GDPR Information Notice

Last updated: November 2, 2026

This notice supplements our Privacy Policy and provides information required under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") for users located in the European Economic Area (EEA) or United Kingdom.

1. Data Controller

Scently
Email: support@scentlyapp.co

2. Personal Data We Process

• Identity data: Name, username, profile photo.
• Contact data: Email address.
• Account data: Hashed password, session tokens.
• Preference and usage data: Scent quiz answers, swipe history, favorite perfumes, perfume wardrobe, scent profile vector.
• Wear log and progress data: Daily wear logs (perfume, date, and morning/evening slot), streak counters (current and best streak, weekly streak-freeze use), earned badges, and daily usage counters for free-tier limits.
• Notification data: Push notification token, the notification types you have turned on or off, your chosen reminder hours, your time zone, and your last-active time.
• Guest session data: If you take the quiz before signing up, a temporary guest account with no name or email address, holding your quiz answers and in-app activity until you save your profile.
• Product analytics data: Pseudonymous usage events linked to an internal user ID (not your email): app opens, screens viewed and onboarding steps, sign-up/sign-in and guest upgrades (with the method), swipes and daily-limit events, favorites added, wear logs (with the morning/evening slot only), paywall views and purchases (with the plan), notification permission answers and notification opens, and weekly-card shares, plus basic device and app information.
• Device and technical data: Device model, OS version, IP address, app version, language/region settings, crash/error reports.
• Subscription data: Subscription status managed via app store and subscription infrastructure providers (we do not store payment card details).

3. Purposes and Legal Bases

We process your personal data for the following purposes and on the following legal bases:

• Contract (Art. 6(1)(b)): Account creation, authentication, providing the Service, scent recommendations, Scent Twin matching, your wear log, streaks and badges, and subscription management. When you take the quiz as a guest, we process your answers to take steps at your request before you create an account, and to carry them over when you save your profile.
• Legitimate interests (Art. 6(1)(f)): Service improvement, fraud prevention, security monitoring, crash reporting, pseudonymous product analytics (see below), deleting inactive guest accounts, and limiting how often we send reminders — balanced against your rights.
• Legal obligation (Art. 6(1)(c)): Compliance with applicable laws, tax requirements, and lawful requests from authorities.
• Consent (Art. 6(1)(a)): Push notifications (you allow them through your device's permission prompt and can switch each type off in the app), optional marketing communications, and any non-essential analytics. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Product analytics. Our analytics are limited to the pseudonymous product analytics described in Section 2, processed by our analytics provider on EU servers. Events are tied to a random internal user ID, never to your name or email address, and are used only to understand and improve how the app works — not for advertising, profiling for marketing, or tracking you across other companies' apps or websites. We rely on our legitimate interest in improving the Service for this. We do not use non-essential analytics beyond this; if we ever add any, we will ask for your consent first. You can object at any time (Art. 21): turn off Profile → Settings → Share usage analytics in the app, or email support@scentlyapp.co; we will then stop analytics for your account and delete the events linked to your internal ID.

Notifications. We send at most 2 push notifications per day, skip reminders when you have already opened the app, and send no more than three "we miss you" reminders (after 3, 7 and 21 days of inactivity). You can choose your reminder hours and turn each notification type off in Profile → Settings → Notifications.

4. Recipients and Processors

We share personal data with the following recipients where necessary:

We also share data with competent public authorities when required by law.

5. International Transfers

Product analytics are processed in the EU. Some other processors are located outside the EEA (e.g., United States). Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or equivalent mechanisms, as required by GDPR Chapter V.

6. Retention Periods

• Core account data is retained while your account is active.
• Guest accounts (created when you take the quiz before signing up) with no activity for 30 days are deleted automatically, with all their data. If you save your profile, the guest data becomes part of your account instead.
• Email accounts can be used for 7 days without verifying the email address; after that, the email must be verified to keep signing in.
• Pseudonymous analytics events and crash reports are kept only as long as needed for the purposes above, under our processors' retention settings.
• Upon account deletion, personal data — including wear logs, streaks, badges, and reminder settings — is permanently removed within 30 days.
• Data subject to legal retention obligations (e.g., billing records) is kept for the applicable statutory period.
• Expired session and password-reset tokens are automatically purged daily.

7. Your Rights Under GDPR

If you are in the EEA or UK, you have the following rights:

• Right of access (Art. 15) — obtain a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — request deletion of your data. Use the in-app account deletion feature or see our Delete Account page.
• Right to restriction (Art. 18) — limit how we process your data.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format via the in-app "Download My Data" feature.
• Right to object (Art. 21) — object to processing based on legitimate interests (including product analytics) or for direct marketing.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent.
• Right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at support@scentlyapp.co. We will respond within 30 days at no charge.

8. Automated Decision-Making

Scently uses algorithmic matching to suggest perfumes and Scent Twins based on your preferences. This does not produce legal or similarly significant effects on you. You may contact us to request human review of any recommendation you believe is incorrect.

9. Children

The Service is not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

10. Changes

We may update this notice from time to time. Material changes will be communicated via the app or email, and the "Last updated" date will be revised accordingly.