← Wine Finder

Privacy Statement

Version 2026-07-29-3 · Last updated 29 July 2026

1. Who controls the data

The Shopify merchant normally controls personal data collected from shoppers through its store and must provide its own customer privacy notice. My Next Wine acts as the merchant's processor where it handles shopper preference inputs, recommendation requests, selected product/session references and permitted widget analytics solely to provide the Wine Finder on the merchant's instructions.

My Next Wine acts as an independent controller for merchant account administration, app installation and billing records, contract acceptance, service security, fraud and abuse prevention, legal compliance, support correspondence and its own business records. The Merchant Terms include the processor obligations that apply between the merchant and My Next Wine.

2. Information processed

Merchant and installation information

• The merchant's permanent myshopify.com domain, store identifiers, country/currency context, installation and onboarding status.
• Encrypted Shopify access credentials, granted scopes and relevant token or installation dates.
• The merchant account, organisation and catalogue link created or reused for the store.
• Shopify billing subscription identifiers, status, price, currency, trial and renewal information.
• The Merchant Terms version accepted, acceptance time and related audit information.
• Support messages and administrator contact details supplied through Shopify or directly by the merchant.

Catalogue information

• Product and variant identifiers, titles, descriptions, images, categories, attributes, prices, currency, publication state, inventory and availability needed to map and recommend the merchant's wines.
• Normalised wine mappings and catalogue-readiness decisions, including products that are ignored because they are unsuitable or cannot be matched.

Shopper and recommendation information

• The bottle mix, budget, wine-style preferences and food-pairing text submitted for a recommendation.
• The candidate and selected wines, substitutions, recommendation result, selected quantities and a short-lived recommendation/session reference.
• A private, short-lived recommendation reference and selected product/quantity information may be written into the Shopify cart so the current shopping journey can function.

The public Wine Finder app does not request Shopify's read_orders scope and is not designed to read completed Shopify orders, customer records, checkout details, addresses, account passwords or payment-card details. The merchant must not deliberately place sensitive personal data or customer-identifying information in free-text preference or food-pairing fields. This is separate from My Next Wine's existing Irish B2C Shopify integrations, which operate under separate merchant arrangements and B2C privacy disclosures.

Analytics, device and security information

• Shop-level events such as widget impressions, opens, recommendation requests and results, swaps and basket clicks. Storefront analytics events are sent only when Shopify's Customer Privacy API reports that analytics processing is allowed.
• Requested budgets and recommended values used for aggregate merchant reporting.
• Request timestamps, webhook delivery information, request identifiers, browser or device metadata, network/security metadata and application logs reasonably required to operate, diagnose and protect the Service.

Merchant reporting is designed to be aggregated rather than to create shopper profiles. Technical logs may nevertheless contain personal data such as an IP address or user-agent where generated by normal web infrastructure or required for security and troubleshooting.

3. How and why the information is used

• Authenticate the merchant and securely connect the correct Shopify store.
• Import, map and maintain the merchant's available wine catalogue.
• Generate, explain, validate and return requested recommendations and substitutions.
• Maintain the current Wine Finder basket journey without reading completed Shopify orders or taking payment for or selling the wine.
• Provide aggregate app performance information to the merchant.
• Create and administer the Shopify subscription and trial.
• Provide support, investigate errors, prevent abuse, enforce the Merchant Terms and protect the Service.
• Comply with Shopify privacy webhooks, tax/accounting duties and other legal obligations.

4. AI-assisted recommendations

Recommendation generation may use an artificial-intelligence service provider. The information sent may include the shopper's current preference and food-pairing answers and a shortlist of relevant catalogue wines, but should not include the shopper's direct identity or payment details. AI output is subjected to application rules and backend validation before it is returned. My Next Wine does not use the Wine Finder to make decisions producing legal or similarly significant effects about a shopper.

5. Legal bases

Where the GDPR applies, My Next Wine relies on:

• Contract: to provide and administer the Service requested by the merchant.
• Legitimate interests: to secure, troubleshoot and improve the Service, prevent fraud and maintain proportionate business records, balanced against affected individuals' rights.
• Legal obligation: for tax, accounting, regulatory, privacy-request and lawful-disclosure duties.
• Merchant instructions: where My Next Wine acts as processor for the merchant.

6. Recipients and subprocessors

Information is exchanged with Shopify for installation, authentication, catalogue access, required privacy/uninstall webhooks and billing. It may also be processed by contracted hosting, database, content-delivery, monitoring, logging, communications, support and AI service providers. Access is limited to what is needed for their function and appropriate contractual safeguards are used. My Next Wine does not sell merchant or shopper personal data, does not acquire the merchant's customer relationship or customer list, and does not use Wine Finder preference inputs for direct-to-consumer wine marketing.

The current subprocessor information is published at mynextwine.ie/subprocessors. Where information is transferred outside the EEA or UK, My Next Wine uses an applicable adequacy decision, standard contractual clauses or another lawful transfer mechanism as required.

7. Retention and deletion

• Live access credentials are disabled or cleared following uninstall or revocation.
• Recommendation inputs and technical logs are kept only for the operational, support, security and dispute period reasonably required for the Service and are not intended to form a persistent consumer wine profile.
• Aggregated merchant analytics may be retained for service reporting and performance history.
• Contract acceptance, billing, tax and accounting records may be kept for the applicable statutory and legal-claims periods.
• Shop-specific data is deleted or anonymised following uninstall and Shopify's required redaction process, except for information that must lawfully be retained.

Shopify merchants can request deletion or export through the contact above. Shopify's mandatory customer-data request, customer-redaction and shop-redaction webhooks are also handled where applicable.

8. Security

My Next Wine uses measures including encryption of Shopify credentials at rest, access controls, signed session/app-proxy/webhook verification, input validation, rate limiting, logging and restricted production access. No system is completely secure; merchants must also protect their Shopify administrator accounts and promptly report suspected compromise.

9. Cookies and local storage

The embedded administration app and storefront widget may use strictly necessary browser storage or cookies to maintain app state, security and the current recommendation flow. The merchant is responsible for configuring its Shopify storefront consent tools and disclosures where local law requires consent for non-essential technologies. The Wine Finder should not be represented as an independent advertising tracker.

10. Rights and complaints

Depending on applicable law, an individual may request access, correction, deletion, restriction or portability, or object to certain processing. For data controlled by the merchant, the individual should normally contact that merchant first; My Next Wine will assist the merchant where it acts as processor. Requests about My Next Wine's controller records can be sent to the privacy contact above.

Individuals may complain to the Irish Data Protection Commission or another competent supervisory authority. They may also have a right to lodge a complaint in the country where they live or work or where the alleged infringement occurred.

11. Changes

This statement may be updated to reflect changes to the Service, subprocessors, law or Shopify requirements. Material changes will be notified through the app or another reasonable channel and the current version will remain published here.