This policy explains how Whiffscope ("we", "us") processes personal data when you visit our website or use our tools. We comply with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.
1. Who is responsible for your data?
Data controller: the publisher of Whiffscope.
This site is edited on a non-professional basis. The publisher does not publish their name or postal address. Their identity is held by the hosting provider listed below and may only be disclosed upon judicial requisition.
Hosting provider (identity on file): Vercel Inc., 440 N Barranca Ave
Privacy contact: hello@whiffscope.com
We do not have a Data Protection Officer. For privacy questions or to exercise your rights, email the address above.
2. What data we collect
Depending on how you use the site, we may process:
- Email address — when you subscribe to our newsletter waitlist or submit your email to unlock quiz results. We store this in our database; we do not currently send automated emails.
- Signup context — which form or tool you used (e.g. newsletter, Scent DNA quiz) and a consent timestamp
- Quiz data — your quiz answers and generated profile (stored to power shareable result pages; not linked to your email unless you submit it)
- Retailer link click records — which product and retailer you clicked (for internal analytics; we do not currently store a persistent browser identifier)
- Server logs — IP address, browser type, pages visited, and timestamps (processed automatically by our hosting infrastructure)
We do not knowingly collect data from children under 16.
3. Why we process data and our legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Store email signups and unlock quiz results on-site | Email, signup source | Consent — you submit the form voluntarily |
| Deliver and improve quiz tools | Quiz answers, profile slug | Legitimate interest — operating the service you requested |
| Measure outbound link usage | Product slug, retailer, timestamp | Legitimate interest — understanding which content drives purchases |
| Keep the site secure and running | Server logs, IP address | Legitimate interest — security, abuse prevention, uptime |
| Respond to privacy requests | Email and request content | Legal obligation — GDPR compliance |
Where we rely on consent, you may withdraw it at any time by emailing hello@whiffscope.com. Withdrawal does not affect processing that already occurred lawfully.
4. Who receives your data
We share data only with service providers that help us run the site:
- Database hosting: Neon (Databricks Inc.), 160 Spear Street, Suite 1300, San Francisco, CA 94105, United States — this is where email signups and quiz data are stored
- Email delivery: none — we do not use a third-party email provider. Your address stays in our database until you ask us to delete it or we connect a delivery service (this policy will be updated if we do).
- Web fonts: Google LLC (web font delivery via Google Fonts CDN) — your browser may send IP address and user-agent when loading fonts
- Retailers: when you click a buy link, you leave our site. Sephora, Amazon, and other retailers set their own cookies and process data under their policies
We do not sell your personal data. We do not share email addresses with third parties for their marketing.
5. International transfers
Our database host is located in the United States. Transfers rely on appropriate safeguards such as the EU-US Data Privacy Framework (where certified) or Standard Contractual Clauses. You may request a copy of relevant safeguards by contacting us.
6. How long we keep data
- Email signups: until you request deletion
- Quiz profiles: until manually removed or no longer needed for the service (typically retained while the shareable link remains useful)
- Retailer link click logs: up to 24 months, then aggregated or deleted
- Server logs: as determined by our hosting provider (typically 30–90 days)
7. Cookies and similar technologies
Whiffscope does not currently set non-essential cookies on your device. We do not run third-party advertising trackers. If we add analytics (e.g. privacy-friendly, cookieless analytics), we will update this policy and, where required, ask for consent before placing cookies.
Retailer sites you visit via our links may set cookies when you arrive — those are governed by the retailer's policy, not ours.
8. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Restrict or object to certain processing
- Data portability (where applicable)
- Withdraw consent at any time (for consent-based processing)
- Lodge a complaint with a supervisory authority
To exercise any right, email hello@whiffscope.com with the subject line "Privacy request". We respond within one month.
Supervisory authority: CNIL — Commission nationale de l'informatique et des libertés (France). EU residents may also complain to the authority in their country of residence.
9. Security
We use industry-standard measures including encrypted connections (HTTPS), access controls on our database, and minimal data collection. No method of transmission over the internet is 100% secure.
10. Changes to this policy
We may update this policy when our practices change. The "Last updated" date at the top reflects the current version. Material changes will be posted on this page.
See also: Legal Notice · Terms of Use