Privacy Policy

ThePerfumeAlchemist ("we", "the Platform") at theperfumealchemist.com is a perfume e-commerce and community platform. This policy explains how we collect, use, and protect your personal data in compliance with GDPR (EU), CCPA/CPRA (California), and applicable data protection laws.

• Account: name, username, email, profile photo, role (customer/perfumer/brand/admin).
• Purchases: order history, shipping address, payment method (processed by gateway; we do not store card data).
• UGC content: reviews, forum posts, quiz results, recommendations.
• Preferences: currency, notifications, wishlist, favorite brands.
• Device: push notification ID (OneSignal), IP, user-agent, cookies.
• Authentication: Supabase Auth (email/password or Google OAuth).

• Consent: push notifications, marketing, non-essential cookies.
• Contract: product purchases, brand/perfumer services.
• Legitimate interest: security, fraud prevention, aggregate analytics.
• Legal obligation: transaction retention for tax/audit.

• Processing orders, shipping, and payments.
• Providing AI-based perfume recommendations and quizzes.
• Running forums, events, and perfume courses.
• Sending push notifications and transactional/marketing emails.
• Moderating content per community standards.
• Improving the Platform via analytics and feedback.

• Supabase — database & auth (GDPR-compliant, optional EU region).
• OneSignal — push notifications.
• Brevo — email marketing.
• Payment gateway — payment processing (PCI-DSS compliant).
• Cloudflare — hosting & CDN.
• Meta / Google Ads — advertising (when you click our ads; data shared per platform policy).

We do not sell your personal data to third parties.

Account data is kept while the account is active. Transaction data is stored for 10 years for tax compliance. After account deletion, other personal data is removed within 30 days except where retention is required by law.

• Access & copy of your data.
• Rectification of inaccurate data.
• Account deletion (right to erasure) — see Settings page.
• Data portability (JSON format).
• Objection to marketing processing.
• Withdrawal of consent at any time.
• "Do Not Sell or Share My Personal Information" (CCPA) — email privacy@theperfumealchemist.com.

To exercise these rights, contact privacy@theperfumealchemist.com. We respond within 30 days (GDPR) / 45 days (CCPA).

We use TLS encryption, Supabase RLS, restricted service-role keys, and role-based admin access. Payments are processed by a PCI-DSS certified payment gateway.

Data may be processed outside your country (e.g., EU). We rely on vendor Standard Contractual Clauses (SCCs) or equivalent frameworks (EU-US Data Privacy Framework) for lawful transfers.

This platform is intended for users aged 13+. We do not knowingly collect data from children under 13.

We will notify you of material changes via email or in-app notification at least 30 days before they take effect.

Email: privacy@theperfumealchemist.com. For EU users, you may lodge a complaint with your local data protection authority.