Privacy Policy.

2. What personal data we collect

• Account information: name, email address, and (optionally) a public display name, when you register.
• Identity and eligibility information: the country you confirm at checkout (to check you can legally buy whisky in your jurisdiction), and, where we ask for it, identity verification data via our provider, Stripe Identity.
• Payment information: processed entirely by Stripe; we do not store your card details. We hold a record of transaction amounts, dates, and status for our own accounting and dispute-resolution purposes.
• Cask ownership and warehouse account information: your name and contact details, and the specific cask you've bought, passed to our supplier and to the bonded warehouse holding it, so the cask can be transferred and confirmed into your name and, where the warehouse offers one, your own warehouse account can be set up.
• Communications: support enquiries, including conversations with our support chat assistant (logged for quality and compliance purposes, reviewed only by administrators).
• Usage data: searches you make and pages you view.
• Cookies: see our separate Cookie Policy.

3. Why we process your data, and our legal basis

4. Who we share your data with

• Stripe (payments and identity verification)
• Supabase (our database and authentication infrastructure)
• Resend (transactional email delivery)
• Anthropic (our AI provider, used for our support chat assistant; see below)
• Our cask supplier and the bonded warehouse holding your cask, limited to what's necessary to transfer it into your name and, where the warehouse offers one, set up your own warehouse account
• Law enforcement or regulators, where we're legally required to

On our AI features: our support chat assistant sends the specific content you submit to Anthropic's API to generate a response. We do not use this to train any AI model, and Anthropic does not use it to train its models either, under its standard commercial terms.

5. How long we keep your data

• Account and transaction records: 6 years from the end of the relevant financial year, in line with HMRC's tax record-keeping requirements
• Sanctions-screening decision records: kept for as long as necessary to meet our legal obligations and to resolve any related dispute or investigation, then deleted or anonymised

6. Your rights

Under UK GDPR, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Contact us at toby@thewhiskyindex.com to exercise any of these rights.

7. Complaints

You have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we've handled your data incorrectly.

8. Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the version and effective date shown at the top of this page.