Privacy Policy.

2. What personal data we collect

• Account information: name, email address, and (optionally) a public display name, when you register.
• Eligibility information: the country you confirm at checkout, to check you can legally buy whisky in your jurisdiction.
• Identity verification data: before you can complete a purchase, we ask Stripe Identity, our identity verification provider, to check a government identity document you submit (which typically shows your name, date of birth, and, depending on the document, your address). You choose how: with facial matching (Stripe compares a live selfie against your document using biometric technology) or without it (document check only, which may take longer or need manual review). Stripe processes this on our behalf for the check we ask for; it may also use the same information separately for its own fraud-prevention and legal purposes, under its own privacy arrangements. Where you choose facial matching, that specific processing involves biometric data, and before it runs, we rely on your explicit consent for it, given through Stripe's verification flow. Choosing not to gives you a real alternative, not a blocked path. We ourselves never receive the underlying documents, images, or biometric data either way: only a verification status (verified/pending/rejected), which method you chose, and, where available, your name and date of birth; Stripe holds the rest under its own retention schedule.
• Payment information: processed entirely by Stripe; we do not store your card details. We hold a record of transaction amounts, dates, and status for our own accounting and dispute-resolution purposes.
• Cask ownership and warehouse account information: your name and contact details, and the specific cask you've bought, passed to our supplier and to the bonded warehouse holding it, so the cask can be transferred and confirmed into your name and your own warehouse account can be set up.
• Cask alert emails: if you sign up to be alerted about new casks matching your criteria, we hold your email address and the criteria you gave us. Every alert email includes a one-click unsubscribe link that stops that specific alert immediately.
• Communications: support enquiries, including conversations with our support chat assistant (logged for quality and compliance purposes, reviewed only by administrators).
• Usage data: searches you make and pages you view.
• Internal customer record: our support and compliance team can see a single internal record combining your account details, orders and casks owned, enquiries, identity verification and sanctions screening status (never the underlying documents), how your account was referred to us, and the emails we've sent you. Access to this record is limited to administrators and every view or export of it is logged. We also keep private internal notes about your account (for example, a stated cask preference) for our own customer-service purposes.
• Cookies: see our separate Cookie Policy.

3. Why we process your data, and our legal basis

4. Who we share your data with

• Stripe (payments and identity verification)
• Supabase (our database and authentication infrastructure)
• Resend (transactional email delivery)
• Vercel (our hosting provider: every request to the Platform passes through it)
• Anthropic (our AI provider, used for our support chat assistant; see below)
• Awin, our affiliate-tracking provider, but only where you arrived via an affiliate link and only after you've given cookie consent for it; see our Cookie Policy for detail
• Google, where our inventory-sync system with a specific supplier is switched on (it currently isn't)
• Our cask supplier and the bonded warehouse holding your cask, limited to what's necessary to transfer it into your name and set up your own warehouse account
• Law enforcement or regulators, where we're legally required to

On our AI features: our support chat assistant sends the specific content you submit to Anthropic's API to generate a response. We do not use this to train any AI model, and Anthropic does not use it to train its models either, under its standard commercial terms.

We also use Sentry, an error-monitoring tool, elsewhere in our infrastructure. It is not currently active in our live production environment, so no production data is currently sent to it. If that changes, we'll update this policy.

Resale marketplace: if you buy or sell a cask through our resale marketplace (currently switched off), we share what's necessary to complete that sale between the buyer and the seller (name and the details needed to identify the cask), with Castlelaw (confirming registered ownership and completing the transfer), and with Stripe (processing and holding payment through your Stripe connected account). Before your first resale payout, we collect a seller's full name, date of birth, address, tax identification number, and whether they sell as a business, and we report this information, together with sale details, to HM Revenue & Customs as required by law.

5. International transfers

Our production database is hosted through Supabase in the eu-west-2 (London, United Kingdom) region.

Stripe, Resend, Vercel and Awin each process personal data outside the UK, primarily in the United States. Each transfer is covered by a real, currently-executed legal safeguard, automatically incorporated into that provider's standard commercial terms rather than a bespoke arrangement of our own: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and, where the receiving entity is certified under it, the EU-U.S. Data Privacy Framework (with its UK extension). Anthropic's contracting entity for our account is Anthropic Ireland, Limited, so our own transfer of your data goes only as far as Ireland, within the UK's adequacy arrangements for the EEA, not a restricted transfer requiring a safeguard of our own. Any further, onward transfer from Ireland to the United States is Anthropic's own arrangement to safeguard, which it does the same way, via its own incorporated UK IDTA/EU SCCs and EU-U.S. Data Privacy Framework certification. You can contact us at toby@thewhiskyindex.com if you would like more information about the safeguards used for a specific international transfer of your personal data.

6. How long we keep your data

• Account and transaction records: 6 years from the end of the relevant financial year, in line with HMRC's tax record-keeping requirements
• Sanctions-screening decision records: kept for as long as necessary to meet our legal obligations and to resolve any related dispute or investigation, then deleted or anonymised
• Business contacts we have written to: 12 months if there is no reply
• Companies House filing information we use to decide when to write: 90 days
• Complaints: 3 years
• Gift recipients whose gift was declined: 30 days; other gift recipient details: 24 months after the gift is redeemed or refunded
• Cask owners' records: 6 years after ownership ends

7. Your rights

Under UK GDPR, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Contact us at toby@thewhiskyindex.com to exercise any of these rights.

If you've signed up for cask alert emails, you can unsubscribe at any time using the link in any alert email, without needing to contact us or exercise any of the rights above.

7A. Business contacts, Companies House and our tools

Businesses we write to. We write to UK companies (limited companies, LLPs and PLCs) about whisky casks as gifts for staff and clients. We use the company's name and a business address the company publishes on its own website, which we note with the page and date we found it. We never guess addresses and we don't write to sole traders or partnerships by email. Our legal basis is legitimate interests. Every email says why you are getting it and how to opt out; reply "stop" or use the unsubscribe link and we won't write again.

Companies House. We read public filings on Companies House (for example, that a company has filed its accounts) to decide when to write. We keep only the type and date of the filing, for 90 days, and never the names of directors or other people. Because we don't collect anyone's personal data from Companies House, we don't contact individuals about it; this notice is how we tell you (UK GDPR Article 14(5)(e) and 14(7)).

Our service tools. The chat assistant, call booking, waitlists and our registry desks use the details you give them only to answer you. Before any AI tool sees a message, we remove identity numbers, bank details, card numbers and dates of birth.

Automated decisions. Some checks are automatic: the age check, sanctions screening, and fraud checks on companies. If one of them stops a purchase, you can ask for a person to review it, and we reply within one working day. We score companies, never people.

Transfers. Some of our suppliers are in the United States. We use suppliers covered by the UK–US data bridge, or the UK International Data Transfer Agreement where they aren't.

Complaints and data requests. Use the complaints page or email us. We acknowledge at once, answer complaints within 30 days and data requests within one month.

8. Complaints

You have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we've handled your data incorrectly.

9. Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the version and effective date shown at the top of this page.