Privacy Policy

Effective and Last Updated: September 12, 2026

1. Scope and Who We Are

This Privacy Policy explains how Signature Scent Studio ("Signature Scent Studio," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use signaturescent.studio and its related applications, pages, and services (the "Service"). Signature Scent Studio is the controller of the personal information described in this Policy. You can contact us at support@signaturescent.studio.

This Policy does not govern websites, retailers, payment pages, or other services operated by third parties. Their own notices apply when you leave the Service or interact with them.

2. Information We Collect

Account and identity information

  • Email address, name, account identifier, authentication status, and sign-in timestamps.
  • If you use Google sign-in, profile information Google makes available with your permission, such as your name, email address, and profile picture.
  • Authentication tokens and a cached copy of limited profile information stored in your browser so you can remain signed in and the Service can render your account correctly.

Profile, community, and collection information

  • Your public handle, display name, bio, profile photo, social links, followers and follows, posts, comments, likes, reactions, reviews, ratings, ranking votes, and other content you publish.
  • Fragrance shelves and collections, shelf names and notes, layering combinations, signature scents, saved fragrances, and the visibility settings you choose. Collections are public by default unless you mark them private.
  • Fragrances you like or dislike, preference history, and taste signals used to personalize search and recommendations.

AI chat and image information

  • Chat prompts, conversation titles and history, AI responses, recommendation cards, tool results, conversation summaries, attached images, and token or message usage.
  • If you use photo identification, the photo or an image-derived numerical vector, optional search constraints, results, and any fragrance you confirm. Confirmed-identification feedback stores the vector and result without the original photo or your user ID.
  • If you submit a missing fragrance, its name, brand, source links, image, notes, accords, description, your account ID, and the status of our review of that submission.

Transactions and communications

  • Subscription tier, plan, status, billing period, cancellation status, prepaid AI-usage purchase amounts and balances, and Stripe customer, subscription, and checkout identifiers. We do not receive or store your full payment-card number.
  • Email address and message content when you contact us, join a mailing or wait list, request support, or redeem an invitation.

Device, usage, and diagnostics information

  • IP address, browser and device information, user-agent, language setting, requested page, request time, and general location inferred from network information.
  • Page views, searches, filters, clicks, saves, feature use, referral context, session or pageload identifiers, web-performance measurements, and error diagnostics.
  • Cookies, local storage, session storage, and similar technologies used for authentication, guest continuity, preferences, security, performance, and analytics.

3. Sources of Information

We obtain information:

  • Directly from you when you create an account, communicate, upload, post, rate, save, or subscribe.
  • From Google when you choose Google sign-in, and from Stripe about your subscription.
  • Automatically from your browser, device, and use of the Service.
  • From other members when they interact with you or your public content.
  • From public fragrance and retailer sources used to maintain the catalog.

4. How and Why We Use Information

We use personal information to:

  • Authenticate you, maintain your account, and provide the features you request.
  • Store and display profiles, collections, reviews, posts, comments, votes, and social interactions according to their visibility.
  • Generate AI responses, image descriptions, fragrance matches, and personalized recommendations.
  • Process subscriptions, apply plan entitlements, measure usage against plan limits, and provide billing support.
  • Operate search, rank useful content, understand feature performance, troubleshoot errors, and improve the Service.
  • Respond to messages, administer invitations or wait lists, and send service-related notices.
  • Protect users and the Service, prevent abuse and fraud, enforce our Terms, and comply with law.

Where data-protection law requires a legal basis, we rely on performance of our contract with you for requested account, subscription, and Service functions; our legitimate interests in operating, securing, measuring, and improving the Service where those interests are not overridden by your rights; your consent for optional analytics or communications where required; and compliance with legal obligations. You may withdraw consent at any time, but withdrawal does not affect earlier lawful processing.

5. AI and Automated Processing

The chat assistant and certain fragrance descriptions, matches, summaries, and recommendations are generated or assisted by artificial intelligence. You are interacting with an AI system, not a human adviser. We may send the relevant prompt, recent conversation context, tool results, and an attached image or image description to an inference provider to produce a response. Depending on availability and configuration, those providers may include Fireworks AI, Novita, DeepInfra, or Amazon Bedrock.

We do not use private conversations to train our own general-purpose AI models. Provider processing is governed by our service arrangements and the provider's applicable terms. Do not include sensitive personal information or confidential information in a prompt or image unless it is necessary and you are comfortable with that processing.

Personalization and usage limits may involve automated processing, but the Service does not make decisions based solely on automated processing that produce legal or similarly significant effects about you. AI outputs can be incomplete or wrong; review them before relying on them.

6. Public and Private Content

Public profiles, public collections and shelves, reviews, ratings, posts, comments, reactions, follows, and ranking activity may be viewed, copied, indexed by search engines, or reshared by anyone worldwide. Your email address, billing information, private shelves, private chat history, and user-submitted fragrance queue are not made public through the Service. Changing content to private or deleting it does not remove copies previously made by other people or search engines.

7. Cookies, Browser Storage, and Analytics

We use browser storage that is necessary to keep you signed in, maintain a guest identity, remember limited profile and interface state, and provide security and requested features. Blocking this storage may prevent parts of the Service from working.

With your permission, we use Google Analytics 4 and our own AWS-hosted product-event logging to understand visits, interactions, and performance. Google Analytics may set or read analytics identifiers and receive device, usage, and approximate-location information. Our own event stream may include a guest or account identifier, page path, pageload identifier, user-agent, browser language, and limited event properties. We do not put chat text, email addresses, or uploaded photos into our product-analytics event properties.

Optional analytics are off unless you accept them. You can accept, reject, or later change that choice through the Cookie settings control. Rejecting optional analytics does not prevent you from using the Service. We also honour supported Global Privacy Control signals by keeping optional analytics off. You can separately restrict storage in your browser. We do not use the Service for cross-context behavioural advertising.

8. When We Disclose Information

We may disclose the relevant minimum information to:

  • Amazon Web Services: hosting, authentication through Cognito, databases, object storage, content delivery, logs, email delivery, and Bedrock AI when used.
  • Google: optional sign-in and Google Analytics.
  • Stripe: checkout, payment processing, subscriptions, and the billing portal.
  • AI inference providers: Fireworks AI, Novita, DeepInfra, or Amazon Bedrock, as needed to process AI text and image features.
  • The public and other members: when you publish content or use a social feature.
  • Professional advisers and authorities: where reasonably necessary to obtain advice, protect rights or safety, investigate abuse, or comply with legal process.
  • A successor: in connection with a merger, financing, reorganisation, or sale of all or part of the Service, subject to appropriate confidentiality and notice where required.

We do not sell personal information for money. We do not share personal information for cross-context behavioural advertising, use sensitive personal information to infer personal characteristics, or offer financial incentives for personal information.

9. International Transfers

The Service is primarily hosted in the United States, and our providers may process information in the United States and other countries where they operate. Those countries may have different privacy laws from your home country. Where required, we use recognised transfer mechanisms and safeguards, such as adequacy decisions, contractual protections or standard contractual clauses, and take reasonable steps to require service providers to protect the information. Contact us if you want more information about safeguards relevant to your location.

10. Retention

We retain information only for as long as reasonably needed for the purposes described above, including to provide the Service, maintain security, resolve disputes, and meet legal obligations. In general:

  • Account and user content remains while your account or the content is active, unless you delete it.
  • Deleted conversations are hidden immediately and scheduled for permanent deletion after approximately 30 days.
  • Our AWS product-analytics logs are retained for up to 90 days; API and rendering logs are generally retained for 7 to 14 days.
  • De-identified photo-identification feedback may be retained while useful for evaluating and improving matching quality.
  • Subscription and transaction records may be retained as required for accounting, tax, fraud prevention, and legal compliance.
  • Backups, legal holds, and records held by providers may persist for a limited additional period under their retention cycles.

11. Security

We use technical and organisational safeguards designed for the nature of the information, including encrypted network connections, managed authentication, access controls, rate limits, input validation, and separated storage for conversations and relational account data. No system is completely secure, and we cannot guarantee that information will never be accessed, lost, or altered improperly. Please use a strong password and notify us if you suspect account misuse.

12. Your Rights and Choices

Depending on where you live and subject to legal exceptions, you may have the right to know or access personal information; correct it; delete it; receive a portable copy; restrict or object to processing; withdraw consent; opt out of sale, targeted advertising, or certain profiling; and appeal a denied request. You may also have the right to complain to your local privacy regulator.

You can edit profile information and visibility settings, delete individual or all conversations, and remove many collections, reviews, posts, comments, and preference signals in the Service. To exercise any other right, remove an email from a wait list, or appeal a decision, email support@signaturescent.studio with "Privacy Request" in the subject. We may need to verify your identity. We will respond within the time required by applicable law and will not discriminate against you for exercising a privacy right. An authorised agent may submit a request where local law permits, subject to proof of authority.

EEA, United Kingdom, Switzerland, Brazil, and similar jurisdictions

In addition to the rights above, you may object to processing based on legitimate interests, request restriction, and complain to the supervisory authority where you live or work. You may request information about applicable international-transfer safeguards. For Brazilian residents, applicable rights also include confirmation of processing, information about shared use, and review of qualifying automated decisions.

United States state privacy notice

During the preceding 12 months, we may have collected the categories described in Section 2: identifiers; customer records and subscription information; internet or electronic-network activity; approximate geolocation; audio, electronic, visual, or similar information you upload; user-generated content; and inferences about fragrance preferences. We collect these from the sources in Section 3, use them for the purposes in Section 4, and disclose them for business purposes to the recipients in Section 8. We do not knowingly sell or share these categories for cross-context behavioural advertising.

Australia, Canada, and New Zealand

You may request access to and correction of personal information and make a privacy complaint using the contact process above. We will investigate and respond within a reasonable time. If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner of Canada or relevant provincial authority, or the Office of the Privacy Commissioner of New Zealand, as applicable.

13. Children

The Service is not directed to children under 16, and they may not create an account or submit personal information. We do not knowingly collect personal information from a child under 16. If you believe a child has provided personal information, contact us so we can investigate and delete it as appropriate. We do not knowingly sell or use children's information for targeted advertising.

14. Changes to This Policy

We may update this Policy to reflect changes to the Service, providers, or law. We will post the revised version here and update the date above. If a change materially affects how we use personal information, we will provide additional notice or seek consent where required.

15. Contact Us

Questions, complaints, and privacy requests may be sent to support@signaturescent.studio. Please do not send passwords, full payment-card details, government identifiers, health information, or other highly sensitive information by email.

This Policy should be read together with our Terms of Use.