Privacy

This page explains how Scentorian handles server logs, our own page counter, the Cloudflare Web Analytics script, what you type into the site's boxes, email and affiliate link records. The site has no accounts, sign-up, newsletter or comments. We update this notice before introducing changes to those features.

Who we are

This site is published by Scentorian LLC. In data protection terms we are the controller of the data described below.

For anything about this page, write to editor@scentorian.com.

What we collect

Server logs. Our server's log does not record visits. It holds operating messages, such as start-ups, warnings and errors, which may mention a page or link that failed but not the address you connected from or your browser's user-agent string. We use them to operate the site and diagnose faults. They rotate as they fill: we hold about 30 MB of the most recent lines and discard older ones to make room. The retention period depends on site traffic. There is no archive or separate copy.

Request counters. To limit abusive traffic, our server counts requests to some files and features, such as robots.txt and the sitemap, per visitor over short windows: one minute for most, and never more than a day. Each count is kept under a one-way pseudonym that changes every window and cannot be turned back into your address, and it expires when its window ends; the file our cache server uses to recover after a restart can hold these pseudonymous counts until the file is compacted.

Delivery records. Cloudflare, which delivers the site, receives the address you connected from, your browser's user-agent string, the requested page and the time with every request. In Cloudflare's dashboard we can see traffic totals and a sample of individual requests from about the last seven days, each with the address, browser string, page (including any search words in it) and country, whether or not a security rule acted on it; we use them to operate the site and handle abusive traffic. Cloudflare keeps these records under its own privacy policy, linked below.

Anything you send us by email. We receive your email address and message and use them to respond. We keep correspondence for as long as needed to deal with the matter. Correspondence about a correction may be kept longer, for as long as we need it to show what we changed and why.

Our own page counter, the on-page boxes and affiliate click records are described below. The site also has a fragrance search box and a scent profiler quiz. Search puts what you type into the page address (for example /fragrances?q=vanilla). Our own counter does not record it, but the address can reach Cloudflare, which delivers the site and runs Cloudflare Web Analytics, as described on this page. The quiz works out its result in your browser, needs scripts to run, and sends us nothing. There is no other form, and we do not ask you to create an account.

Cookies

We set no cookies of our own for analytics, advertising or remembering you between visits, and Cloudflare Web Analytics, described below, sets none either. There is no cookie consent banner. A retailer, or Rakuten Advertising's click tracker described under Affiliate link tracking, may set its own cookies after you follow a paid link; each one's privacy policy describes those cookies.

Analytics

We use our own first-party page counter to understand which pages get read. It does not set cookies and does not build a profile of you across sites.

Cloudflare, which delivers this site, also runs Cloudflare Web Analytics on its pages for us. A small script loaded from static.cloudflareinsights.com reports each page view, the page that referred you, the country your visit came from, the type of device, browser and operating system you used, and how quickly the page loaded (the measures known as Core Web Vitals). It sets no cookie, and Cloudflare states that it does not identify you or follow you from site to site. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

For each page view, our own counter records the page, the page you arrived on first, the host names of the sites that referred you to this page and to the page you arrived on (never the full address), any campaign tags in the address you arrived with, which version of the page you were shown, and the time. For each paid-link click it records the page, the page you arrived on first and the host name of the site that referred you to it, the campaign tags, the time, which offer was clicked, the retailer and its host name, the kind of product (for example a sample or a full bottle) and where on the page the link was. Your connecting address is not stored; it is replaced by a one-way hash made with a key that changes every day and is never written down, so the hash cannot link your views on different days. Your browser holds a random session id, with the campaign tags, the page you arrived on and the site that referred you to it, in its session storage — not a cookie — so that the pages of one visit can be counted together; it is discarded when the tab closes, and we store the session id only as a hash under the same daily key, so the stored id cannot link one day's views to another's either. Campaign tags are stored as they appear in the link you followed, so a link carrying a tag unique to you would show up on every view made from it. We do not record your browser's user-agent string, and we do not build a profile of you.

Page view and click records are kept for 400 days, then deleted. What you type into the on-page boxes is kept for 180 days, then deleted.

What you type into the site

Some pages carry small optional boxes: whether a page answered your question and what was missing, what you are comparing a fragrance with, whether you are after a sample or a full bottle, and what you would like to watch a fragrance for. Using one records your answer together with the page, the day and time, the session id, the campaign source and name and any ref tag in the address you arrived with, and the same daily one-way hash of your connecting address described above; your connecting address itself is not stored. None of these boxes asks for your name or email. What you type is read by a person, is never published as written, and is deleted after 180 days.

If you send us a source by email, it is correspondence: we receive your email address and what you write, and keep them as described under email above. It is read by a person and is never published as written.

Do Not Track

Your browser may send a Do Not Track signal. We do not change how the site behaves in response to it. Our own first-party page counter runs the same way whether or not the signal is present.

Affiliate link tracking

Some links on this site are paid, and none goes through a redirect of ours. Links to MicroPerfumes pass first through Rakuten Advertising's click tracker (click.linksynergy.com), which receives what any website you visit receives (including your connecting address and browser details) and records the click, the name of the page the link was on and the time, and may set cookies so that a purchase can be credited to us; Rakuten's privacy policy is at rakutenadvertising.com/legal-notices/services-privacy-policy. Other paid links go straight to the retailer. When you follow one, our own counter records which offer was clicked, the retailer, where on the page the link was, the page you were on, the visit's referring host and campaign tags, and the time, kept as described under Analytics. Your connecting address is kept only as the daily one-way hash described there, and your browser's user-agent string is not recorded; we do not use these records to build a profile of you. A retailer may set cookies when you arrive. The retailer's privacy policy applies to its collection and use of your data.

Who else sees your data

These service providers handle data when they deliver the site or process our email. Their roles, the data they receive and their privacy policies are listed below.

• Cloudflare, Inc.: delivering the site and terminating its encrypted connections. Receives your connection address, the page you requested and the page that linked to it, your browser string, and everything the site's page counter and on-page boxes send, including the session id, campaign tags and anything you type into a box. Privacy policy
• New Dream Network, LLC (DreamHost): hosting the mailbox for our published address and sending our replies. Receives your email address and whatever you write to us. Privacy policy
• MailChannels Corporation: filtering the email sent to our published address before DreamHost delivers it, and relaying the email we send from it. Receives your email address and whatever you write to us. Privacy policy

Where your data goes

Our server is in the United States. Cloudflare, which delivers the site, answers each request at one of its data centres, usually one near you and possibly in your own country, and passes anything it cannot answer from its cache on to our server. Each company named above handles data where it operates, under the laws that apply there, including laws governing access by courts and authorities.

If you are in Canada: your information is also processed outside Canada, including in the United States, where government authorities and courts may access it under applicable local law.

What we don't do

• We do not sell your personal information, and we do not share it for advertising.
• We do not build advertising or behavioural profiles.
• We have no relationship with any data broker.
• We do not make any decision about you automatically, and there is no profiling on this site.
• We do not combine what we learn here with data bought from anyone else.

Your rights

To exercise your data rights, write to us with your request. We do not charge a fee. We ask for identity information only as needed to handle the request safely.

If you are in California

You have the right to know what personal information we collect and why, the right to have it corrected, and the right to have it deleted.

We do not sell or share your personal information, as those terms are defined in the CCPA as amended by the CPRA. "Sharing" refers to disclosure for cross-context behavioural advertising. We have not sold or shared personal information in the preceding twelve months, so we do not provide a sale or sharing opt-out link.

We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it.

We will not discriminate against you for exercising these rights.

If you are in Canada

Under PIPEDA you can ask what personal information we hold about you and how we have used it, challenge its accuracy, and ask us to correct it.

If you are not satisfied with how we answer, you can complain to the Office of the Privacy Commissioner of Canada.

Write to editor@scentorian.com. We answer within the time the law where you live allows us.

Keeping it safe

The site is served over an encrypted connection. Our server's logs, and anything the site itself records as described above, are held on infrastructure we control and are accessible only to its operators. Our database is backed up every night; backups on the server are kept for up to five weeks, and we may keep further copies on a separate drive we control, so a record deleted or changed as described here can remain in a backup until that backup is removed. These measures do not guarantee complete security.

Children

This site is not directed at children, we do not knowingly collect data from anyone under 16, and we have no way to identify a reader's age. If you believe a child has sent us something, write to us and we will delete it.

Changes

We update the date at the top of this page when we make a material change to this notice.