not grant app advertising consent or Apple tracking permission. Use Cookie Preferences in the website footer to withdraw website consent; this clears the campaign record and resets measured download links. App choices remain separate.

On iPhone, optional advertising measurement helps us understand which campaigns lead to installs and subscriptions. It is separate from the product analytics and diagnostics used to operate Valmont. Identifiable measurement starts only after you are signed in, have passed our adult age check, and allow Apple's App Tracking Transparency permission when the app asks. Declining does not prevent you from using Valmont.

What is shared

With these permissions, AppsFlyerreceives advertising and device identifiers (including Apple's advertising identifier and an AppsFlyer identifier), device and network information, install and app-open events, and events indicating onboarding completion or a successful scan. Scan images, wine labels, chat messages, reservation details, and nomination secrets are not included in these advertising events.

RevenueCat links permitted advertising identifiers to your subscription record and sends subscription events to AppsFlyer, including trial starts, paid subscriptions, first payments after a trial, and renewals. These events may include subscription product, price, currency, and revenue. RevenueCat still processes purchases and membership status when advertising measurement is off.

AppsFlyer shares install/app-open, trial-start, paid-subscription, paid trial-conversion, and renewal events with Metafor users attributed to Meta advertising. This reporting may include advertising/device identifiers and the subscription information above. Meta reporting is limited to Meta-attributed users; advanced matching and advanced data sharing are off for this mobile integration.

If you decline on iPhone

If you decline, or later turn advertising measurement off, the app still runs AppsFlyer in a limited mode, only so that Apple's SKAdNetwork can report installs and coarse milestones (an account created, a trial started, a purchase) to advertising networks. In this mode no advertising identifier is used, the activity is not linked to your Valmont account or subscription record, and AppsFlyer does not forward it to Meta or any other partner. Apple controls SKAdNetwork reports: they arrive delayed and aggregated, carry no advertising identifier, and may omit information to protect privacy. Android has no such mode.

Your control

You can change your choice in Valmont under Settings → Privacy → Advertising measurement, or withdraw Apple's tracking permission in your device settings. Withdrawal stops further identifiable app advertising measurement and requests removal of the identifiers used for RevenueCat partner sharing; delivery of that update requires a network connection. It does not undo processing that happened before withdrawal. To request access to or deletion of previously shared information, contact hello@valmont.app.

Some Valmont features are answered by a third-party AI model rather than by us. Before anything of yours is sent, the app shows you what will be sent and who receives it, and asks you to agree. Nothing reaches the AI processor until you do.

What is sent

• The messages you write to The Nod, and the conversation so far in that chat.
• Your taste profile, meaning the grape, region and style preferences derived from your ratings and pours, so the answer matches your palate.
• Your approximate location, meaning the city we resolve and how far you are from the nearest venue whose wine list we hold, and only while you allow the app location access.
• Photographs of the wine lists and bottles you choose to scan.

Your name, email address, account identifier, and date of birth are not included. Scanned photographs are sent so the wine names and prices printed on them can be read; they are not used to identify people.

Who receives it

OpenAI(openai.com) is the AI processor. Requests are made from Valmont's own servers (Supabase edge functions) rather than from your device, and are covered by OpenAI's API data-processing terms. Anthropic (anthropic.com) is configured in the same service as an alternative model provider for The Nod; if we switch to it, the chat content described above would be processed by Anthropic instead, under its commercial API terms.

What it is used for

Producing wine recommendations, answers, and tasting notes for you, and reading the wine lists you scan. Under OpenAI's API terms, data submitted through the API is not used to train or improve OpenAI's models; OpenAI retains it for up to 30 days for abuse monitoring and then deletes it, unless the law requires otherwise. Anthropic's commercial terms likewise state that inputs and outputs submitted through its API are not used to train its models. Neither processor uses your data for advertising, and neither may use it for any purpose other than providing the service to us and the safety monitoring described above.

Your control

The in-app disclosure appears the first time you reach an AI feature, whether that is the first message you send to The Nod or the first list or bottle you scan, and the request is held until you answer. You can withdraw at any time in the app under Settings → The Nod and your data, which stops any further sending and makes the app ask again the next time. Declining or withdrawing leaves the rest of Valmont working.

• Providing your account, subscription, recommendations, and accepted nomination, performance of our contract with you (Art. 6(1)(b)).
• Keeping the service secure, preventing duplicate grants and repeat use of invite codes, supporting users, and improving reliability, our legitimate interests (Art. 6(1)(f)), balanced against your rights.
• Optional device permissions, sending your data to the AI processor, app advertising measurement, and website campaign analytics, your consent (Art. 6(1)(a)), withdrawable at any time.

We share data with the following service providers and advertising partners for the purposes described below, under the applicable data-processing or data-sharing terms:

• Clerk (clerk.com), account authentication and identity.
• Supabase (supabase.com), database hosting where account, taste, social, and nomination records are stored (EU region), and serverless functions run.
• RevenueCat (revenuecat.com) and Apple, subscription processing, receipt validation, and promotional Pro entitlement status. RevenueCat also supports the consent-based app advertising measurement described above.
• AppsFlyer(appsflyer.com), optional website-to-app campaign measurement with website consent, iPhone campaign attribution and subscription measurement with app consent and Apple's tracking permission, and a limited SKAdNetwork-only mode on iPhone when you decline.
• PostHog (posthog.com), minimised product analytics and masked session replay; Sentry (sentry.io), crash and performance diagnostics.
• Klaviyo (klaviyo.com), transactional and lifecycle messages.
• Expo (expo.dev), app builds, updates, and push notification delivery.
• Google, location search and website analytics; website analytics run only with consent. On Android, Google Play also passes an invite code to the app once if you install from a friend's invite link.
• OpenAI (openai.com), the AI processor behind The Nod and the scan features, with Anthropic (anthropic.com) configured as an alternative model provider for The Nod. See AI processing for exactly what is sent, on what basis, and how to withdraw.
• Vercel Inc. (vercel.com), hosting, CDN, and analytics.
• Meta Platforms, Inc. (Meta Pixel and Conversions API), campaign attribution, only with your consent. For confirmed website enquiries, we send a hashed email address, IP address, browser user agent, form page URL, event ID and available Meta browser/click identifiers. The email hash is used for matching and is not anonymous. Meta also receives the limited mobile events described under App advertising measurement, through AppsFlyer for Meta-attributed users.

We do not sell personal data. We do not share it with data brokers or any advertising network beyond the campaign attribution listed above.

Our processors may process your data in the United States. Transfers from the UK and the EEA are protected by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, as applicable, together with any supplementary measures required by the UK ICO's guidance.

• Account and product data, while your account is active, then deleted or anonymised within 30 days of a valid deletion request except for the narrow records below, including the Rewards digests described in this section.
• Rewards digests, the keyed one-way digests of a new member's sign-in identifier, verified email address and verified phone number, kept after you delete your account for the life of the Rewards programme plus 24 months, solely to enforce the one-use-per-person rule and prevent abuse. They cannot be turned back into your email address or phone number. The Rewards programme log holds no names, email addresses, phone numbers or codes from failed attempts. Your invite code is retired when you delete your account.
• Nomination labels and live links, while the nominator's account and status history exist. Links close after 30 days; deleting the nominator account invalidates every owned unused link and removes the private label.
• Confirmed nomination grants, a minimal pseudonymous programme/account digest and grant/terms timestamps for the life of the programme plus 24 months, solely to enforce the one-account allowance, handle disputes, and prevent abuse. It contains no nominator, private label, bearer, contact detail, or raw Clerk ID.
• Uncertain provider grants, the RevenueCat app user ID only while reconciliation is necessary. It is removed on a terminal outcome and no later than 90 days after the intended grant expiry; unresolved cases then require manual support using the pseudonymous audit record.
• AI requests, held by the AI processor for up to 30 days for abuse monitoring and then deleted. The timestamp recording that you agreed is kept on your profile while your account is active, and is removed when you withdraw or delete the account.
• Website campaign context, a consented session-storage record with a two-hour expiry, removed on withdrawal or entry to private routes and cleared when the tab closes. Data already sent to AppsFlyer or advertising partners follows the applicable account retention and provider terms; browser withdrawal does not delete those records automatically.
• Server logs, 30 days.
• Website analytics, up to 26 months. App analytics and diagnostic retention follows the configured PostHog and Sentry project periods and is reviewed regularly.

Under UK and EU GDPR, you can, at any time:

• Access a copy of the personal data we hold about you.
• Rectify anything that is inaccurate.
• Erase your data (subject to the narrow exceptions the law permits).
• Restrict processing in certain circumstances.
• Portability, receive your data in a commonly used, machine-readable format.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, for anything given by consent (including switching analytics off via the cookie banner).

To exercise any of these, write to hello@valmont.app. We will respond within 30 days.

If you believe we have mishandled your data, you can complain to the UK Information Commissioner's Office or your local supervisory authority in the EEA.

Before you accept, the only data stored in your browser is a preference flag that remembers your choice. Analytics (Vercel, Google Analytics 4, Meta Pixel) load only after you click "Accept" on the cookie banner. You can revisit the decision by clearing the valmont-consententry from your browser's local storage.

No third-party cookies are set without your consent.

Valmont is not directed at anyone under 18 and we do not knowingly collect data from children. If you are under 18, do not submit information to the service.

All traffic is encrypted in transit with TLS. We limit processor selection to vendors with SOC 2 Type II or equivalent assurance. No security is absolute, in the event of a confirmed personal data breach, we will notify affected users and the UK ICO within 72 hours, as the law requires.

We update this policy when the service or the law changes. The "Last updated" date at the top reflects the current version. Material changes will be notified by email to waitlist members.

hello@valmont.app