Privacy

Who we are

Sobremesa Wine Pte. Ltd., UEN 202633623Z, a company registered in Singapore. We import Spanish wine and run a members’ club. We are the organisation responsible for the personal data described here, and we handle it under Singapore’s Personal Data Protection Act 2012.

What we collect, and why

We collect the least we can get away with. There is no advertising network here, no analytics tracker, and nothing is sold or shared for marketing.

We never see your card details. Payment is handled by Stripe on their own pages; card numbers do not reach our servers. We keep only their reference for the payment, so we can match it to your order.

Cookies

One kind only: the cookie that keeps you signed in. It is necessary for the site to work and it is not used to follow you anywhere. We do not use analytics, advertising or third-party tracking cookies, which is why you have not been asked to dismiss a banner.

If you install the app to your home screen, your membership card and cellar are also stored on your own device so they open without a signal. Signing out erases that copy.

Who else touches it

Only the companies that make the club work, and only with what they need:

• Supabase — stores the database and manages sign-in. Hosted in Singapore.
• Vercel — runs the website itself.
• Stripe — takes payment. They receive your email and the amount; we receive no card details.
• Resend — sends our email.
• Singapore Wine Vault — stores and dispatches your bottles. They receive your name and delivery address when a bottle leaves the vault.

Some of these operate servers outside Singapore. Where data is transferred abroad we rely on their contractual undertakings to protect it to a standard comparable to the PDPA.

How long we keep it

Records of what you bought, and of each age confirmation, are kept for [retention period — to be decided, commonly five years] because tax and licensing rules require it. Everything else is kept while you have a seat at the table, and removed within a reasonable period after you leave.

Two exceptions, both deliberate. The Founding Ledger records the fifteen founders’ chosen names and seat numbers permanently; it is written once and never edited, and that permanence is the point. Our administrative audit trail keeps a record of actions taken by administrators.

What you can ask for

Under the PDPA you may ask us to:

• tell you what personal data we hold about you, and how we have used it;
• correct anything that is wrong;
• stop sending you the letter, at any time;
• close your account and delete what we are not required to keep.

Write to the address below and we will answer within 30 days. If we cannot do what you have asked — usually because a record must be kept for licensing or tax — we will say so plainly and explain why.

If something goes wrong

If personal data is exposed in a way likely to cause you significant harm, we will tell you and notify the Personal Data Protection Commission as the law requires.