Privacy

Last updated 23 September 2026 (version 2026-09-23)

These terms are a draft. They have not been reviewed by a solicitor and are published so you can see what we intend, not as a final agreement. They will be reviewed before we take payment, and we will tell you what changed.

Lactone Labs Ltd (“we”) operates DRAMFINDER. This page explains what we collect and why. Two very different groups of people touch this service, and they are treated differently.

If you are a guest in a venue

We collect nothing that identifies you. The page you open to find a dram:

sets no cookies;
stores nothing on your device;
runs no analytics, advertising or tracking scripts of any kind;
has no sign-up, so there is no account and no profile.

The flavours you tap are sent to our server to work out which bottles match, and the answer is sent straight back.

We do keep an anonymous record of each search, so the venue can see what its guests are looking for and buy accordingly. It records the flavours asked for, the flavours ruled out, how many of the venue’s bottles the question reached, and which bottles came back — so a venue can tell which of its stock never comes up.

We also record that the page was opened, as a count and a time. That is how we can tell whether people who scan the code go on to use it.

Neither record carries anything about you: no name, no email, no device, no location, no IP address, and nothing that connects one search to another or to a person. Nobody, including us, can work out who asked. That is a property of what is stored rather than a promise about how we behave — the columns to hold such a thing do not exist.

As with any website, our infrastructure providers record ordinary technical request logs (including IP address) for short periods to keep the service running and to stop abuse. We do not use those logs to build a picture of individual guests.

If you run a venue

To give you an account and a venue page, we hold:

Your email address — this is how you sign in. We send a one-time link; we never store a password because there isn’t one.
Your venue details — name, web address, logo, colours, typeface and welcome message.
Your bottle list — which bottles you carry, what’s in stock and the prices you choose to display.

The lawful basis is performance of a contract: we cannot provide the service without these. Keeping security and abuse logs rests on our legitimate interests in running the service safely.

Who else sees it

We use other companies to run parts of the product. Each one only ever gets what it needs to do its job, and each processes it on our instructions only:

Supabase — the database and your sign-in.
Vercel — hosting the application itself.
Anthropic — reads the photographs and tasting notes you send us and turns them into flavour data. Your material is sent to them to be read.
Stripe — your subscription payments. We never see your card details.
Resend — the emails we send you, including your sign-in link.
Cloudflare — our domain and our own email.
Brave Search — used to find tasting notes already published about whiskies. No customer data is sent to it.

Nothing here is used to train anything — not by us, and not by them. We do not sell your data or share it with advertisers, and none of the companies above may use it to build or improve their own models.

One venue can never see another venue’s list, prices or guests — that separation is enforced in the database itself, not merely in the interface.

What we record about running your venue

Every change to your venue is logged: a bottle added or removed, stock marked in or out, your theme changed, your page suspended. Each entry says what changed, when, and which account did it — so it is a record of what a named person did.

Two reasons it exists, and both are as much for you as for us:

you can see what changed on your own venue, and when;
if something looks wrong later — why is this bottle gone, why did this page go dark — we can answer it rather than guess.

We keep it for as long as your venue exists, and delete it with everything else when you leave. We use it for those two purposes and nothing else, and nobody outside Lactone Labs sees it.

How long we keep it

Your account and venue data are kept while your subscription is active. If you cancel we delete them within 90 days, with two exceptions:

Billing records, which we must keep longer to meet our tax and accounting obligations.
Whisky descriptions you contributed — tasting notes you wrote and label photographs you sent. These become part of a catalogue every venue shares, and our own flavour analysis is built on them, so they stay. This is set out in section 3 of the terms. It covers only what you told us about a whisky: your bottle list, prices, stock levels and everything else are deleted with the rest.

Your rights

Under UK data protection law you can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, or object to our using it. Email hello@lactonelabs.co.uk and we will respond within one month.

If you think we have handled your data badly, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can fix it.

Changes

If we change what we collect, we will update this page and change the date above. For anything significant we will email account holders rather than relying on you to notice.