Privacy policy
In effect from 27 August 2026.
This explains what Perfume Foundry collects about you, why, who else sees it, and what you can make us do about it. It covers the site at perfumefoundry.ai and the application behind it.
Who we are
Perfume Foundry is operated by Scentâme Ltd, which is the data controller for the personal data described here. Company number 16524697. Registered office: Unit 107, Forestow Studios, 36a Hurst Road, London E17 3BL.
For anything in this policy — including a request to see, correct or delete your data — write to privacy@perfumefoundry.ai. For anything else, support@perfumefoundry.ai.
What we collect
Your account
Your email address, the display name you choose if you give one, and your role. Your password is stored only as a scrypt hash — we do not hold the password itself and cannot tell you what it is.
Your sessions
When you sign in we record a random session token, the IP address and browser the sign-in came from, and an expiry date thirty days out. The IP address and browser are kept so you and we can recognise a session that should not exist. Expired sessions are deleted automatically by the database, not on a schedule someone has to remember.
What you make
Formulas and every version of them, notes, stock levels, orders, and any material records you create. These are private to your account. They become visible to others only when you share a formula, join a house, or promote a material into the shared library — each of which is an action you take deliberately.
What you upload
Safety data sheets, allergen declarations, IFRA certificates and similar supplier documents. We keep the file and the text extracted from it, and the structured records built from that text. Supplier documents are not usually personal data, but they are yours, and they are treated as private to your account on the same terms as everything else here.
Public pages
If you accept the analytics banner, Google Analytics records visits to the public pages — the landing page, sign-in and sign-up, the ingredient library and the olfactory wall. It is not loaded on any page inside your account, so the addresses of your formulas and documents are never sent to Google. Decline, or ignore the banner, and nothing is stored on your device and no analytics data is collected.
Cookies and local storage
| Name | Kind | What it does | Lifetime |
|---|---|---|---|
| pf_session | Cookie · essential | Keeps you signed in. Set only when you sign in, holds nothing but a random token, and cannot be read by scripts. | 30 days |
| _ga, _ga_* | Cookie · analytics | Google Analytics, on public pages only. Set only after you accept the banner, and never on pages inside your account. | Up to 2 years |
| pf:analytics-consent | Local storage | Remembers your answer to the analytics banner so you are not asked on every visit. Clearing it asks again. | Until you clear your browser data |
There are no advertising cookies, and no tracking that follows you to other sites. You can change your analytics answer at any time by clearing your browser data for this site, which brings the banner back.
Who processes it for us
We use the following services to run Perfume Foundry. Each acts on our instructions, and each sees only what is listed against it.
- MongoDB Atlas
- Hosts the database: your account, your formulas, and the records extracted from your documents.
- Cloudflare R2
- Stores the document files you upload.
- Resend
- Sends transactional email — invitations, shared formulas, notifications. It sees the recipient address and the message.
- Anthropic (Claude)
- Reads the text extracted from safety data sheets and allergen declarations you upload, to turn them into structured records. It receives the document text, not your account details.
- OpenAI
- Summarises a formula when you ask for an analysis, and reads the brief you type when you ask it to compose one. It receives that text, not your account details.
- Google Analytics
- Counts visits to public pages, only if you accept the banner. It sees the public page URL, your approximate location and your device — never a page inside your account.
- Adobe Fonts and Google Fonts
- Serve the typefaces. Your browser requests these directly, so both can see your IP address on any page you load.
We do not sell personal data, and we do not share it with anyone for their own marketing.
Why we are allowed to
- To perform our contract with you. Your account, your formulas, your documents, and the email we send about them. You cannot have the service without these.
- Our legitimate interests. Keeping the service secure and working — the session records that let us spot an account being misused, and the logs that let us find a fault.
- Your consent. Analytics, and nothing else. You can withdraw it at any time, and withdrawing costs you nothing.
Where it goes
Several of the services above are based in the United States. Where personal data is transferred there it is covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with the provider's own safeguards.
How long we keep it
- Sessions expire thirty days after sign-in and are then deleted automatically.
- Your account, formulas and documents are kept until you delete them or ask us to close your account. Ask, and we will delete them.
- Material records promoted into the shared library stay there, because other people's formulas depend on them — but they carry no personal data once promoted.
- Analytics data is retained by Google for the period set on the property.
Your rights
Under UK data protection law you may ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask for it in a portable form, object to processing based on legitimate interests, and withdraw consent to analytics. Write to privacy@perfumefoundry.ai and we will answer within one month.
If you think we have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, so we can put it right.
Changes
If we change this policy in a way that matters we will update the date at the top and, where the change affects how we use data you have already given us, tell you by email.
See also the terms of use.