Privacy policy

Data controller

Absociety is published in a personal, non-commercial capacity by a private individual, who is the controller of the data described here. For any question or request: contact@theabsociety.com.

Data collected

When you create an account:

• email address, pseudonym, first name and last name, plus the country you collect from if you choose to give it;
• password — stored hashed only, never in clear text, and absent altogether if you signed up with Google;
• optionally: date of birth, the year you started collecting, and links to Facebook, Messenger, X, Instagram or eBay profiles.

While you use the site:

• the contents of your collection (bottles owned, quantities) and your wanted lists;
• the additions you record (type, date, number of bottles, price and fees if given, provenance);
• the banner image you choose for your collector page, if any. It is public on that page. Only one resized copy is kept — the original file is never stored, and with it go the EXIF metadata, GPS coordinates included;
• the photos of your collection you upload, and their captions. They are public on your collector page. Only two resized copies are kept — the original file is never stored, and with it go the EXIF metadata, GPS coordinates included;
• the photos you confirm when searching an edition by photo — see Photo search below. Only one reduced copy is kept, without its EXIF metadata, GPS coordinates included, and it is never shown to other members;
• the label readings you ask for when photo search finds nothing: the text read on the bottle, the editions proposed and the one you chose — see Photo search below;
• the technical dates tied to the account (creation, email verification).

Nothing else is attached to your account: no profiling, and no record of what you read. Visits are counted, but separately and anonymously — see Audience measurement below.

Signing in with Google

Signing in with Google is optional: the site works exactly the same with an email address and a password. Nothing is sent to Google until you press the button yourself.

When you do press it:

• your browser goes to Google, which therefore learns your IP address and that you are signing in here;
• Google sends back, and only then, a stable identifier for your Google account, your email address and whether Google has verified it, and your first and last name. Nothing else is asked for — no contacts, no calendar, no Drive;
• no access token is kept. It is exchanged, read once, and dropped.

The legal basis is your consent (article 6, 1, a of the GDPR), given by pressing the button. Google LLC is in the United States, so this exchange is a transfer outside the European Union; it rests on the European Commission's adequacy decision for the EU-US Data Privacy Framework, to which Google is certified. What Google does on its own side is governed by its own privacy policy.

You can unlink your Google account at any time from your profile, provided you have set a password first — otherwise nothing would let you back in.

Photo search

Anyone can search an edition by photographing a bottle. The photo is read, compared with the catalogue, and forgotten with the request: it is not stored.

If you are signed in, you can then confirm which edition it was (“This is the one”). Only then is a reduced copy of your photo kept — the original file is never stored, and with it go the EXIF metadata, GPS coordinates included. That copy is used for one thing only: helping the search recognise that edition the next time anyone looks for it. Everyone benefits from it, and no one sees it — other members never do. Only the site's administrator can look at it, to remove a photo confirmed by mistake.

The legal basis is your consent (article 6, 1, a of the GDPR), given by confirming. You can withdraw it at any time by writing to contact@theabsociety.com: your confirmed photos are then deleted. They are kept for as long as your account exists, and deleted with it.

If none of the candidates is the right one, you can ask the site to read the label (“None of them? Read the label”). The reduced copy of your photo — without its EXIF metadata — is then sent, with the list of edition names in the catalogue, to Anthropic, the provider of the Claude model, which returns the text it reads on the bottle and up to three editions. Nothing that identifies you is sent with it: no name, no email address, no account identifier. The photo is not kept by the site unless you then confirm an edition, as described above; what is kept, attached to your account, is a record of the reading — the text read, the editions proposed, the one you chose and what the reading cost.

The legal basis is your consent (article 6, 1, a of the GDPR), given by pressing the button. Your label readings are kept for as long as your account exists, and deleted with it — or sooner, with your confirmed photos, on a simple request to contact@theabsociety.com.

Purposes and legal bases

• Providing the service you asked for — account, collection, lists, trading between collectors: performance of the contract (article 6, 1, b of the GDPR).
• Keeping the account secure — session, email verification, password reset: legitimate interest (article 6, 1, f of the GDPR).
• Teaching photo search to recognise an edition from the photos you confirm: your consent (article 6, 1, a of the GDPR), given by confirming.
• Reading the label of your bottle when photo search finds nothing: your consent (article 6, 1, a of the GDPR), given by pressing the button.

Retention

Data is kept for as long as the account is active. The account and all the data attached to it are deleted on a simple request to contact@theabsociety.com. Password reset links expire on their own after one hour.

Your rights

You have the rights of access, rectification, erasure, portability, restriction and objection over your data. To exercise them, write to contact@theabsociety.com. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Cookies

The site only sets the cookies it needs to work:

• the session cookie, which authenticates you during your visit and expires when you close the browser;
• the “remember me” cookie, set for 7 days only if you tick that box when signing in;
• a display preference cookie (table or tiles), set when you choose a view; it holds no identifier;
• a cookie holding the last announcement you dismissed, set when you close the banner under the header, so that it stays closed until the next one.

No advertising trackers: these cookies are either strictly necessary or a mere display preference, so no consent banner is required. The site itself sets no third-party cookie — if you press “Continue with Google”, Google sets its own on its own pages, under its own policy.

Audience measurement

We count visits, to know which pages are read and which are not. The tool that does it runs on our own server, alongside the site — the figures never reach a third party.

It sets no cookie and keeps no persistent identifier. A visit is recorded as a one-way fingerprint that cannot be traced back to you, is renewed regularly, and is never followed from one website to another. What we read from it are page counts, referring sites and broad locations — never individuals.

Because the measurement is strictly statistical, is never cross-referenced with any other processing and is never passed on, it falls under the audience measurement exemption and needs no consent banner. The figures are deleted after 25 months.

Hosting and transfers

Data is hosted by OVH in France. It is never sold, and never passed on for anyone else's purposes.

Three providers act on our behalf: Brevo, in the European Union, which delivers the site's emails; Google LLC, in the United States, only if you choose to sign in with Google, as described above; and Anthropic, in the United States, only if you press the button that reads a bottle's label, as described under Photo search. Those are the only transfers outside the European Union, and only you can trigger them.

Anthropic acts as our processor under its data processing addendum, which incorporates the European Commission's standard contractual clauses for the transfer to the United States. It does not use what it receives to train its models, and deletes it within 30 days — unless a request is flagged for breaching its usage policy, in which case it may be kept for up to two years.