Privacy policy
Written for a European audience against the GDPR’s structure. Have it reviewed before launch.
What we collect
- Account: email, a hashed password, display name, optional country, optional profile photo.
- Sellers: shop handle, headline, bio, payment instructions you choose to publish, listing content and photographs.
- Orders: delivery name, address, email, optional phone, and any note you write.
- Shipping evidence: the receipt and parcel photographs a seller uploads.
- Operational: a session cookie, an age-confirmation cookie, and an internal action log of moderation events.
We do not run third-party analytics, advertising trackers, or third-party fonts. Nothing about your visit is sent to another company.
Photographs and metadata
Every uploaded image is decoded and re-encoded on arrival. All embedded metadata — camera details and GPS coordinates in particular — is discarded before the file is written. The file stored is one we generated, not the one you sent.
Who sees what
- Your delivery address is visible to the seller shipping your order, and to moderators. Never to other users.
- Shipping evidence is visible to that order’s buyer and seller, and to moderators. It is never public and is excluded from search engines.
- Listing photos and your shop profile are public — that is their purpose.
- Your email address is never shown publicly.
Why we hold it (lawful basis)
- Contract: account and order data, to run the marketplace you asked to use.
- Legitimate interest: shipping evidence and moderation logs, to resolve disputes and prevent fraud.
- Legal obligation: records we are required to keep.
How long
- Account data: until you delete the account.
- Listings and photos: deleted with the account or the listing.
- Order records and shipping evidence: retained after account deletion, because historic disputes commonly surface afterwards.
Your rights
You may request access, correction, deletion, restriction, portability, or object to processing. Email support@scentofher.com from your registered address. Deletion requests are honoured except where an order record must be retained as above.
Cookies
Two, both first-party and strictly functional: a session cookie that keeps you signed in, and an age-confirmation cookie so the 18+ notice does not reappear on every page. No tracking cookies are set.
Security
Passwords are hashed with bcrypt. Evidence files are served only to authorised sessions. Uploads are validated by extension, declared type, magic bytes and a full re-encode before storage.