OLFACTRA
Privacy Policy
Draft content for legal review — not final. Last updated August 27, 2026.
1. Scope and operator details
This Privacy Policy applies to the Olfactra website, applications, and related services. In this draft, “Olfactra,” “we,” “us,” and “our” refer to the operator of the Olfactra service. The operator's full legal name, business address, privacy contact email, and applicable jurisdiction must be inserted and confirmed during legal review.
2. Information we collect
We collect information that you provide, information created through your use of Olfactra, and limited technical information needed to operate and improve the service.
- Account information. When you register or sign in through an authentication provider, we may receive your email address, display name, provider-specific account identifier, sign-in method, and basic profile information authorized by you. Authentication may involve Clerk and OAuth providers such as Google or Apple.
- User-created content. We store formulas, ingredient libraries, weights, notes, scent concepts, prompts, generated results, samples, feedback, workspaces, uploaded documents, images, brand settings, and other content you choose to create or submit.
- Subscription and transaction information. We maintain subscription tier, status, billing interval, transaction references, and related account entitlements. Stripe processes payment-card and checkout information; Olfactra does not intentionally store your complete payment-card number.
- Communications. We may retain support requests, account notices, and transactional email records needed to respond to you and operate the service.
- Technical and usage information. We may collect device and browser information, IP-derived information, pages viewed, interactions, diagnostic logs, and security events.
3. How we use information
We use information to create and secure accounts, provide formulation and collaboration features, save and retrieve your work, process subscriptions, generate requested AI-assisted content, send service communications, prevent abuse, diagnose errors, improve performance, and comply with legal obligations.
We may also use aggregated or de-identified information to understand feature adoption and improve Olfactra, provided that the information is not reasonably used to identify you.
4. AI processing and Google Gemini
Olfactra sends user-submitted prompts and relevant context to a third-party model provider. When you use an AI-assisted feature, the text you submit—and, where necessary, related formula, ingredient, product, or document context—is transmitted to Google's Gemini service for processing. Google returns generated text, structured data, analysis, or images that Olfactra displays or stores for you.
Do not submit confidential personal information, trade secrets, or third-party data that you are not authorized to disclose. Third-party model processing, retention, location, and potential use of submitted data are governed by the applicable Google service terms, privacy terms, and the configuration of Olfactra's Google account. Legal review must confirm that those terms and settings are accurately reflected here before publication.
AI outputs may be inaccurate, incomplete, or unsuitable for a particular purpose. Human review is required before relying on generated content, especially for safety, IFRA, regulatory, manufacturing, or commercial decisions.
5. Service providers and disclosures
We disclose information to vendors that process data on our behalf only as reasonably necessary to provide, secure, support, or improve the service. Current service categories include:
- Authentication providers, including Clerk and connected OAuth providers, to register users and verify sessions.
- Google Gemini, to process prompts and related context for AI-assisted features.
- Stripe, to process payments, subscriptions, and billing events.
- Resend, to deliver transactional and operational email.
- Hosting, database, and object-storage providers, to run Olfactra and retain account and user-created content.
- Analytics, security, and diagnostic providers, where enabled, to measure use and detect errors or abuse.
We may also disclose information when required by law, to protect users or the service, in connection with a corporate transaction, or with your direction or consent. This draft does not authorize selling personal information, but legal review must confirm and describe any jurisdiction-specific “sale,” “sharing,” or targeted-advertising practices.
6. Data retention and deletion
We retain account information and user-created content while your account is active and as reasonably necessary to provide the service, maintain backups, resolve disputes, prevent fraud, enforce agreements, and satisfy legal or accounting obligations. Different record types may have different retention periods.
Account closure or deletion requests may not immediately remove information from backups, legal records, transaction records, or systems where retention is required. Specific retention periods, backup deletion timelines, and the account-deletion process must be confirmed during legal review.
7. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect information. No transmission, model-provider request, database, or storage system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. You are responsible for protecting your sign-in methods and notifying us of suspected account compromise.
8. Your choices and privacy rights
Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to certain processing of personal information, or to withdraw consent where consent is the legal basis. You may also manage connected sign-in methods and billing through the relevant provider.
Users should send privacy requests to support@olfactra.ai and identify the request as a privacy request.
9. Cookies and similar technologies
Olfactra and its authentication, payment, and analytics providers may use cookies, local storage, and similar technologies to maintain sessions, remember settings, protect accounts, complete checkout, and understand service use. Legal review must determine whether a consent banner or additional regional disclosures are required.
10. International processing
Olfactra and its service providers may process information in countries other than your own. Those countries may have different privacy laws. Legal review must confirm the operator's location, processing locations, and any required international-transfer safeguards.
11. Children's privacy
Olfactra is not directed to children under 13, or a higher minimum age where required by local law. We do not knowingly collect personal information from children in violation of applicable law. The appropriate age threshold and parental-consent process must be confirmed for the jurisdictions in which Olfactra will be offered.
12. Changes and contact
We may update this policy as Olfactra, its providers, or applicable law changes. Material updates should be communicated through the service or another appropriate channel. The final policy must state when changes become effective.
Questions may be sent to support@olfactra.ai. The final policy must state the operator's legal name, mailing address, and any required data-protection representative or regulator contact.