Privacy Policy

ScentWeave (“we”, “us”, “our”) is a fragrance discovery platform. For the purposes of the GDPR and the UK GDPR, we are the data controller. You can contact us at privacy@scentweave.com.

We collect the following categories of personal data:

• Account data — name and email address when you create an account.
• Usage data — pages visited, features used, fragrance searches, and AI stylist interactions. Collected only with your consent via PostHog analytics.
• Performance reports — fragrance performance data you voluntarily submit (longevity, projection, season, skin type).
• Preference data — notes you choose to block from recommendations.
• Technical data — IP address, browser type, and approximate location, processed only to deliver the service securely.

We do not collect payment card data or government identification.

We use your data to:

• Provide, operate, and improve the ScentWeave platform.
• Power AI-driven features (fragrance DNA, stylist, layering) using anonymised or aggregated data.
• Send transactional emails (password reset, account notifications).
• Detect and prevent abuse or fraudulent activity.
• Analyse how the platform is used so we can improve it — only if you have granted cookie consent.

We rely on the following legal bases:

• Contract (Art. 6(1)(b)) — to provide your account and core features.
• Consent (Art. 6(1)(a)) — for non-essential analytics cookies. You may withdraw consent at any time by clearing your cookies.
• Legitimate interests (Art. 6(1)(f)) — for security, abuse prevention, and service improvement.

We use the following cookies:

• scentweave-lang — stores your language preference. No expiry required; set for 1 year.
• scentweave-consent — records whether you accepted or declined analytics cookies. Set for 1 year.
• PostHog analytics cookies — only set after you accept analytics. Used to measure product usage. PostHog is hosted on EU servers (eu.i.posthog.com).

We do not use advertising, retargeting, or third-party tracking cookies.

We share data with the following sub-processors:

• Neon (database hosting, EU region) — stores account and fragrance data.
• Vercel (hosting, EU region when selected) — serves the web application.
• Resend — sends transactional emails. Only your email address is shared.
• Groq — processes AI stylist messages. Messages are sent to Groq for inference. Please do not include sensitive personal data in AI chat messages.
• PostHog (EU cloud) — analytics, only with your consent.

We retain your account data for as long as your account exists. Performance reports are kept indefinitely as community data (they are not linked to your identity in public views). If you delete your account, your personal data is erased within 30 days. Server logs are retained for 90 days.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time (for consent-based processing).

To exercise any of these rights, email privacy@scentweave.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

Passwords are hashed with bcrypt and never stored in plain text. Data in transit is protected by TLS. We apply the principle of least privilege to database access. Despite these measures, no system is completely secure; please use a strong, unique password.

ScentWeave is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have done so, please contact us and we will delete it promptly.

We may update this policy from time to time. We will post the revised policy on this page with an updated “last updated” date. For significant changes we will notify registered users by email.

Questions about this policy? privacy@scentweave.com.