Privacy Policy

Privacy is important to us. This document explains what personal data we collect in connection with your use of the Scenza application and related services, why we collect it, the legal basis for processing and the parties to whom it may be entrusted. This Policy forms an integral part of the Terms of Service.

§1. Data controller

1. The controller of your personal data within the meaning of Regulation (EU) 2016/679 (the GDPR) is:

Controller

Karol Walęcki

Registered office

ul. Plac Wolności 10/4, 26-220 Stąporków, Polska

Correspondence address

ul. Szpakowa 10/128, 30-691 Kraków, Polska

Tax ID (NIP)

7792448486

Contact

info@scenza.pl

Given the nature and scale of the processing, we have not appointed a Data Protection Officer. For all privacy matters, please contact the Controller at the email address above.

§2. Definitions

Capitalised terms such as Application, User, Account, Premium Plan and App Store have the meanings given in the Terms of Service.

§3. Categories of data collected

3.1. Data provided during registration and use of the Application

• Email registration: email address, password (stored only as a cryptographic hash) and first name.
• Google / Apple login: provider identifier (Google ID / Apple ID), email address, first name, surname, profile picture URL and authentication tokens, to the extent made available by the provider and covered by the consent you give when logging in.
• Profile: first name and gender (female, male or other) are required in profile setup; date of birth and profile picture are optional.
• Fragrance preferences: liked and disliked perfumes, fragrance notes and subcategories, quiz answers and onboarding step.
• User Content: mappings of barcodes to bottles, ratings, wear diary entries (perfume, date, occasion, mood, weather and ratings, and, if provided, a note and city name; these are not GPS coordinates), price alerts, optional quiz descriptions and results inspired by a photo.
• Settings, permissions and allowances: language, marketing choices, AI permission status and version, and the time permission was granted, allowance and bonus usage. When rewarded ads are available, we also record the reward session and its verification.
• Tokens: email verification, password reset and session refresh tokens, processed solely for authentication.

3.2. Data collected automatically

• Technical data: IP address, installation identifiers used for notifications or diagnostics, operating system type and version, Application version and timestamps, as needed by the feature or recorded in logs.
• Diagnostic data: crash events, response delays and error codes, used to maintain Application stability.
• Allowance and Premium offer measurement: aggregate daily counts of requests refused after an allowance is used up and, when the offer is available, offer views, purchase or restore attempts and their outcomes. The Application sends the event type, originating screen or feature, platform, subscription period and outcome. The request is authenticated with the Account, whose identifier is also used for short-lived abuse prevention; we store aggregate counters without account, device or transaction identifiers.
• Account usage history: Account creation date, most recent login and most recent activity.

3.3. Photos, camera and notifications

• EAN scanner: reads the barcode locally on the device. The camera image is not sent to our servers.
• Photo inspiration: after separate permission to use AI, the selected camera or library photo is sent through our API to OpenAI (USA). The model describes the scene and its mood to suggest perfumes. This feature does not identify a bottle or product from the photo. Access covers the selected photo, not your entire library.
• Avatar: the chosen profile photo is stored in Hetzner storage. Re-encoding removes metadata including EXIF/GPS. The avatar has a public file URL; please avoid confidential information in it.
• Notifications: with system permission, Firebase Cloud Messaging delivers alerts, including price alerts. Data includes the installation token, alert content and account, alert and perfume identifiers.

These features do not require precise location or microphone permission. An IP address may nevertheless allow infrastructure or advertising providers to estimate approximate location.

Please do not include special-category data, such as health information, confidential information or other people's personal data in photos or descriptions sent to AI.

§4. Purposes and legal bases for processing

We process your data for the following purposes:

Premium availability depends on the operating system, Application version and distribution channel; test versions may support test purchases. Purchase terms are shown by the store before confirmation. Rewarded ads are currently disabled; the ad-related processing described below applies when that feature is made available. Free features may have usage limits.

• Providing Application services — creating and maintaining an Account, generating recommendations, operating the scanner and providing the User profile. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
• Login through external identity providers (Google, Apple). Legal basis: Articles 6(1)(b) and 6(1)(a) GDPR (consent given to the identity provider).
• Sending transactional messages — registration confirmation, email verification, password reset and important service notices. Legal basis: Articles 6(1)(b) and 6(1)(f) GDPR (legitimate interest in Account security).
• Optional AI features — perfume recommendations inspired by a photo or optional quiz description. We request separate permission before sending this content to OpenAI; you may withdraw it in Settings. The quiz without a description and other profile recommendations work without this transmission. Legal basis: Article 6(1)(b) GDPR (providing the requested recommendation feature). Permission to send content to external AI is a separate choice, not a condition of having an Account.
• Optional rewarded ads — where available in the app version, providing the selected ad and verifying the additional AI allowance. The ad privacy form manages processing choices; where consent is required, processing relies on it (Article 6(1)(a) GDPR). Fraud prevention relies on legitimate interests (Article 6(1)(f) GDPR).
• Security and abuse detection — protection against unauthorised access, attacks and spam. Legal basis: Article 6(1)(f) GDPR (legitimate interest).
• Premium subscription management (where applicable) — verifying purchase status and billing. Legal basis: Articles 6(1)(b) and 6(1)(c) GDPR (legal obligations, including tax and accounting obligations).
• Handling complaints and correspondence. Legal basis: Articles 6(1)(b), 6(1)(c) and 6(1)(f) GDPR.
• Establishing, pursuing and defending claims. Legal basis: Article 6(1)(f) GDPR (legitimate interest).
• Statistics, aggregated analysis and product improvement — using diagnostic data and aggregate statistics, including allowance and Premium offer counters. Longevity, projection and intensity ratings in the wear diary contribute to public perfume rating averages and counts, without author names or identifiers. An average may also be based on a single rating, so removing names alone does not guarantee that the result is anonymous. Pseudonymised data may still be personal data; only data that cannot be linked to a User is treated as anonymous. Legal basis: Article 6(1)(f) GDPR.
• Marketing our own services (if introduced) — sending commercial information and product updates. Legal basis: Article 6(1)(a) GDPR (your consent), which may be withdrawn at any time.

§5. Data recipients

We use the following providers as needed for the selected feature. Providers may act as processors on our behalf or as independent controllers, for example when managing their own Google/Apple accounts and purchases.

Scenza requires third parties receiving users' personal data to provide the same or an equivalent level of protection as described in this Policy. Our requirements for service providers include using data only for the disclosed purposes, confidentiality, appropriate security measures and equivalent obligations for their subprocessors.

• Hetzner Online GmbH (Germany): API, databases, profile files and backups in the EEA. Qdrant vector search operates in our infrastructure.
• OpenAI (OpenAI Ireland Ltd for EEA customers; processing may take place in the USA): the selected photo, scene description and descriptors, and optional quiz text, to obtain recommendations. We do not attach your email, account identifier, date of birth or favourites to OpenAI requests. The content itself may contain personal data. API data is not used for model training by default under OpenAI's data controls. Our use of the API is governed by OpenAI's Data Processing Addendum, which provides for processing on documented instructions, confidentiality, security safeguards and comparable data-protection obligations for subprocessors.
• Google and Apple: chosen external login, app distribution and, when Premium purchases are available, their verification. We do not receive card numbers; we process transaction/product identifiers and purchase-to-account references.
• Google Firebase Cloud Messaging: installation tokens and notification data described in §3.3.
• Brevo: transactional emails such as account verification and password resets. We provide the recipient address and the message content needed for delivery.
• Google AdMob and User Messaging Platform: when the feature is available and you choose a rewarded ad, they provide the ad and privacy choices. Data may include IP address, approximate location, installation identifiers, device information, ad interactions and diagnostics. The app requests non-personalised ads; this does not mean no data is processed. The privacy form is handled before ads are initialised.
• Sentry — mobile Application diagnostics: in versions with an active mobile diagnostics configuration, receives crash/performance data, technical event context and a random installation identifier. Diagnostic context, such as API request URLs, may contain account identifiers and activity information. We restrict logging; default personal information collection and event IP inference are disabled.
• Sentry — server diagnostics: when the server integration is enabled, it receives sanitised diagnostic logs, such as error type, response status, duration and error location in the code. The export filter allows selected messages and technical fields, and excludes account identifiers, IP and email addresses, request URLs and bodies, and tokens. This mechanism applies to server logs and does not describe the scope of mobile Application diagnostics.
• Authorised public authorities: where required by law.

§6. Transfers outside the EEA

Processing by providers including OpenAI, Google and Sentry may involve transfers outside the European Economic Area, including to the United States. Depending on the recipient and transfer, the safeguards used are:

• standard contractual clauses (SCCs) approved by the European Commission in Decision 2021/914,
• for US partners, the EU–US Data Privacy Framework, where the organisation is listed as an approved participant,
• additional safeguards such as encryption in transit, data minimisation and anonymisation where possible.

You may obtain a copy of the safeguards used by contacting the Controller.

§7. Data retention periods

• Profile and account feature data: until account deletion or an accepted request to delete selected data. Account deletion removes identifying details, preferences, wear diary, alerts and recommendation history. A limited technical record of the inactive Account remains in the database, including its identifier, creation and last-login dates, language and selected technical states. This record may still constitute personal data. Submitted EAN mappings remain part of the catalogue after the author link is removed.
• AI history: results, scene description, descriptors and photo hash linked to the Account, until history or account deletion. The current AI flow does not persist the original photo or original quiz text. Seven-day cache freshness is not a history deletion period.
• OpenAI data: abuse-monitoring logs are normally retained for up to 30 days. Exceptions include legal requirements, preventing harm and review of some images. We do not claim zero retention or immediate erasure of all provider copies; see the provider's documentation.
• Backups: separate access-restricted database backups rotate with 14-day retention. Automatic object expiry may be delayed. Deletion from the live database does not rewrite older copies; deletion requests must be reapplied if a backup is restored.
• Technical/security logs: local server logs rotate when size limits are reached. Their retention depends on event volume and the need to investigate an incident. Diagnostic data sent to Sentry is subject to separate project retention settings; rotating local logs does not remove copies held by that provider. Logs are not used as preference history or for marketing.
• Purchases and billing: account references in transaction records are detached upon account deletion. Necessary accounting records, if generated, are retained as required by law; data required for a claim is retained until the applicable limitation period ends.
• Correspondence and submissions: for handling the case and, where necessary, establishing, exercising or defending a claim.
• Consent-based marketing: until withdrawal; a minimal record of grant/withdrawal may separately be retained to demonstrate compliance.

§8. User rights

In connection with our processing of your data, you have the following rights:

• Right of access to data and to receive a copy (Article 15 GDPR).
• Right to rectification of inaccurate or incomplete data (Article 16 GDPR).
• Right to erasure (“right to be forgotten”) in the cases specified in Article 17 GDPR.
• Right to restriction of processing (Article 18 GDPR).
• Right to data portability in a structured, commonly used format (Article 20 GDPR).
• Right to object to processing based on legitimate interests (Article 21 GDPR).
• Right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR).
• Right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl) if you believe processing infringes the GDPR.

In the Application, you can edit your profile, delete your Account and withdraw permission to send content to AI. Camera and notification permissions can be changed in device settings. To request a copy or portability of your data, restriction of processing, object to processing, request deletion of data you cannot edit yourself or withdraw marketing consent, email info@scenza.pl. We will respond within one month. For complex matters this period may be extended by a further two months, and we will notify you of the extension.

§9. Profiling and AI

1. We use your fragrance quiz answers and stated preferences (liked and disliked perfumes, notes and subcategories) to build a fragrance profile that personalises recommendations. The legal basis is Article 6(1)(b) GDPR (performance of the contract in relation to recommendation functionality).
2. One explicit, versioned permission covers both photo inspiration and optional quiz descriptions. Before requesting permission, we explain which data is sent to OpenAI and why. No content is sent until you accept the current disclosure. Permission is linked to the Account; an earlier permission does not carry over to a new disclosure version. You can review the explanation and withdraw permission in Settings. Withdrawal blocks future content transmission for both features but does not itself remove earlier history. Declining does not prevent use of the Account or the quiz without an optional description. You may request erasure under the data deletion instructions.
3. Profiling in the Application does not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. It only produces product suggestions, over which you retain full freedom of choice. You may nevertheless object to profiling at any time by contacting the Controller.

§10. Security

1. We apply technical and organisational measures appropriate to the identified risks, including:
   • TLS (HTTPS) encryption of connections,
   • storage of passwords as salted cryptographic hashes,
   • session authentication using time-limited JWTs and a refresh-token mechanism,
   • infrastructure access control, backups and monitoring,
   • verification of processors and regular reviews of their security practices.
2. We will notify the President of the Polish Personal Data Protection Office of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals’ rights or freedoms (Article 33 GDPR). If the breach is likely to result in a high risk, we will also notify affected individuals without undue delay, subject to Article 34 GDPR.

§11. Cookies and local storage

1. The mobile Application does not use cookies in the conventional browser sense. It uses local data storage (AsyncStorage) to save session tokens, User settings and cached responses for faster operation after restart. These are local copies: tokens also authenticate API requests, and profiles and preferences are synchronised with the server. Local storage does not mean that data is processed only on your device.
2. The website https://scenza.pl may use only cookies necessary for its proper operation, such as maintaining a session or language. We currently do not use marketing or analytics cookies that collect personal data.

§12. Children

The Application is intended for persons aged 16 or over, in accordance with the Terms. We do not verify age using identity documents; the profile date of birth is optional. If we receive reliable information about an Account belonging to a person under 16, we will take steps to delete the Account and its data, subject to our legal obligations. Parents or guardians who suspect that a child under 16 has provided data to us should contact info@scenza.pl.

§13. Changes to the Policy

1. The Policy may change, for example because the Application develops, providers change or legislation is updated.
2. The current Policy is always available at https://scenza.pl/privacy. We will notify you of material changes by email if you have an Account or by a notice in the Application at least 14 days before the changes take effect.

§14. Contact

Please direct questions about personal data processing, exercising your rights or this Policy to info@scenza.pl or in writing to the Controller’s correspondence address at ul. Szpakowa 10/128, 30-691 Kraków, Polska.

This Policy applies from April 28, 2026.