Privacy Policy

1. Scope and contact

Haystack Group LLC, operating ScentCompass ("we," "us," or "our"), is responsible for the personal information described in this Privacy Policy. This policy applies to the ScentCompass website and related services that link to it (the "Services"), communications with us, and related business activities. Where applicable law uses the term, we are the controller of this information.

"Personal information" means information that applicable law treats as relating to, identifying, or reasonably capable of being linked to a person or household. An identifier does not stop being personal information merely because it does not contain a name.

Contact privacy@scentcompass.com about this policy or a privacy request. Our mailing address is:

This policy provides information about our practices; it does not treat visiting the site or accepting our Terms as consent where separate consent is required.

2. Information we collect and why

The information involved depends on how you interact with us and the features you use. We do not necessarily retain every item our systems receive. This section is our notice at collection: it identifies the categories, purposes, and retention periods or criteria. We do not currently sell any of these categories or share them for cross-context behavioral advertising. Section 5 describes recipients, Section 6 explains sale and advertising practices, and Section 7 provides further retention details.

Identifiers and technical information

We and the providers that deliver the Services receive information such as IP addresses, browser and device information, browser-associated identifiers, request times, requested pages or resources, and technical or security information. Approximate location, such as country, may be derived from a connection. We use this information to deliver and configure the Services, maintain saved features, diagnose problems, protect systems, prevent misuse, and evaluate performance. We do not request precise device location through ordinary fragrance features.

Retention: saved-feature cookies last up to 365 days, but their server association ends after 30 days of inactivity or 365 days from creation, whichever comes first. Setup cookies last up to 10 minutes; specified temporary abuse counts last up to three hours. Other technical records are kept for the period needed to diagnose reliability issues, identify recurring misuse, resolve incidents, and satisfy applicable legal requirements.

Activity, preferences, and Contributions

When you use relevant features, we receive searches, fragrance selections, saved items, lists, ratings, and wear-log information. A wear entry may include a fragrance, date, setting, weather, sprays, rating, and any note you choose to add. When you first save a fragrance, mark one Want to sample, or log a wear, we also keep a record of which version of the Terms you agreed to and when, with your saved items, and delete it with them. Information retained from an earlier feature is subject to this policy and any continuing restrictions attached to its original collection.

We use this information to supply the features you request and, as described in Section 3, to understand preferences, evaluate results, conduct research, and develop and improve our products and technologies. We may derive inferences about fragrance interests and preferences. These are estimates, not established facts about you.

Retention: browser-linked records and inferences are removed when you clear the associated data or the browser association expires as described above. Detailed wear and interaction history is also subject to the 365-day creation or linked-activity limits in Section 7. A search recorded in an operational log follows the technical-record criteria. Properly aggregated or deidentified outputs may be kept without a fixed period.

Contact information and communications

If you contact us, submit a rights request, or enter into a business relationship with us, we receive the contact details, correspondence, business information, supporting materials, and other information you provide. Depending on the interaction, this can include a name, email or mailing address, telephone number, professional role, and records needed to verify a request. We use it to respond, administer the relationship or request, keep appropriate records, improve our operations, and meet legal obligations.

Retention: for the duration of the relationship or matter and then as needed to document its resolution and meet applicable recordkeeping, consent-evidence, or legal-claim periods. Unneeded information is removed or deidentified.

Information received from others

We may receive personal information from service providers, business counterparties, people communicating with us, and publicly available sources. This may include names, contact or professional information, identifiers, and statements or opinions relevant to the Services or a business matter. For a person who reviews fragrances publicly, it can also include profile details shown with their reviews, such as a stated sex, which we keep internally with the reviews and never show publicly. We use it for the relevant service, research, communication, verification, security, or legal purpose described in this policy, and may combine it with related information we lawfully hold. We provide additional source information or notices where applicable law requires them.

Retention: according to continuing relevance to the stated purpose, reasonable update needs, applicable recordkeeping requirements, and any applicable objection or deletion rights.

Sensitive information

Ordinary fragrance features do not ask you to provide medical information, government identification numbers, financial-account credentials, precise location, or other sensitive personal information. Do not put that information, or another person's private information, in searches, notes, or messages unless it is necessary for a specifically requested and appropriately explained interaction.

If you nevertheless provide sensitive information, we handle it only as necessary to respond to that interaction, maintain security, comply with law, or for another purpose specifically permitted by applicable law. We do not use unsolicited sensitive information to infer sensitive characteristics or to train general-purpose models. A request not to submit sensitive information does not remove our legal obligations if we receive it. Retention follows the relevant category above and is limited to what the permitted purpose and applicable law require.

3. How we use information

Provide and personalize the Services

We use relevant identifiers, activity, preferences, Contributions, and communications to deliver pages, respond to searches, maintain saved information, supply requested features, and, where available, personalize content or recommendations. Some features associate information with a browser rather than an account. We may infer fragrance preferences from choices and ratings to help select relevant information.

Evaluate, research, and develop

We may use relevant Contributions, activity, preference inferences, technical information, and product feedback to measure quality, diagnose errors, conduct experiments and research, evaluate outcomes, and develop and improve products, services, and related technologies. This can include developing, training, testing, and improving statistical and artificial-intelligence systems. Resulting technologies and non-personal insights may be incorporated into products or licensed commercially.

This description does not mean that every record is used for every development purpose. Use of personal information remains subject to the applicable legal basis, the circumstances and notice under which it was collected, your applicable choices, and any consent required by law. It does not authorize an unrelated third party to take private information for that party's independently chosen purposes.

Operate and protect our business

We use relevant information to administer the Services and our business relationships, respond to communications and rights requests, detect and prevent abuse or security incidents, troubleshoot, enforce agreements, resolve disputes, establish or defend legal claims, and comply with law. We may also process information in connection with the transactions described in Section 5.

Communicate with you

We use contact details and relevant records for service-related messages and responses. If you choose to receive marketing communications, or applicable law otherwise permits them, we may send information about our products, services, and offers. You can opt out of marketing email using the message's unsubscribe method or by contacting us. Service and legal communications may still be necessary.

Create and commercialize non-personal information

We may aggregate or deidentify information so it is no longer personal information under applicable law. We may retain, use, publish, combine, license, sell, or otherwise disclose that non-personal information for lawful purposes, including research, analytics, model development, market insights, and commercial products.

We take reasonable measures designed to prevent deidentified information from being associated with an individual or household, maintain it in deidentified form, and do not attempt to reidentify it except for testing permitted by law. We contractually require recipients of deidentified information to comply with applicable non-reidentification and protection requirements. Information that remains identifiable or reasonably linkable, including a model that contains recoverable personal information, remains subject to applicable privacy obligations.

4. Cookies, browser-linked features, and external resources

Cookies and similar technologies help deliver the Services, maintain features you request, and protect against misuse. They can associate activity with a browser even when we do not know your name.

Saved-feature cookies. A short-lived setup cookie can last up to 10 minutes. It is set only when you first save a fragrance, mark one Want to sample, or log a wear, never when you only view a page. A cookie used for saved fragrances and wear information can last up to 365 days. The server-side association currently ends after 30 days of inactivity or 365 days from its creation, whichever occurs first. A cookie can therefore remain in your browser after it stops providing access to information.

Security and delivery. The providers that deliver and protect the Services process connection and request information and may use security-related storage or access technologies when providing those functions. We do not use advertising or third-party behavioral-analytics cookies on the current Services. Before introducing technology requiring consent or an objection mechanism, we will provide the applicable information and controls.

External resources. Where a page loads a resource directly from another provider, your browser sends that provider the connection information needed to supply it. A third-party resource's own processing is not made anonymous by our use of browser-linked features.

You can block or remove cookies through your browser, but doing so may prevent features from working. To delete the information associated with the saved-feature identifier, use Clear device data on My picks before deleting the cookie. Clearing a browser cookie alone does not send a deletion request for information already stored on our systems. Without the identifier, we may be unable to locate or verify those records, which remain subject to their retention periods.

5. When information is disclosed

Service providers. We disclose information as needed to providers supporting hosting, storage, content delivery, security, communications, technical support, and other operations. Where used for the purposes described here, this can include analytics and artificial-intelligence processing providers. Providers acting on our behalf are subject to appropriate contractual restrictions; appointing a provider is not permission for unrestricted independent use.

Our organization and advisers. Relevant personnel, affiliates supporting the purposes in this policy, professional advisers, insurers, and auditors may receive information as reasonably necessary for their roles.

Your choices. We disclose information when you direct us to do so or give legally valid authorization. If a feature expressly allows public posting and you choose it, the information you publish and the public attribution you supply can be seen and reused by others. We do not publish your private notes, saved items, or browser-linked activity as identifiable user content merely because you use those features.

Legal and protective purposes. We may disclose information to comply with law or valid legal process, respond to lawful government requests, establish or defend claims, enforce agreements, investigate wrongdoing, or protect rights, safety, and security, where legally permitted. This can include necessary information exchanged when handling a rights complaint.

Business transactions. Information may be disclosed to relevant counterparties and advisers, subject to appropriate safeguards, in connection with an actual or proposed financing, investment, merger, acquisition, reorganization, sale of assets, insolvency proceeding, or transfer of all or part of our business. A successor's handling of personal information remains subject to applicable law and the commitments that law requires it to honor.

Third-party websites you choose to visit operate under their own privacy notices. Merely linking to a retailer does not give that retailer unrestricted access to your private saved information. Disclosures of non-personal information are addressed in Section 3.

6. Sales, targeted advertising, and browser signals

Current practices. We do not sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising as those activities are defined by applicable US state privacy laws. We have not done so during the preceding 12 months, or since the Services began operating if that period is shorter. We do not knowingly sell or share personal information of individuals under 16.

Commercializing information that actually qualifies as aggregated or deidentified under the relevant law is different from selling personal information. Paying a provider to process information on our behalf also does not, by itself, describe every element needed to determine whether a disclosure is legally a sale or sharing.

We may change our offerings and business practices. Before beginning a materially different use, sale, or advertising-related disclosure of personal information, we will give the notices, obtain the consents, and provide the opt-out mechanisms required by applicable law. A revision to this policy does not, by itself, authorize a use inconsistent with a binding earlier commitment.

We process legally recognized opt-out preference signals, such as Global Privacy Control, when and as applicable law requires. Under our current no-sale and no-targeted-advertising practices, there is no such activity for the signal to stop. Ordinary "Do Not Track" browser settings do not currently change our practices. You may still submit an applicable privacy request using the contact methods in this policy.

7. Retention and deletion

We keep personal information for the period reasonably necessary for the purposes for which it is processed, subject to applicable law, your valid requests, and specific commitments. Different information has different retention rules.

Browser-linked saved information. Saved fragrances, wear records, and associated private histories are removed when you use Clear device data or when their browser association expires. That association currently expires after 30 days of inactivity or 365 days from creation, whichever comes first. An ordinary wear entry also expires 365 days after it is created. Where an entry is part of a related interaction history, that history expires no later than 365 days after its most recent linked activity. The earlier browser-association deletion rule still applies.

Short-lived abuse-prevention records. The temporary request counts used for certain data-changing actions are kept for up to three hours. Other security or incident records are subject to the technical- and legal-record criteria below.

Technical and operational records. Retention depends on the period needed to investigate errors, establish service reliability, identify recurring misuse, and resolve security incidents, taking into account the event's seriousness and any applicable legal requirements. We do not retain routine logs indefinitely merely because storage is available.

Communications and business records. Retention depends on how long a relationship, request, dispute, or obligation remains active, the need to document its handling, and applicable recordkeeping or limitation periods. Unneeded personal details are removed or deidentified.

Legal, consent, and request records. We may retain limited information necessary to document permissions, comply with applicable request-record requirements, preserve evidence, satisfy legal obligations, or establish or defend claims for the relevant legal period. This is not a general exception allowing unrelated continued use of deleted information.

Backups. Information removed from active systems may remain in restricted backups until they expire or are overwritten in the normal backup cycle, where applicable law permits. Such copies are not used for ordinary product development or marketing.

Deletion from an active browser-linked feature does not necessarily delete a separate email you sent, a legally required request record, or a backup awaiting expiry. Non-personal information may be retained without a fixed period if it continues to meet the applicable aggregation or deidentification requirements. We do not preserve personal information indefinitely simply by labeling it a model, statistic, or derived record.

8. Your choices and rights

Requests and browser controls

Use Clear device data on My picks to delete the active private records associated with your browser. You can also write to privacy@scentcompass.com or our mailing address with a request or question. You do not need to create an account to make a privacy request.

Depending on your location and the law applicable to the processing, you may have rights to confirm whether we process personal information about you; access or obtain a copy of it; learn about its categories, sources, purposes, and recipients; correct inaccuracies; request deletion; receive portable information; restrict processing; withdraw consent; and opt out of sale, targeted advertising, or certain profiling or automated decision-making. Some laws also provide a right to identify specific third parties receiving your information or limit particular uses of sensitive information.

We may request information reasonably necessary to locate the records and verify your identity or authority, using a method proportionate to the request. Do not email passwords, complete authentication-cookie values, or unrelated sensitive records. We are not required to collect new identifying information solely to identify an otherwise unidentifiable record, but we will consider additional information you voluntarily provide where the law requires it. We protect other people's rights and may apply lawful exceptions.

You may use an authorized agent where applicable law permits. We may request proof of authorization and any verification allowed by law. We will not unlawfully discriminate or retaliate against you for exercising your rights. We do not require account creation or unnecessary identity verification for an opt-out that applicable law does not make subject to those requirements.

We respond within the period required by applicable law. Many US state access, correction, and deletion requests have a 45-day response period; requests under EU or UK data-protection law generally have a one-month period. Shorter periods apply to some requests, including certain opt-outs. Permitted extensions may apply, and we provide any required explanation.

Appeals and complaints

If we deny a request, we will explain the decision as required. Where you have a right to appeal, you can reply to the decision or contact privacy@scentcompass.com, identifying the request and why you seek review. We will address the appeal within the applicable legal period and provide any required information about further recourse. You may also complain to your state attorney general or other competent privacy regulator.

Objection to legitimate-interest processing and marketing

Where EU or UK data-protection law applies, you may object to processing based on legitimate interests on grounds relating to your particular situation. You may object at any time to processing for direct marketing, including related profiling. Contact privacy@scentcompass.com. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

9. Additional information for US residents

For applicable state-law disclosures, the information described in Section 2 falls into categories including identifiers; internet or other electronic-network activity; commercial information such as products considered and preferences; inferences about interests; correspondence and other content you provide; contact information of the kinds described in California Civil Code section 1798.80; professional information where relevant to a business interaction; and characteristics of protected classifications, limited to a sex stated on a public reviewer profile. An unsolicited submission may contain another legally defined category, including sensitive information, which is handled as described above.

During the preceding 12 months, or since operations began if shorter, the categories actually involved in your interactions have been collected from the sources and for the purposes described in Sections 2 and 3 and disclosed, as applicable, to the recipient categories described in Section 5. Identifiers, technical information, activity, Contributions, and related inferences are handled by relevant operational providers; contact and communication records are handled by communications providers and, where relevant, advisers or parties addressing the matter. Any category may be disclosed for a legally applicable protective purpose or business transaction described in Section 5. We do not imply that every category has been disclosed to every type of recipient.

No category has been sold or shared for cross-context behavioral advertising during that period. We do not use or disclose sensitive personal information for the purpose of inferring sensitive characteristics or for purposes that require us to offer a California right to limit under our current practices. These are descriptions of current practices, not waivers of your rights or substitutes for an updated notice when practices change.

The rights and request methods in Section 8 apply where the relevant law covers the processing. Inquiries concerning a California disclosure requirement, including applicable direct-marketing disclosures, may also be sent to privacy@scentcompass.com.

10. Additional information for Europe and international processing

Legal bases

Where EU or UK data-protection law applies, we use the following legal bases for the corresponding activities:

• Contract: processing objectively necessary to provide a feature or service you request under an agreement with us, such as maintaining requested saved information or handling a paid offering. General product research or model training is not treated as contractually necessary merely because it appears in our Terms.
• Legitimate interests: proportionate site delivery where no contract applies, service security, preventing abuse, troubleshooting, business administration, responding to ordinary inquiries, and appropriately assessed analytics, research, personalization, and product or model development. The interests are operating and improving useful services, maintaining a viable business, protecting systems and rights, and understanding product performance. We rely on this basis only where the relevant processing is necessary and those interests are not overridden by your interests or fundamental rights.
• Consent: optional technologies, marketing, sensitive-information processing, or other processing where consent is required and obtained. You may withdraw consent through the available control or by contacting us.
• Legal obligations: processing necessary to comply with requirements that apply to us, including appropriate records and responses to lawful requests. Where another narrowly applicable legal basis is needed for a specific situation, we identify it as required by law.

Providing information is generally voluntary. Without information necessary to respond to a request or deliver a feature, we may be unable to do so. If providing particular information is a legal or contractual requirement, we explain that in the relevant context.

Routine fragrance-related personalization is not a decision with legal or similarly significant effects. We do not use the Services to make solely automated decisions about you that produce such effects. If that changes, any additional information and safeguards required by law will apply before the relevant processing.

International processing

We operate from the United States. Information may be processed in the United States and other countries where our providers or relevant business operations are located. Those countries may have different data-protection laws.

Where a transfer is subject to restrictions under applicable law, we rely on an applicable adequacy decision or appropriate contractual or other lawful safeguards. These may include the European Commission's standard contractual clauses and the relevant UK transfer instrument, with additional protections where required. We do not claim that participation in a certification program or a particular transfer agreement applies unless it actually does. Contact privacy@scentcompass.com for information about safeguards applicable to your information or an available copy, subject to lawful redactions.

Regulatory complaints

You may complain to the data-protection authority where you live or work or where an alleged infringement occurred, as applicable. In the United Kingdom, that is the Information Commissioner's Office. In Switzerland, you may contact the Federal Data Protection and Information Commissioner. Applicable Swiss rights are also available even where their legal terminology differs from the examples above.

11. Security

We use administrative, technical, and organizational measures appropriate to the information and risks involved. Access to a browser-linked feature does not mean the information is end-to-end encrypted or inaccessible to authorized personnel and providers. No method of transmission or storage is completely secure. A security disclaimer does not remove our legal duties to protect information or provide required incident notifications.

12. Children

The Services are intended for adults aged 18 and over, not children. We do not knowingly solicit personal information from children or knowingly collect personal information from children under 13. If you believe a child has provided information contrary to this policy or applicable law, contact privacy@scentcompass.com. We will take the steps required by law, including deleting information where required. Stating an age limit does not replace any applicable duties concerning children's information.

13. Changes to this policy

We may update this policy as our practices, offerings, or legal obligations change. We will show the new effective date and provide additional notice of material changes where required. Before a materially different use of personal information, we will obtain consent or take other steps when the law or a binding earlier commitment requires them. A policy update does not automatically authorize retroactive use of previously collected information.

14. Contact

Haystack Group LLC, operating ScentCompass

Privacy questions, requests, and appeals: privacy@scentcompass.com
Other legal questions: legal@scentcompass.com