Privacy Policy

Last updated: 2026-05-01

This Privacy Policy describes how DEGUSON collects, uses, and protects your personal data when you use the DEGUSON mobile app, website, and related services.

DEGUSON is a structured product-tasting platform that connects producers with verified tasters. We are committed to handling your data in line with the EU General Data Protection Regulation (GDPR) and the Latvian Personal Data Processing Law.

1. Who is the data controller

The data controller is the legal entity operating DEGUSON. For any privacy-related question, contact us at info@deguson.lv.

2. What data we collect

Account identity: name and email obtained via Sign in with Apple or Google Sign-In.
Optional profile data: date of birth, gender, and a profile photo if you choose to add them.
Location: only when you scan a tasting QR code at a pickup point, to verify you are at the correct location.
Tasting data: photos, ratings, and answers you submit in surveys.
Technical data: device type, OS version, app version, language, and server-side request logs (IP address, timestamps).

3. Why we use your data

To match you with relevant tasting opportunities near you.
To pass anonymized survey answers to producers — your name, email, exact age, and contact details are never shared with producers.
To detect abuse such as duplicate accounts or fraudulent ratings.
To send essential transactional notifications (verification, survey reminders, account changes).
To comply with legal obligations.

4. Legal basis (GDPR)

Performance of a contract: providing the tasting service you requested.
Legitimate interest: fraud prevention, service security, and aggregate analytics.
Consent: optional data such as profile photo or precise age, which you can withdraw at any time.
Legal obligation: tax records, regulatory requests.

5. Who sees your data

DEGUSON staff for moderation, customer support, and abuse review.
Producers running the campaign you participated in — they only see anonymized survey answers in aggregate, not your name, email, exact age, or contact details.
Sub-processors that help us operate (see section 6).
Authorities only when legally required.

6. Sub-processors

Hosting: Hetzner Online GmbH (Germany).
Authentication: Apple Inc., Google LLC.
Push notifications and crash reporting: Google Firebase.
Email delivery: our email service provider.

7. Data retention

Active accounts: data is kept for as long as your account exists.
Deleted accounts: identifying data is removed within 30 days; aggregated, anonymized survey results may be retained as research data without identifying you.
Server logs: retained for up to 90 days for security and abuse investigations.

8. Your rights

Under the GDPR you have the right to:

access the data we hold about you;
correct inaccurate data;
delete your account and personal data;
export your data in a portable format;
object to processing not strictly required for the service;
lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija).

9. How to delete your account

You can delete your account in two ways:

In the DEGUSON app: open Settings → Delete account.
On the web: https://deguson.com/account/delete.

Once confirmed, your name, email, profile photo, date of birth, and gender are removed from our active systems within 30 days. Survey answers and ratings remain in aggregate research data without identifying you.

10. Children

DEGUSON is not intended for users under 16. If we become aware that we hold data about a child under 16, we will delete it.

11. International transfers

Our hosting and most sub-processors operate within the EU/EEA. Where transfers outside the EEA are necessary (e.g. Apple, Google), we rely on the European Commission’s standard contractual clauses or equivalent safeguards.

12. Changes to this policy

We will notify users by email at least 30 days before any material change to this policy. The current version is always available at this URL.

13. Contact

Privacy questions and data-rights requests: info@deguson.lv.