Privacy Policy

1. Who we are

THE WHISKY INDEX LTD, registered in England and Wales, company number 17216416, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ ("we", "us", "our"), trading as The Index Registry, operates the platform described in this policy (the "Platform"). We are the data controller for the personal data described below.

Contact: toby@thewhiskyindex.com

2. What personal data we collect

• Account information: name, email address, and (optionally) a public display name, when you register.
• Identity verification (KYC) data: when you verify your identity to list an asset for sale, we ask Stripe Identity, our identity verification provider, to check your identity document. You choose how: with facial matching (Stripe compares a live selfie against your document using biometric technology) or without it (document check only, which may take longer or need manual review). Stripe processes this on our behalf for the check we ask for; it may also use the same information separately for its own fraud-prevention and legal purposes, under its own privacy arrangements. Where you choose facial matching, that specific processing involves biometric data, and we rely on your explicit consent for it, given through Stripe's verification flow. Choosing not to gives you a real alternative, not a blocked path. We ourselves never receive the underlying documents, images, or biometric data either way: only a verification status (verified/pending/rejected), which method you chose, and, where available, your name and date of birth; Stripe holds the rest under its own retention schedule.
• Payment information: processed entirely by Stripe; we do not store your card details. We hold a record of transaction amounts, dates, and status for our own accounting and dispute-resolution purposes.
• Asset and listing information: details you provide when registering an asset (e.g. distillery, cask number, condition), and any documents or photographs you upload, stored in a private storage system, only accessible to you and, where necessary, our verification team.
• Communications: messages sent through the Platform between buyers and sellers regarding a specific transaction; support enquiries, including conversations with our support chat assistant (logged for quality and compliance purposes, reviewed only by administrators).
• Usage data: searches you make, pages you view, and, where you choose to use them, saved searches, followed assets, and buyer requirements you submit.
• Cookies: see our separate Cookie Policy.

3. Why we process your data, and our legal basis

4. Who we share your data with

• Stripe (payments and identity verification)
• Supabase (our database and authentication infrastructure)
• Resend (transactional email delivery)
• Anthropic (our AI provider, used for document auto-fill assistance and our support chat assistant; see below)
• The other party to a transaction you're involved in (limited to what's necessary to complete that transaction)
• Law enforcement or regulators, where we're legally required to

On our AI features: our support chat assistant and document auto-fill tool send the specific content you submit (a message, or a document you upload) to Anthropic's API to generate a response. We do not use this to train any AI model.

Under Anthropic's standard commercial terms, it does not use inputs or outputs from our use of its API to train its models. It may retain this data for a limited period as needed to provide the service and for safety and abuse-monitoring purposes, in line with its published commercial terms and privacy policy.

5. International transfers

Our production database is hosted through Supabase in the eu-west-2 (London, United Kingdom) region. We do not currently use Sentry in production, so no production data is currently sent to Sentry.

Stripe and Resend each process personal data outside the UK, primarily in the United States. Each transfer is covered by a real, currently-executed legal safeguard, automatically incorporated into that provider's standard commercial terms rather than a bespoke arrangement of our own: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and, where the receiving entity is certified under it, the EU-U.S. Data Privacy Framework (with its UK extension). Anthropic's contracting entity for our account is Anthropic Ireland, Limited, so our own transfer of your data goes only as far as Ireland, within the UK's adequacy arrangements for the EEA, not a restricted transfer requiring a safeguard of our own. Any further, onward transfer from Ireland to the United States is Anthropic's own arrangement to safeguard, which it does the same way, via its own incorporated UK IDTA/EU SCCs and EU-U.S. Data Privacy Framework certification. You can contact us at toby@thewhiskyindex.com if you would like more information about the safeguards used for a specific international transfer of your personal data.

6. How long we keep your data

• Account and transaction records: 6 years from the end of the relevant financial year, in line with HMRC's tax record-keeping requirements (which in practice determine this period, alongside the Companies Act 2006's own shorter minimum for a private company)
• KYC session references: our own reference to your Stripe Identity session is cleared automatically after 90 days once no longer needed for an active verification. This is separate from, and does not affect, Stripe's own retention of the underlying identity-document and biometric data it collected directly from you. Stripe deletes that under its own schedule, not ours; see Stripe's own privacy policy for specifics
• Documents, and identity details collected for sanctions screening, flagged for retention review: reviewed by a human after 365 days, not retained indefinitely without reason
• Sanctions-screening decision records, and reports of illegal or rule-breaking content: we don't apply a fixed number of days to these; instead, each is kept for as long as necessary to meet our legal obligations (financial sanctions law; the Online Safety Act 2023) and to resolve any related dispute or investigation, then deleted or anonymised

7. Your rights

Under UK GDPR, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Contact us at toby@thewhiskyindex.com to exercise any of these rights.

8. Complaints

You have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we've handled your data incorrectly.

9. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our services, how we use personal data, or applicable requirements. When we do, we will update the "Last updated" date shown at the top of this page. Where a change materially affects how we use your personal data, or where applicable law requires additional notice or consent, we will provide that notice or obtain that consent as required.