Privacy Policy
1. Data Controller
The Cavacave website (cavacave.com) is published and operated by:
Wine Project S.A.S. Share capital: €80,373 SIRET: 793 730 086 00022 Registered office: 151 rue Marcadet – 75018 Paris – France Represented by Mr Stéphane DEUBEL, President
Contact: contact@cavacave.com — +33 1 84 21 85 70
2. Personal Data Collected
Depending on your use of the site, we collect the following data:
| Category | Data |
|---|---|
| Identification | Last name, first name, username, email address, phone number |
| Address | Postal address (billing and shipping) |
| Payment | Banking details (collected and hosted by Mangopay) |
| Identity verification (KYC) | Identity document (processed by Mangopay) |
| Browsing | IP address, browser type, pages viewed, interactions |
| Communication | Messages exchanged via support chat |
3. Purposes and Legal Bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Management of your account and user profile | Performance of contract (Art. 6.1.b) |
| Execution of auction transactions | Performance of contract (Art. 6.1.b) |
| Payment and transfers (via Mangopay) | Performance of contract (Art. 6.1.b) |
| Identity verification (KYC/AML) | Legal obligation (Art. 6.1.c) |
| Customer support via chat | Legitimate interest (Art. 6.1.f) |
| Audience analysis and service improvement | Consent (Art. 6.1.a) |
| Sending marketing communications | Consent (Art. 6.1.a) |
4. Recipients and Processors
Your personal data may be shared with the following processors, strictly within the scope of the purposes described above:
| Processor | Role | Location |
|---|---|---|
| Supabase | Database hosting and authentication | EU (Frankfurt) |
| Vercel | Website hosting | Global network (Edge) |
| Mangopay | Payment services, e-wallets, KYC | Luxembourg (EU) |
| PostHog | Audience analytics | EU (Frankfurt) |
| Crisp | Customer support chat | France (EU) |
| Brevo | Transactional and marketing emails | France (EU) |
We never sell your personal data to third parties.
5. International Transfers
The majority of your data is processed within the European Union.
Vercel may process certain data (IP address, HTTP headers) on its global Edge network. These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46.2.c of the GDPR.
6. Data Retention Periods
| Data | Retention period |
|---|---|
| Active user account | Duration of the business relationship |
| Transaction data | 10 years (accounting and tax obligation) |
| KYC data | 5 years after the end of the business relationship (AML obligation) |
| Analytics cookies | 13 months maximum |
| Support messages | 3 years after the last contact |
| Inactive account | Deletion after 3 years of inactivity |
7. Your Rights
In accordance with the GDPR (Articles 15 to 22), you have the following rights:
- Right of access: obtain confirmation that your data is being processed and receive a copy
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request the deletion of your data (except where legal retention is required)
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to the processing of your data on legitimate grounds
- Right to withdraw consent: withdraw your consent at any time (without affecting the lawfulness of prior processing)
- Right to restriction: request restriction of processing in certain cases
How to Exercise Your Rights
Send your request by email to: contact@cavacave.com
We will respond within one month of receiving your request.
Complaint to the CNIL
If you believe that the processing of your data does not comply with regulations, you may lodge a complaint with the French Data Protection Authority (CNIL):
- Website: www.cnil.fr
- Address: CNIL — 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
8. Cookies
Necessary Cookies
These cookies are essential to the website's operation or to a service you expressly request. They are set without your consent, in accordance with article 82 of the French Data Protection Act.
| Cookie / storage | Provider | Purpose | Duration |
|---|---|---|---|
sb-<project>-auth-token (Cookie) | Supabase | Maintaining your login | Session |
NEXT_LOCALE (Cookie) | Cavacave | Remembering your language choice | 1 year |
cavacave_consent (Cookie) | Cavacave | Recording your cookie choice | 6 months |
crisp-client/* (Cookie) | Crisp | Identifying your support conversation, from the moment you open the chat | 6 months |
crisp-client/* (Local storage) | Crisp | Identifying your support conversation, from the moment you open the chat | Until cleared |
Audience Measurement Cookies
These cookies are set only after you accept. Until you do, we measure site traffic without storing anything on your device: we receive visit counts and their sources, but no identifier follows you from one session to the next.
| Cookie / storage | Provider | Purpose | Duration |
|---|---|---|---|
ph_<project key>_posthog (Cookie) | PostHog | Browsing analysis and usage statistics | 13 months |
ph_<project key>_posthog (Local storage) | PostHog | Browsing analysis and usage statistics | Until cleared |
Managing Your Preferences
You can change your choice at any time:
- From the consent banner shown on your first visit;
- From the “Cookie policy” link in the footer, which brings that banner back;
- From your browser settings.
Declining audience measurement cookies affects neither your access to the site nor any of its features — including the support chat, which remains reachable and only creates a session when you open it. If we add or change a tracker, the banner is shown to you again automatically.
9. Changes to This Policy
We reserve the right to modify this policy at any time. In the event of a substantial change, we will inform you by email or via a notification on the site.
The date of the last update is shown below.
Last updated: February 2026