WineCRM · Version 1.2 · Effective 24 September 2026 · Applies to the winecrm.app website, the web application and the WineCRM mobile apps · English translation provided for convenience; the French version prevails.
1. Who processes your data
WineCRM is published by FlowLabs SAS, a simplified joint-stock company with share capital of €5,000, registered with the Bordeaux Trade and Companies Register under number 100 545 003, whose registered office is at 2 chemin de Peyrouley, 33360 Carignan-de-Bordeaux, France (« FlowLabs », « we »).
FlowLabs acts in two capacities:
Controller for the data needed for its own business: website visitors, contact and demo requests, user accounts, subscriptions, invoicing, support, security and marketing communications.
Processor for the data its customers record in their CRM (business contacts, notes, files, products, sales, appointments, tasks, audio recordings). For this data, the customer is the controller and FlowLabs acts on its instructions, under the Data Processing Agreement (DPA) available at winecrm.app/data-processing-agreement/.
Contact: contact@winecrm.app · +33 6 35 23 93 63 · FlowLabs SAS, 2 chemin de Peyrouley, 33360 Carignan-de-Bordeaux, France. FlowLabs is not required to appoint a Data Protection Officer; all requests relating to personal data are handled at this address.
2. Data processed, purposes, legal bases and retention periods
| Website audience measurement (Matomo, hosted by FlowLabs) | Pages viewed, truncated IP address, device type, traffic source | Legitimate interest (consent-exempt audience measurement) | 25 months maximum; cookies 13 months maximum |
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Contact and demo requests | First and last name, email, phone, organisation, message | Pre-contractual steps / legitimate interest | 3 years after the last contact initiated by the person |
| Email entered on the home page (« Try for free ») | Email address, date and page of entry | Legitimate interest (WineCRM information and offers sent to professionals, related to their business) | 3 years after the last contact initiated by the person; removed from the list immediately on unsubscribe |
| Account creation and management | Name, email, password (stored hashed), sign-in method (email, Google or Apple), preferences, versions of documents accepted | Performance of the contract | Life of the account, then 30-day recovery period before deletion |
| Subscription and invoicing | Plan, period, amounts, invoices, Stripe payment references, billing address | Performance of the contract / legal obligation | Accounting records: 10 years from the end of the financial year |
| Proof of contractual acceptance | Date, version accepted, account identifier | Legitimate interest (evidence) / legal obligation | 5 years after the end of the relationship |
| Support | Messages, attachments | Performance of the contract / legitimate interest | Duration of the request, then 2 years |
| Security and abuse prevention | Technical connection data | Legitimate interest | 12 months maximum |
| WineCRM news and offers | Email, consent choice | Consent (optional box, unticked by default) | Until consent is withdrawn or 3 years without interaction |
| Suppression list (unsubscribes) | Email, date of choice | Legal obligation / legitimate interest | At least 3 years, used only to honour the objection |
Mandatory fields are indicated at the time of collection. If they are not provided, the requested feature cannot be delivered.
3. Data recorded in the CRM by our customers
Our customers record information in WineCRM about their business contacts (wine merchants, restaurants, distributors, prospects): identity, business contact details, establishment address, notes, sales and visit history, documents and audio recordings. The customer determines the purposes and legal bases of this processing and informs the individuals concerned where required.
FlowLabs processes this data solely to provide the service. We do not sell it, do not use it for our own marketing and do not use it to train artificial intelligence models.
WineCRM is not designed to hold sensitive data (health, opinions, criminal convictions, etc.). Customers undertake not to record such data, including in free-text fields, files and audio recordings.
If you are a contact of one of our customers and wish to exercise your rights, please contact that customer. You may also write to us and we will forward your request to the customer concerned.
4. Specific features
Home page form. The email entered in the « Try for free » field is saved in our emailing tool Brevo, and you are then redirected to account creation. We use it to send you information about WineCRM, including if you do not complete your sign-up (for example to help you finish it). Every email contains an unsubscribe link.
Business card scanning. The photo of the card is sent to Google’s Gemini service (paid API) to extract the business contact details. FlowLabs does not keep the photo after extraction. Under Google’s terms for paid services, the data sent is not used to improve its models; Google may, however, keep limited logs, in particular for security purposes. This processing may take place outside the European Union (see section 6). Users check the extracted information before saving it.
Voice notes. Voice notes are recorded as audio files, stored by Scaleway in Paris. They are not automatically transcribed. Where a recording contains a third party’s voice, the user is responsible for informing that person and, where required, obtaining their consent.
Maps. WineCRM uses Google Maps Platform to convert contacts’ business addresses into coordinates, display the map, search for establishments and open directions in Google Maps. If you allow location access on your phone, it is used on the device to show your position; WineCRM does not send it to its servers and does not store it. Google processes the data needed for these features under its own rules: Google Privacy Policy (policies.google.com/privacy) and Google Maps Additional Terms of Service (maps.google.com/help/terms_maps).
Importing contacts from your phone. Only the contacts you select are imported. WineCRM does not access your entire address book.
Follow-up alerts. WineCRM analyses the sales history entered by the user to suggest, within the app, which customers to follow up. These alerts are suggestions only: the user remains the sole decision-maker. No decision producing legal or similarly significant effects is taken by automated means.
Sign in with Google or Apple. If you choose this sign-in method, Google or Apple send us the information needed for authentication (name, email or relay address, identifier). They act as separate controllers for their own processing.
Payment. Payments are processed by Stripe. We send Stripe the email, name and order references; Stripe collects card data and billing address directly. Card numbers never pass through our servers. No purchases are offered in the mobile apps.
5. Recipients and service providers
Your data is accessible only to authorised FlowLabs staff and to the providers below, to the extent necessary for their tasks. Development contractors have no access to real production data.
| Provider | Role | Data location |
|---|---|---|
| Scaleway SAS | Application server, PostgreSQL database, storage of files and audio | Paris, France |
| Vercel Inc. | Hosting and delivery of the application’s web interface (app.winecrm.app) | Global network, including the EU and the United States |
| MongoDB, Inc. (MongoDB Atlas, on Amazon Web Services) | Sales history database | Paris, France (AWS region eu-west-3) |
| Hostinger International Ltd | Hosting of the winecrm.app website | European Union |
| Google Ireland Ltd / Google LLC | Card scanning (Gemini), maps (Google Maps Platform), Sign in with Google, demo booking (Google Calendar) | EU and United States |
| Brevo (Sendinblue SAS) | Sending account-related emails (verification codes, password resets, notifications); management of mailing lists and sending of information and marketing emails | European Union |
| Stripe Payments Europe Ltd | Subscription payments and invoicing | Ireland, with possible transfers |
| Apple Distribution International Ltd | Sign in with Apple, distribution of the iOS app | Ireland, with possible transfers |
Matomo audience measurement is hosted by FlowLabs on its Hostinger hosting; no data is sent to the publisher of Matomo.
Administrative or judicial authorities may receive data where required by law.
6. Transfers outside the European Union
Some providers (Google, MongoDB, Stripe, Apple, Vercel) belong to groups established in the United States and may process data outside the European Union, in particular for the Gemini service, for which no processing region is guaranteed. Brevo hosts its data in the European Union but may access it from the United States and India. These transfers are covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework, where the provider is certified, and by the European Commission’s standard contractual clauses included in these providers’ data processing terms. A copy of the applicable safeguards can be requested at contact@winecrm.app.
7. Security
We implement measures appropriate to the risks, including:
We recommend that users export their data regularly from the app.
In the event of a data breach presenting a risk to individuals, we notify the CNIL within 72 hours and inform the customers concerned under the DPA.
8. Account closure and deletion
You can delete your account from the app or by writing to contact@winecrm.app. Deletion opens a 30-day period during which the data can be exported or the account restored on request. After this period, the data is deleted from production; it may remain in backups until they expire (7 days), after which it is permanently erased. If a backup is restored, earlier deletions are reapplied.
A free account with no sign-in for 24 months may be closed after two email warnings, sent 30 days and 7 days before closure.
Data that FlowLabs must keep under a legal obligation (invoices, evidence) is archived separately, with restricted access, for the periods stated in section 2.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent at any time and the right to give instructions on the fate of your data after your death. You may object to marketing at any time, including via the unsubscribe link in every email.
To exercise these rights: contact@winecrm.app. We reply within one month, which may be extended by two months for complex requests, in which case we will let you know. Proof of identity is requested only in case of reasonable doubt.
You may lodge a complaint with the French data protection authority (CNIL): www.cnil.fr or 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
10. Minors
WineCRM is intended for adult professionals only. We do not knowingly collect data about minors.
11. Cookies
The use of cookies and trackers is described in the Cookie Policy: winecrm.app/cookie-policy/.
12. Changes
We may update this policy to reflect legal, technical or functional changes. Substantial changes are notified to users by email or in the app at least 30 days before they take effect, except in cases of legal or security urgency.
Terms of Use
WineCRM · Version 1.2 · Effective 24 September 2026 · Applies to all accounts, free and paid · English translation provided for convenience; the French version prevails.
1. Purpose and publisher
WineCRM is a sales management service for wine professionals, available on the web (app.winecrm.app) and through iOS and Android mobile apps (the « Service »). It is published by FlowLabs SAS, with share capital of €5,000, registered with the Bordeaux Trade and Companies Register under number 100 545 003, whose registered office is at 2 chemin de Peyroulet, 33360 Carignan-de-Bordeaux, France (« FlowLabs »). Contact: contact@winecrm.app · +33 6 35 23 93 63.
These Terms of Use (the « Terms ») set out the conditions for accessing and using the Service.
2. Definitions and applicable documents
Customer: the individual or legal entity using the Service for its business, free of charge or for a fee. User: the individual holding an access. At the date of these Terms, one account corresponds to a single User. Customer Data: the data and content entered, imported or generated by the Customer in the Service (contacts, notes, files, audio, products, sales, appointments, tasks and histories).
The contractual documents are, in order of priority: the Data Processing Agreement (« DPA ») as regards the protection of Customer Data; the Terms of Sale for paid subscriptions; these Terms. The Privacy Policy provides information on processing carried out by FlowLabs; it is not a contract.
3. Sign-up and acceptance
The User is of legal age, acts for business purposes and, where applicable, has authority to bind the Customer.
Sign-up requires acceptance of these Terms and the DPA, including for free accounts, by ticking a box that is not pre-ticked. The documents are available before acceptance. The date and version of the documents accepted are recorded. Signing in with Google or Apple does not exempt the User from this acceptance.
The User provides accurate information and keeps it up to date. Credentials are personal and confidential; the User reports any unauthorised use without delay to contact@winecrm.app.
Consent to receive WineCRM news and offers is separate, optional and not pre-ticked. Refusing it does not prevent sign-up.
4. Description of the Service
Depending on the plan, the Service allows users to manage contacts, text and voice notes, documents, product sheets, sales histories, appointments and tasks; to display contacts on a map and plan sales routes; to scan business cards; and to receive follow-up suggestions within the app.
Limitations to be aware of:
5. Free trial and Starter plan
Every new account gets a 14-day trial of the Pro features, with no credit card required. If no paid plan is purchased at the end of the trial, the account automatically switches to the free Starter plan, with no charge.
Starter includes in particular access to five contacts, appointments and tasks, text notes, product sheets, customer history and 500 MB of documents. Details of each plan are shown on the Pricing page before any purchase.
When switching from Pro to Starter, no data is deleted: the five oldest contacts remain viewable; the others are kept with restricted access and become viewable again with a new Pro subscription. Existing notes and audio remain accessible. Exceeding the document quota blocks new uploads without deleting existing documents. Display restrictions never prevent the export of all Customer Data.
6. Mobile apps
The iOS and Android apps can be downloaded free of charge from the App Store and Google Play. They give access to the User’s WineCRM account. No purchases or subscriptions are offered in the mobile apps: paid subscriptions are purchased on the website or web application, under the Terms of Sale.
For apps downloaded from Apple’s App Store, the User acknowledges that:
Questions and complaints about the apps should be sent to FlowLabs: contact@winecrm.app, 2 chemin de Peyroulet, 33360 Carignan-de-Bordeaux, France.
7. Third-party services: Google Maps
Map features use Google Maps Platform. By using them, the User agrees to be bound by the Google Maps/Google Earth Additional Terms of Service (maps.google.com/help/terms_maps) and acknowledges that Google processes data under the Google Privacy Policy (policies.google.com/privacy). Establishment information from Google Maps is subject to Google’s terms; the User checks and completes the information saved in their records.
8. Customer obligations regarding its data
The Customer is responsible for Customer Data. It determines the purposes and legal bases of its files, informs the individuals concerned where required, respects their rights (including their objection to marketing) and limits the information recorded to the needs of its business. A business card or publicly available information does not exempt it from these obligations.
The Customer shall not record health data, other special categories of data or data relating to criminal convictions, including in free-text fields, files and audio.
Scanning a business card involves sending its photo to the Google Gemini service. Importing from the phone covers only the contacts selected. If an audio recording contains a third party’s voice, the Customer informs that person in advance and obtains their consent where required by law; technical permission to use the microphone does not constitute the recorded person’s consent.
FlowLabs acts as a processor for Customer Data, under the DPA.
9. Prohibited uses
The following are prohibited in particular: unauthorised access or attempted access to the Service or to other customers’ data; any action intended to disrupt, overload or compromise the Service; automated extraction of data beyond normal use; uploading unlawful or malicious content; reselling or making the Service available to third parties without written consent; any infringement of the rights of others. These prohibitions do not limit the Customer’s export of its own data or exceptions provided by law.
10. Intellectual property
The Customer retains all rights to Customer Data. It grants FlowLabs a limited authorisation to process it in order to provide the Service and comply with its legal obligations. FlowLabs does not sell Customer Data, does not use it to market to the Customer’s contacts and does not use it to train artificial intelligence models.
The Service, its code, interfaces, trademarks and content remain the property of FlowLabs or its licensors. FlowLabs grants the User a personal, non-exclusive, non-transferable right of use for the life of their account.
11. Availability, maintenance and backups
The use of cookies and trackers is described in the Cookie Policy: winecrm.app/cookie-policy/.
12. Suspension
FlowLabs may suspend access without notice in the event of fraud, a breach of the security of the Service or of others’ data, a serious breach of these Terms, or an order from an authority. For other breaches, FlowLabs sends a warning by email and allows a reasonable period of at least 7 days to remedy it. Any suspension is proportionate; the recovery of Customer Data remains possible, subject to legal and security requirements.
13. Account deletion and inactivity
The User can delete their account at any time from the app or by email to contact@winecrm.app. Deleting an account is separate from cancelling a paid subscription, which is governed by the Terms of Sale. A proportionate check of the requester’s identity may be carried out.
Deletion opens a 30-day period during which the data can be exported or the account restored on request; the data is then deleted under the DPA.
A free account with no sign-in for 24 months may be closed after warnings sent 30 days and 7 days before closure. Signing in before the deadline stops the procedure.
14. Confidentiality
Each party keeps confidential any non-public information received from the other in connection with the Service and uses it only for that purpose, for the duration of the relationship and 3 years thereafter, and in any event for as long as Customer Data is retained.
15. Liability
FlowLabs is bound by an obligation of means (best efforts). It does not guarantee any commercial result.
FlowLabs is not liable for damage resulting from use of the Service that does not comply with these Terms, from content entered by the Customer, from failures of the Internet or of the User’s equipment, or from force majeure within the meaning of Article 1218 of the French Civil Code.
FlowLabs is not liable for indirect damage, including loss of revenue, margin, customers or business opportunity, or damage to reputation.
Except in cases of gross negligence or wilful misconduct, personal injury and mandatory legal provisions, FlowLabs’ total liability, on all grounds combined, is limited: for a Customer with a paid subscription, to the amount excluding VAT corresponding to six (6) months of its subscription at the rate applicable to it; for a Customer on a free plan (Starter or trial), to fifty (50) euros.
These limitations do not apply to the rights that data subjects derive from data protection law.
16. Changes to the Terms
FlowLabs may change these Terms. Substantial changes are notified by email and in the app at least 30 days before they take effect, except in cases of legal or security urgency. A Customer who refuses the new terms may delete its account, and cancel its subscription under the Terms of Sale, before they take effect. New acceptance is obtained where necessary.
17. Evidence
Electronic records kept by FlowLabs under reasonable security conditions (online acceptances, emails, action histories) constitute evidence between the parties, unless proven otherwise.
18. Governing law and disputes
These Terms are governed by French law. In the event of a dispute, the parties shall first seek an amicable solution for 30 days from the written complaint, without prejudice to urgent measures. Failing that, and where both parties are traders (commerçants), the courts within the jurisdiction of the Bordeaux Court of Appeal shall have exclusive jurisdiction; in other cases, the statutory rules of jurisdiction apply.
