Privacy

This portal records the least it can. There is no advertising, no tracking across other websites, and no analytics company is paid to watch you.

What is recorded, and why

Your email address and password

So you can sign in. The password is never stored as you typed it — it is hashed by Supabase, and nobody at the Court or SOMM DIGI can read it.

What you read, and how you are getting on

Sections opened, bookmarks, notes you write, quiz attempts, saved words and the days you studied. This is what makes the portal remember where you were, and it is visible to the Court in aggregate.

The site that referred you, once

Recorded when you create your account, so the Court knows where its candidates come from. It is a single word — “instagram”, “google”, “direct” — not a history of where you have been.

Your IP address, city and country

Recorded when a page opens. The city and country come from the network and are approximate. The IP address is the only thing here that points at a household rather than a region; it is kept so the Court can see where its members are and recognise misuse of a shared account. Visit records are deleted after ninety days.

Your payment

Handled entirely by Stripe. Card numbers never reach this portal — the Court holds only the plan you chose, whether it is active, and when it renews.

What is not recorded

• No advertising or tracking cookies. The only cookie set is the one that keeps you signed in.
• No third-party analytics — no Google Analytics, no Meta pixel, nothing of that kind.
• No profile is built about you across other websites, because nothing here can see them.
• Nothing is sold, and nothing is shared for marketing by the Court or by SOMM DIGI.

Who else handles it, and where

Four companies process data on the Court’s behalf, each for one job: Supabase stores the database and manages sign-in, Vercel serves the website and runs its code, Stripe takes payments, and Resend delivers email. Each is bound to use the data only to provide that service, and none may use it for anything of its own.

Your account and everything you study stay in the United Kingdom. The database is in London and, since 23 August 2026, so are the servers that run the portal’s code — they were in Washington until then, and were moved so that reading a chapter no longer sends anything across the Atlantic.

Two things still leave the country, and both are named rather than glossed over. Stripe operates from Ireland and the United States, and Resend from the United States, so your email address travels to them to take a payment or deliver a letter. Each transfer is covered by Standard Contractual Clauses with the UK Addendum, which is the mechanism UK and EU law provide for exactly this. Card details never reach the Court at all — Stripe holds those.

Nothing here is held because you consented to it, which is why you are never asked to. Your account and study record are held to perform your membership; the visit records on the Court’s legitimate interests, which you may object to; payment records because tax law requires it. This is set out in full, with what you can demand about each, in your data rights.

How long it is kept

Your account and your study record are kept for as long as you hold a place, and are deleted when you ask. Visit records — the IP, city and page — are deleted after ninety days. Payment records are kept for as long as tax law requires the Court to keep them.

What you can ask for

Under UK and EU data protection law you may ask for a copy of everything held about you, ask for anything wrong to be corrected, ask for it to be deleted, or object to it being held at all. Write to rsayburn@courtofmastersommeliers.org and it will be dealt with within one month. Deleting your account removes your study record with it.

Who to complain to

If you are not satisfied with the answer you receive, you can complain to the Information Commissioner’s Office in the United Kingdom, or to the data protection authority in your own country.

The Court of Master Sommeliers is the data controller. The portal is built and maintained on its behalf by SOMM DIGI AI. What is kept in your own browser is set out in the cookie notice; how to exercise any of the rights above is in your data rights.