GDPR Information Notice

Last updated: June 1, 2026

This notice supplements our Privacy Policy and provides information required under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") for users located in the European Economic Area (EEA) or United Kingdom.

1. Data Controller

Scently
Email: support@scentlyapp.co

2. Personal Data We Process

• Identity data: Name, username, profile photo.
• Contact data: Email address.
• Account data: Hashed password, session tokens.
• Preference and usage data: Scent quiz answers, swipe history, favorite perfumes, wear logs, scent profile vector.
• Device and technical data: Device model, OS version, IP address, app version, language/region settings, crash/error logs.
• Subscription data: Subscription status managed via Apple App Store, Google Play, or RevenueCat (we do not store payment card details).

3. Purposes and Legal Bases

We process your personal data for the following purposes and on the following legal bases:

• Contract (Art. 6(1)(b)): Account creation, authentication, providing the Service, scent recommendations, Scent Twin matching, and subscription management.
• Legitimate interests (Art. 6(1)(f)): Service improvement, fraud prevention, security monitoring, and anonymized analytics — balanced against your rights.
• Legal obligation (Art. 6(1)(c)): Compliance with applicable laws, tax requirements, and lawful requests from authorities.
• Consent (Art. 6(1)(a)): Optional marketing communications and non-essential analytics. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Recipients and Processors

We share personal data with the following categories of recipients where necessary:

• Cloud infrastructure providers (hosting and storage).
• Apple and Google (app distribution and in-app subscription services).
• RevenueCat (subscription management).
• Anthropic (AI-powered gift suggestions — anonymized text only).
• Email service providers (transactional emails).
• Competent public authorities when required by law.

5. International Transfers

Some processors are located outside the EEA (e.g., United States). Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or equivalent mechanisms, as required by GDPR Chapter V.

6. Retention Periods

• Core account data is retained while your account is active.
• Upon account deletion, personal data is permanently removed within 30 days.
• Data subject to legal retention obligations (e.g., billing records) is kept for the applicable statutory period.
• Expired session and password-reset tokens are automatically purged daily.

7. Your Rights Under GDPR

If you are in the EEA or UK, you have the following rights:

• Right of access (Art. 15) — obtain a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — request deletion of your data. Use the in-app account deletion feature or see our Delete Account page.
• Right to restriction (Art. 18) — limit how we process your data.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format via the in-app "Download My Data" feature.
• Right to object (Art. 21) — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent.
• Right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at support@scentlyapp.co. We will respond within 30 days at no charge.

8. Automated Decision-Making

Scently uses algorithmic matching to suggest perfumes and Scent Twins based on your preferences. This does not produce legal or similarly significant effects on you. You may contact us to request human review of any recommendation you believe is incorrect.

9. Children

The Service is not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

10. Changes

We may update this notice from time to time. Material changes will be communicated via the app or email, and the "Last updated" date will be revised accordingly.