Privacy policy

The short version: We collect only what we need to run Dramfly. We don't sell your data and we don't track you across other apps. We may share anonymous, combined insights with partners in the whisky community, never anything that identifies you. You can delete your account, and everything that identifies you, at any time.

1. Who we are

Dramfly is operated by Caskbase LTD, a company registered in Scotland, United Kingdom. We are the data controller for the personal data described in this policy.

For privacy questions or to exercise your rights, email info@dramfly.com.

2. What this policy covers

This policy applies to the Dramfly website at www.dramfly.com and the Dramfly app for iOS and Android. It explains what personal data we collect, why, how we use and protect it, and what rights you have over it.

3. Data we collect

3.1 Website (dramfly.com)

Email address and first name, when you subscribe to our newsletter, so we can send you updates

• Name, email and organisation, when you submit an event, club or venue through our partner forms, so we can list it and reply to you
• IP address and browser information, collected automatically for security, performance and analytics

3.2 Mobile app (iOS and Android)

• Name, email address and profile photo, when you sign in with Google, Apple or Facebook, to create and identify your account

• Tasting data: the whisky, your reaction (not for me, it's fine, loved it) and the flavour tags you choose for nose, palate and finish. This is the core of your tasting journal
• Bottle photos, when you take or select one during a tasting, so you can remember and identify the whisky
• Event participation, when you join a festival or tasting event, so your tastings are linked to it
• Precise device location, only when you grant permission and look for events, pubs and venues nearby. We read your location at that moment and do not track it continuously or in the background
• Push notification token, if you allow notifications, so we can send them to your device
• Device and usage information (OS version, device model, app version, screens viewed, crashes), to fix problems and understand how the app is used

3.3 Data we do not collect

We do not collect payment information, health data or biometric data. We do not track your location in the background. We do not build advertising profiles. We do not access your contacts, microphone or any device features beyond the camera (for bottle photos), location (for nearby events and venues) and notifications (if you allow them).

4. Lawful basis for processing

Under the UK GDPR and the Data Protection Act 2018, we rely on these lawful bases:

• Contract: providing the app. Creating your account, storing your tastings and photos, building your flavour profile, linking tastings to events, showing nearby events and venues, sending notifications you have switched on, and creating share cards when you choose to share.
• Consent: newsletters and marketing emails, location access and push notifications (both controlled by your device settings). You can withdraw consent at any time by unsubscribing, changing your device settings or emailing privacy@dramfly.com.
• Legitimate interests: keeping Dramfly secure, fixing bugs, understanding how the app and website are used, replying to partner form submissions, and creating anonymous tasting insights for whisky community partners (section 6.2). We have weighed these interests against your rights, and you can object at any time. We never use this basis for marketing to you.

5. How we use your data

We use your personal data to:

• Create and manage your account
• Store your tastings, flavour tags and photos so you can see them any time, on any device
• Build your personal flavour profile (the radar chart)
• Create share cards when you choose to share a tasting or your flavour profile
• Show you events, pubs and venues near you
• Send push notifications you have allowed, such as reminders and milestones
• Send newsletters and product updates, where you have agreed to receive them
• Create anonymous, combined insights for partners in the whisky community (section 6.2)
• Diagnose bugs, monitor performance and improve Dramfly
• Protect against fraud, abuse and security threats

We do not make automated decisions about you that have legal or similarly significant effects.

6. Who we share data with

We do not sell your personal data and we do not share it with advertisers.

6.1 Data we do not collect

These providers help us run Dramfly. They process data only on our instructions and under contracts that protect it.

• Microsoft Azure — cloud hosting, database, and blob storage. All app data is stored encrypted. Servers located in the UK / EU.
• Google (OAuth, Firebase Analytics) — sign-in authentication for the mobile app. Authentication tokens are shared. App usage analytics.
• Apple (OAuth) — sign-in authentication for the mobile app. Authentication tokens are shared. Located in the US.
• Meta / Facebook (OAuth) — sign-in authentication for the mobile app. Authentication tokens are shared. Located in the US.
• Google Analytics — cookieless website analytics. Anonymised usage data (page views, referral sources, general device information) is collected. No cookies are placed. Located in the US.
• Kit (ConvertKit LLC) — email marketing platform used to send product updates, feature announcements, and newsletters to subscribers. Email address and first name are shared. Located in the US. Data is transferred under Standard Contractual Clauses.

Each provider processes data only on our instructions and under appropriate contractual safeguards. Where data is transferred outside the UK, we rely on adequacy decisions, Standard Contractual Clauses (SCCs), or the provider's certification under an approved data protection framework.

6.2 Anonymous tasting insights

We work with partners in the whisky community, such as festivals, event organisers and distilleries. We may create anonymous, combined insights from tasting activity on Dramfly and share them with these partners. For example, how many drams were logged at an event.

These insights:

• never include your name, email, photo, profile or any single tasting
• only describe groups large enough that nobody can be singled out
• are never sold as lists of people or used to contact you

You can object to your tastings being included at any time by emailing info@dramfly.com. We will then leave them out of future insights.

6.3 Anonymous tasting insights

We may disclose data if the law requires it, or to protect the rights and safety of our users and others. If Caskbase LTD or Dramfly is ever sold or merged, your data would pass to the new owner under the same protections, and we would tell you first.

7. International data transfers

Some providers are based in the United States. When personal data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU US Data Privacy Framework), the UK International Data Transfer Agreement or Addendum, or Standard Contractual Clauses.

8. How long we keep your data

• Account and tasting data — kept as long as your account is active. Deleted within 30 days of account deletion.
• Photos — kept as long as your account is active. Deleted within 30 days of account deletion.
• Waitlist email address — kept until you unsubscribe or we complete the launch notification campaign, whichever comes first.
• Server logs (IP address, device info) — kept for up to 90 days for security and debugging purposes.
• Anonymised analytics — Indefinitely, as they cannot be linked to you.

9. Your rights

Under the UK GDPR you have the right to:

• Access a copy of the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (see section 10)
• Restrict how we process your data
• Port your data in a structured, machine readable format
• Object to processing based on legitimate interests, including anonymous partner insights
• Withdraw consent at any time, for anything based on consent

To exercise any of these, email info@dramfly.com. We will respond within one month.

You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put things right first.

10. Account deletion

You can delete your account at any time from Settings in the app. When you do, we permanently delete your profile (name, email, photo), all your tastings and flavour data, all your photos and your push token, and revoke your sign in tokens. Nothing that identifies you is kept.

Deletion completes within 30 days, and backups clear within 35 days. Anonymous totals that were already calculated, such as the number of drams logged at a past event, stay as they are because they contain nothing about you.

If you can't access the app, email info@dramfly.com and we will delete your account for you. This also applies if you signed in with Facebook.

11. Data security

All data in transit is encrypted with HTTPS and TLS, and stored data is encrypted

• Photos are stored in private containers, reachable only through short lived signed links
• Sign in tokens have limited lifetimes and are stored in secure device storage (Keychain on iOS, Keystore on Android)
• Our servers are protected by rate limiting, input validation and security headers
• Secrets are never stored in application code

12. Children's privacy

Dramfly is for adults of legal drinking age. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it promptly. If you believe a child has given us personal data, email info@dramfly.com.

13. Cookies and similar technologies

Website. We use Google Analytics 4 configured so that it does not set analytics cookies. It collects general data about how the site is used, such as pages visited and referral sources, without advertising profiles. We may use essential cookies needed for the site to work, such as for forms. If we ever add non essential cookies, we will ask for your consent first.

App. We use Firebase Analytics to understand how the app is used. It collects an app instance ID, install and update events, session length and screens viewed. Advertising ID collection and ad personalisation are switched off. You can object to app analytics at any time by emailing privacy@dramfly.com.

14. Third-party links

The app and website link to other sites, such as distillery and festival websites and social media. Their privacy practices are their own, so please read their policies.

15. Changes to this policy

We may update this policy. When we make important changes, we will update them in the app. The date at the top shows the latest version.

16. Contact us

Caskbase LTD Email: info@dramfly.com Website: www.dramfly.com