BonTox

Legal

Privacy policy

Last updated: 20 April 2026

1. Introduction

This privacy policy describes how the BonTox application collects, uses and protects its users’ personal data.

By using the application, you accept the practices described below.

2. Data controller

The data controller is:

BonTox
Email: contact@bontox.app

3. Data collected

We collect only the data strictly necessary for the purposes described below.

3.1 Data provided directly

  • email address
  • user identifier
  • display name / username
  • profile picture
  • imported content (bottle photos)

3.2 Generated or derived data

  • data extracted from images (wine, producer, region, etc.)
  • preferences and interactions
  • usage history

3.3 Technical data

  • IP address
  • device type
  • technical logs
  • Firebase identifiers

3.4 Professional data (where applicable)

  • name of the establishment
  • address
  • Instagram account
  • associated public content

4. Legal bases for processing

Processing relies on the following legal bases:

  • Performance of the contract: operation of the account and personal cellar
  • Legitimate interest: service improvement and feeding the public database
  • Consent: cookies and certain analytics features
  • Legal obligation: security and fraud prevention

5. Purposes of processing

Data is used to:

  • provide the Service (account management, personal library)
  • process images and extract information via AI
  • improve the user experience
  • ensure security and prevent abuse
  • display professional profiles
  • feed a public database of data that is not directly identifying

6. Artificial intelligence and automated processing

The Service uses artificial intelligence technologies, notably provided by Google.

This processing may include:

  • image recognition
  • text extraction
  • content generation

This processing may be partially automated and produce approximate results.

It does not entail any legal decision or significant effect on the person within the meaning of Article 22 of the GDPR.

7. Third-party services

We use:

  • Google Firebase (authentication, database, hosting, analytics)
  • Google Gemini (AI processing)

These providers may process certain data as subcontractors.

8. Public database and data reuse

BonTox maintains a public database accessible without an account.

This database is fed from data derived from user content, provided that:

  • only data that is not directly identifying is used
  • this data is disassociated from the user account before reuse
  • it does not enable identification without external cross-referencing

8.1 Images

Images associated with public pages are generated or transformed from content submitted by users.

They do not constitute a faithful reproduction of the original content, but an interpreted representation intended to illustrate the wine information.

These images may be modified, recomposed or stylised to avoid any identical reproduction of protected elements (notably labels, logos or graphic elements).

Identifying metadata (EXIF, geolocation) is removed before any use.

The user may request the removal of an image concerning them.

8.2 Legitimate interest

This public database is based on BonTox’s legitimate interest in:

  • building a knowledge base on wine
  • improving the Service

The user may object to this processing (see §12).

9. Professional accounts

Data from professional accounts is made public.

These users act in a professional capacity and are responsible for the data they publish.

10. Transfers outside the EU

Data may be transferred outside the European Union, notably to the United States.

These transfers are governed by:

  • standard contractual clauses
  • or any other recognised compliant mechanism

11. Retention periods

11.1 Personal data

  • Account: until deletion
  • Logs: proportionate duration (security)
  • Content: as long as the account is active

11.2 Data from the public database

Data integrated into the public database is retained provided it is:

  • aggregated
  • not directly identifying
  • and does not allow identification of a natural person

12. Your rights

In accordance with the GDPR, you have the following rights:

  • access
  • rectification
  • erasure
  • restriction
  • portability
  • objection

You may object to:

  • the use of your data in the public database
  • processing based on legitimate interest

Contact: contact@bontox.app

13. Right to lodge a complaint

You may lodge a complaint with the

CNIL

14. Security

We implement appropriate technical and organisational measures to protect data.

15. Cookies and trackers

The Service uses tracking technologies via Firebase.

Where required, prior consent is obtained.

16. Data deletion

Deleting the account results in:

  • deletion of personal data
  • disassociation of contributions

Data already integrated into the public database may be retained if it no longer allows identification of a person.

17. Changes

This policy may be amended at any time.

In case of a substantial change, users will be notified.