Legal

Vinari · Legal

Privacy Policy

Effective date: 1 July 2026Last updated: 1 July 2026
↓ Download PDF

This Policy explains how we handle personal data. It is written to align with Malaysia’s Personal Data Protection Act 2010 (as amended by the Personal Data Protection (Amendment) Act 2024) and, where they apply to our overseas users, comparable laws such as the EU/UK GDPR.

1. Who we are

Vinari is operated by Lee Kok Yang, an individual based in Malaysia, trading under the brand name “Vinari” (“Vinari”, “we”, “us”, “our”).

2. The three groups this Policy covers, and our role for each

Vinari serves restaurants and other venues (“Operators”). Their guests (“Guests”) use our app at the table. We treat the data differently depending on whose it is:

2.1 Guest data — the Operator is the controller, Vinari is the processor. When a Guest uses the app at a venue, the Operator decides why and how that Guest’s personal data is collected and used. Vinari processes that data only on the Operator’s behalf and on its instructions, to provide the Service. The Operator is responsible for the privacy notices and consents required for its Guests.

2.2 Operator data — Vinari is the controller. For the account, billing, and support data of the Operators who subscribe to us, we decide how that data is used, so we act as the controller.

2.3 Website visitor data — Vinari is the controller. For people who simply browse vinari.io, we act as the controller of limited analytics data.

3. What we collect

3.1 From Guests (on the Operator’s behalf):

  • mobile phone number (used to recognise a returning Guest at that same venue);
  • name;
  • gender;
  • age group;
  • wine and taste preferences, and the messages a Guest sends in the chat;
  • order selections and history at that venue.

3.2 From Operators:

  • name, business name, email, and login credentials;
  • venue details and wine list content you upload;
  • billing information — handled by Lemon Squeezy as merchant of record (we do not store full card details);
  • support correspondence and usage logs.

3.3 From website visitors:

  • basic device/analytics data and essential cookies needed to run the site.

We do not intentionally collect special/sensitive categories of data (such as health or biometric data). Please do not enter them into the chat.

4. How Guest data is kept separate — our core commitment

This is central to how Vinari works:

  • A Guest’s data is only available to the venue(s) that Guest has actually patronised.
  • We do not share one venue’s Guest data with any other venue.
  • When a returning Guest visits a new venue, the AI starts fresh — it does not carry over or reuse the taste profile, history, or identity that Guest built at any other venue.
  • We do not sell Guest personal data, and we do not provide it to third parties for those third parties’ own marketing or commercial purposes.

5. Why we use the data, and our legal basis

Guest data (on the Operator’s instructions): to recognise returning Guests at the same venue, generate wine recommendations, relay orders to the venue, and maintain the venue’s record of preferences and orders. The lawful basis (typically the Guest’s consent, captured by the Operator at the point of collection) is the Operator’s responsibility as controller.

Operator data (as controller): to provide and bill for the Service, support you, secure the platform, prevent fraud and abuse, and meet our legal obligations. Our basis is performance of our contract with you and our legitimate interest in running a secure, lawful service.

Website data: to keep the site working and understand basic usage, on the basis of our legitimate interest and, where required, your consent.

We use AI to generate recommendations (see Section 7). We do not use Guest data to build cross-venue profiles, and we do not sell any personal data.

6. Who we share data with (sub-processors)

We share data only with service providers who help us run the Service, under contracts that restrict their use of it:

  • Lemon Squeezy — merchant of record; processes Operator payments and handles billing, tax, and chargebacks.
  • Google (Gemini) — generative AI provider; processes the Guest’s chat inputs and your wine list to generate recommendations (update if you migrate to a self-hosted model).
  • Vercel — application hosting and delivery.
  • Neon — database hosting; stores Operator and Guest data.

(Our domain registrar, GoDaddy, does not process personal data and is not a sub-processor.) A current list of sub-processors is available on request. We will take reasonable steps to bind each sub-processor to obligations no less protective than those in this Policy.

7. Artificial intelligence

Recommendations and chat responses are generated using Google’s Gemini API. To produce them, the Guest’s inputs and the venue’s wine list are sent to Google for processing. Because we use the paid tier of the Gemini API, Google does not use the data we send to train or improve its models, and processes that data as our data processor; Google may retain limited logs to detect misuse and may process or cache data in countries where it operates. AI outputs may be inaccurate or incomplete and are suggestions, not professional advice (including not allergen, dietary, or medical advice).

8. International transfers

Your personal data is stored in the United States — our hosting provider (Vercel) and database provider (Neon) both operate there — and our AI provider may process data in the US or other countries where it operates. Because the US is not currently recognised under the PDPA as offering protection substantially similar or adequate to Malaysia’s, we rely on your consent to this transfer (captured when you start using the app) together with contractual data-protection safeguards in our agreements with these providers. For personal data subject to the GDPR, those safeguards include Standard Contractual Clauses.

9. How long we keep data

  • Guest data: retained while the relevant Operator’s account is active, then deleted within a reasonable period (target: 30 days) after the Operator’s account ends, unless the law requires longer or the Guest asks for earlier deletion.
  • Operator data: retained for the life of the account and a reasonable period afterwards for legal, tax, and record-keeping purposes.
  • Website data: retained only as long as needed for analytics and security.

10. Security

We use reasonable technical and organisational measures to protect personal data, including access controls and encryption in transit. No system is perfectly secure, but we take protection seriously. If a personal data breach occurs, we will act in line with our legal obligations — including, where required under the PDPA, notifying the Personal Data Protection Commissioner as soon as practicable (and within 72 hours), and notifying affected individuals without undue delay where the breach is likely to cause significant harm. Where Vinari processes Guest data on an Operator’s behalf, we will support that Operator in meeting its own notification duties.

11. Your rights

Depending on the law that applies to you, you may have rights to:

  • access the personal data we hold about you;
  • correct inaccurate data;
  • withdraw consent;
  • request deletion;
  • request portability of your data; and
  • object to or restrict certain processing.

If you are a Guest, the venue you visited is the controller of your data, so please contact that venue first. You may also contact us at support@vinari.io and we will assist or pass your request to the relevant venue. If you are an Operator or website visitor, contact us directly.

12. Age and alcohol

Vinari is a tool used in venues that sell alcohol. It is not directed at anyone below the legal drinking age, and it is the Operator’s responsibility to verify a Guest’s age before serving alcohol. We do not knowingly collect data from anyone below the legal drinking age. If you believe we hold such data, contact us and we will delete it.

13. Changes

We may update this Policy from time to time. We will post the updated version here with a new “Last updated” date, and where changes are material we will take reasonable steps to notify Operators.

14. Contact

Vinari — Lee Kok Yang, operating as Vinari
Emerald Hills, Jalan 6/154D, Taman Desa Cheras, 56000 Kuala Lumpur, Malaysia
Email: support@vinari.io