Privacy Policy
Effective Date: February 19, 2026 · Last Updated: October 29, 2026 · Türkçe KVKK Aydınlatma Metni
At ScentWise ("we," "our," or "us"), we respect your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using our website at scent-wise.com (the "Service"), you agree to the practices described here.
Who is responsible: ScentWise is operated by Kerem Toker as an individual, who is the data controller (veri sorumlusu under Turkish law no. 6698, "KVKK") for the processing described here. Contact: scentwise.com@gmail.com. Visitors in Turkey can read the KVKK notice in Turkish at /kvkk.html.
1. Information We Collect
We collect the following information to provide and improve the Service:
— IP address: Used for rate limiting, free trial tracking, abuse prevention, and user profile identification (for free users). Stored in our server infrastructure (Upstash Redis) with automatic expiration.
— Purchase details: Order ID, customer ID, and email address from Lemon Squeezy when you purchase Premium. Email is stored in your authentication cookie.
— Email address (free-pick unlock and newsletter): To unlock two more free AI picks you enter your email. Unlocking does not subscribe you to anything: unless you also tick the separate, optional newsletter box, the address is not stored and we send you nothing. If you tick the box, we record your opt-in (email, time, source and the wording you agreed to) in our database (Upstash Redis) and pass your email to our newsletter provider (Beehiiv), which sends occasional fragrance guides and offers. Unsubscribe any time via the link in any email or by emailing scentwise.com@gmail.com.
— AI inputs: Text queries and uploaded photos sent to our AI features. These are sent to Google's Gemini API for processing. Google may retain this data for up to 30 days for abuse detection per their policies.
— Scent profile data: Your fragrance preferences (liked/disliked notes, favorite brands, occasions, skin chemistry, etc.) are automatically extracted from your AI interactions and stored in our database to personalize future recommendations. See Section 5 for retention details.
— Analytics data: With your consent we use Google Analytics (GA4), which sets cookies to measure page views and usage. Without consent, Google Analytics is not loaded at all and nothing is sent to Google. We also use Plausible, Vercel Web Analytics and Speed Insights, which are cookieless and do not identify you.
— Advertising data: Google AdSense shows ads on the site. AdSense is loaded only after you accept advertising cookies; without that consent no AdSense script loads and no ads are shown. With your consent for advertising cookies, the TikTok pixel and, after a purchase, TikTok's server-side Events API (hashed email, IP address, browser user agent) measure ad conversions. Without that consent nothing is sent to TikTok. See Section 2.
We do not collect names, physical addresses, or phone numbers beyond what is listed above. We do not use browser fingerprinting.
2. Cookies We Use
ScentWise uses the following categories of cookies:
Essential cookies (required for the Service to function):
| Cookie | Purpose | Duration |
|---|---|---|
sw_free | Tracks free trial query count for anonymous users | 32 days |
sw_device | Device-bound identifier used to enforce free trial limits across browsers and incognito windows | 32 days |
sw_email | Marks that the user has shared their email to unlock extended free recommendations | 32 days |
sw_sub | Authenticates premium subscribers | 30 days |
sw_usage | Tracks monthly query count for premium users | 32 days |
sw_owner | Authenticates site administrators | 30 days |
sw_revalidated | Throttles subscription re-verification checks | 24 hours |
Our essential cookies are HttpOnly (inaccessible to JavaScript), SameSite=Lax, and Secure (HTTPS-only in production). Each cookie is cryptographically signed with HMAC-SHA256 to prevent tampering.
Analytics cookies (used to understand how visitors use the site):
| Provider | Purpose | More Info |
|---|---|---|
| Google Analytics (GA4) | Page views, user engagement, traffic sources. Sets persistent cookies (_ga, _ga_*) for visitor identification. | Google Privacy Policy |
| Vercel Analytics | Web vitals and performance monitoring. No personally identifiable information collected. | Vercel Analytics Privacy |
Advertising cookies (used to display relevant ads):
| Provider | Purpose | More Info |
|---|---|---|
| Google AdSense | Displays personalized ads. Sets cookies for ad targeting, frequency capping, and behavioral profiling across websites. | Google Ads Privacy |
You choose in the cookie banner shown on your first visit (Accept all / Statistics only / Essential only). Google Analytics loads only after you accept statistics cookies, and Google AdSense only after you accept advertising cookies; before you choose, no request is made to Google. Fonts are served from our own domain, so loading a page does not send your IP address to Google Fonts. You can change your choice by clearing this site's data in your browser, and opt out of Google's personalised ads at Google Ad Settings.
3. How We Use Your Information
We use the information we collect to:
— Provide and improve the Service, including AI-powered fragrance recommendations personalized to your scent profile.
— Build and maintain your scent preference profile for increasingly personalized recommendations.
— Enforce usage limits and prevent abuse (rate limiting, free trial enforcement).
— Process and verify subscription payments through Lemon Squeezy.
— Send a periodic fragrance newsletter, only if you ticked the separate opt-in box. Legal basis: your consent (GDPR Art. 6(1)(a); KVKK m.5/1; Turkish law no. 6563 m.6). Withdraw it at any time via the unsubscribe link in any email.
— Analyze usage patterns and site performance to improve the Service.
— Display relevant advertisements via Google AdSense.
— Respond to your support inquiries.
4. Data Sharing
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share data with the following service providers, strictly as needed to operate the Service:
— Google (Gemini API): Processes AI queries. Your text queries, uploaded photos, and scent profile data are sent to Google's Generative AI API for processing. Subject to Google's Privacy Policy and Generative AI Terms.
— Google Analytics & AdSense: Collects analytics and advertising data. Subject to Google's Privacy Policy.
— Lemon Squeezy: Processes subscription payments and stores billing details. Subject to Lemon Squeezy's Privacy Policy.
— Vercel: Hosts the Service and provides analytics/speed insights. Subject to Vercel's Privacy Policy.
— Upstash: Provides server-side data storage (Redis) for rate limiting, usage tracking, and user profiles. Subject to Upstash's Privacy Policy.
— Amazon Associates: Affiliate product links. Clicking "Shop on Amazon" links may set Amazon tracking cookies. Subject to Amazon's Privacy Notice.
— Beehiiv: Newsletter delivery, only for people who ticked the newsletter opt-in box. Subject to Beehiiv's Privacy Policy.
— TikTok: Ad conversion measurement, only with your consent to advertising cookies. Subject to TikTok's Privacy Policy.
— Plausible: Cookieless, aggregate page statistics. No personal data is stored. Subject to Plausible's Privacy Policy.
— Brave Search, Unsplash: Perfume image lookups. Only the perfume name is sent, never data about you.
5. Data Retention
We retain data only as long as necessary:
— Scent profile data: Stored for up to 1 year from your last interaction. Includes your fragrance preferences, liked/disliked notes, and AI recommendation history. You can delete your profile at any time from the Settings menu or by contacting us.
— AI inputs (text and photos): Not stored on our servers beyond the request. Google may retain data for up to 30 days per their API terms.
— Cookies: Expire automatically as listed in Section 2 above.
— Purchase data: Retained while your Premium access is active and for a reasonable period afterward for billing purposes.
— Free trial usage data: IP-based usage records are stored in Redis with a 33-day automatic expiration.
— Newsletter opt-in: Stored with Beehiiv until you unsubscribe. The opt-in record (email, time, wording) is kept in Redis for 4 years from opt-in, because Turkish law requires consent records to be kept for 3 years after consent ends. An unlock without newsletter consent stores no email at all. Email us at scentwise.com@gmail.com to have your email removed from all systems.
— Rate-limit data: Automatically purged after 10 minutes (in-memory) or at end of the rate-limit window.
6. Your Rights
Depending on your jurisdiction, you may have the following rights:
For all users:
— Access the personal data we hold about you.
— Request deletion of your data (including your scent profile — use the "Reset Profile" option in Settings, or contact us).
— Withdraw consent for analytics and advertising cookies at any time via the cookie consent banner or by clearing cookies in your browser.
— Object to processing of your data.
For EU/EEA residents (GDPR):
— Right to data portability.
— Right to restrict processing.
— Right to lodge a complaint with your local data protection authority.
— We process your data on the basis of: (a) consent for analytics and advertising cookies, (b) legitimate interest for security and abuse prevention, and (c) contract performance for subscription services.
For residents of Turkey (KVKK):
— You have the rights in Article 11 of law no. 6698 (to learn whether your data is processed, request information, learn the purpose, know the recipients in Turkey and abroad, request correction or deletion, object to automated decisions, and claim compensation). See the full KVKK Aydınlatma Metni for how to apply. You may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) if we refuse or do not answer within 30 days.
For California residents (CCPA/CPRA):
— Right to Know: You may request details about the categories of personal information we collect, the purposes for collection, and the categories of third parties with whom we share it.
— Right to Delete: You may request deletion of your personal data. Use the "Reset Profile" option or contact us.
— Right to Opt-Out of Sale: We do not sell your personal information in the traditional sense. However, the use of Google AdSense may constitute a "sale" or "sharing" under CCPA. You can opt out of personalized ads via Google Ad Settings or by declining advertising cookies in our consent banner.
— Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
To exercise any of these rights, contact us at scentwise.com@gmail.com. We will respond within 30 days (45 days for complex CCPA requests).
7. International Data Transfers
Our service providers (Vercel, Upstash, Google, Lemon Squeezy and, where you consented, Beehiiv and TikTok) process data in the United States and other countries outside Turkey and the EU. For EU/EEA users we rely on the providers' Standard Contractual Clauses or the EU–US Data Privacy Framework where applicable. For users in Turkey, transfers abroad are made under KVKK Article 9: on the basis of your explicit consent for cookies, analytics and advertising, and because they are necessary to perform the contract for hosting, payment and AI processing. Details are in the KVKK notice.
8. Security
We implement industry-standard security measures to protect your data, including HMAC-SHA256 signed cookies, HTTPS enforcement, Content Security Policy headers, CSRF protection, rate limiting, and timing-safe token comparisons. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
9. Data Breach Notification
In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities as required by applicable law (within 72 hours under GDPR). Notification will be provided via email (for subscribers) or through a notice on the Service.
10. Children's Privacy
ScentWise is not intended for users under 16 years of age. We do not knowingly collect information from children under 16 (or under 13 under COPPA). If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Service and, where required, we will seek renewed consent. The "Last Updated" date at the top indicates when this policy was last revised. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
12. Contact
If you have questions about this Privacy Policy or how we handle your data, please contact us at scentwise.com@gmail.com.