Privacy Policy

1. Controller

[NAME AND ADDRESS FROM IMPRINT]

Email: info@scentx.io

2. Data we collect

When you visit this website, the following data is processed:

IP address (technical, for hosting/rate limits; not sold as anonymized analytics)
Date and time of access
Pages visited
On registration: email address
On waitlist signup: email address (purpose: beta access information; legal basis Art. 6(1)(a) or (f) GDPR; retained until withdrawal or end of beta)

3. Hosting & Infrastructure

This website is operated using the infrastructure of the following service providers:

Vercel Inc.

340 S Lemon Ave #4133, Walnut, CA 91789, USA

Vercel provides hosting infrastructure and the content delivery network (CDN). Technical access data (IP address, browser type, timestamp) may be processed. Data transfers to the USA are based on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. A data processing agreement pursuant to Art. 28 GDPR will be concluded / is planned once business infrastructure is finalized.

Supabase Inc.

970 Toa Payoh North #07-04, Singapore 318992

Supabase is used as a database and authentication service. User data (email address, encrypted password, user preferences, watchlist, alerts) is stored on servers in the EU (Frankfurt, eu-central-1). All data processing takes place within the EU. A data processing agreement pursuant to Art. 28 GDPR will be concluded / is planned.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / beta access) and Art. 6(1)(f) GDPR (legitimate interest in secure platform operation).

4. AI-Powered Features (ScentX Signal & Alerts)

The Anthropic API is used to power the platform's AI features (personalized market analysis, AI-generated alert text, weekly reports).

Anthropic, PBC

548 Market St PMB 90375, San Francisco, CA 94104, USA

User preferences (selected fragrance categories and interests) and market data are transmitted to the Anthropic API to generate personalized analyses. No names, email addresses, or other directly identifying data are transmitted. Anthropic does not train its models on data submitted via the API.

Data transfers to the USA are based on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. A data processing agreement pursuant to Art. 28 GDPR with Anthropic will be concluded / is planned.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / provision of beta and planned Pro features) and Art. 6(1)(f) GDPR.

5. Email Communication

System emails (registration confirmation, password reset, alerts, weekly report) are sent via the IONOS email service.

IONOS SE

Elgendorfer Str. 57, 56410 Montabaur, Germany

A data processing agreement pursuant to Art. 28 GDPR with IONOS will be concluded / is planned.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / beta access).

6. Supabase (database & auth)

We use Supabase (Supabase Inc., USA) as our database provider. Your data is processed on servers in the EU. Supabase is certified under the EU-US Data Privacy Framework.

7. Affiliate links

Affiliate links to external shops are prepared but not live yet. Once affiliate programs are active, clicking a link may transmit technical data (e.g. IP address, timestamp) to the respective provider for commission attribution.

8. Cookies

This website uses only technically necessary cookies (Supabase Auth session cookies). No non-essential / tracking cookies are set at this time.

9. Data retention on plan changes

Paid plans and checkout are not active yet. Once plan changes go live: when downgrading from Pro to Free, your data is not immediately deleted. Excess watchlist entries and alerts are deactivated and permanently removed after 30 days. You can upgrade again at any time to access all your data.

10. Your rights (Art. 15-21 GDPR)

Access to stored data
Rectification of inaccurate data
Erasure of your data
Restriction of processing
Objection to processing
Data portability

Contact for privacy requests: info@scentx.io

11. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection supervisory authority.