Privacy Policy

Scentsation is a sole proprietorship operating a perfume workshop studio in Edmonton, Alberta, Canada. In this policy, “Scentsation,” “we,” and “us” refer to that business; “you” refers to anyone using our website at scentsation.ca or attending a workshop.

We collect only what we need to run workshops and the website. Specifically:

• Account & contact info: name, email address, phone number (if you provide one), and a one-way hash of your password — we never see your password in the clear.
• Bookings: the workshop you booked, date, party size, deposit choice, and any notes you add.
• Payments: the deposit amount, payment status, and a Square receipt URL. Card numbers and CVV are handled entirely by Square and never reach our servers.
• Fragrance records: if you attend a workshop, we record the top, heart, and base notes you blended (with percentages) so you can re-order your scent later. This is private to your account.
• AI Scent Design (optional): if you use our AI scent designer, your questionnaire answers are sent to Anthropic’s Claude API to generate a recipe. The answers and resulting recipe are saved to your account.
• Basic technical info: standard web server logs (IP address, timestamp, page requested), used for security and abuse prevention.

We do not collect government ID, payment card details, location data, or anything you don’t voluntarily provide.

• To take and confirm your booking, send reminders, and run the workshop.
• To process deposits and remainders through Square.
• To send transactional emails — booking confirmation, reminder, cancellation, payment receipt, password reset.
• To send occasional marketing emails about upcoming workshops, only if you opted in. You can unsubscribe any time from the link at the bottom of those emails or by emailing us.
• To keep your fragrance recipe so you can re-order or reproduce it.
• To protect the site against abuse (rate limiting, security logging).

We do not sell your personal information. We share only what is necessary, only with these processors:

• Square, Inc. — payment processing. Square receives the payment amount and your email; it stores your card details under its own privacy policy.
• Resend — sending transactional and marketing email. Resend receives the recipient address and the email content.
• Anthropic, PBC — only if you use the AI Scent Design feature. Your questionnaire answers are sent to the Claude API to generate a recipe; per Anthropic’s API terms, inputs are not used to train their models.
• Railway and Vercel — infrastructure providers that host our API, database, and website. They store data on our behalf in their secure data centres.

We may also disclose information if required by law, court order, or to investigate fraud or threats to safety.

Your personal information is stored in PostgreSQL databases hosted by Railway, and backed up by Railway’s automated backup system. Square, Resend, and Anthropic may process data outside of Canada. By using the Services, you consent to that cross-border processing.

• Account & bookings: kept while your account is active. If you ask us to delete your account, we will do so within 30 days, except where we must keep records for tax or accounting purposes (typically 7 years for payment records under Canadian tax law).
• Marketing email list: until you unsubscribe.
• Server logs: typically 30 days, then automatically rotated out.

We use a single piece of browser storage to keep you signed in: a JSON Web Token (JWT) saved in your browser’s localStorage. We do not use tracking cookies, third-party analytics, ad pixels, or social media trackers.

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA), you have the right to:

• Access the personal information we hold about you.
• Correct anything that is inaccurate or out of date.
• Withdraw consent for non-essential processing (e.g. marketing emails).
• Ask us to delete your account and the personal information attached to it, subject to the retention limits above.
• Complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta if you believe we have mishandled your information.

To exercise any of these rights, email us at hello@scentsation.ca.

We protect your information with industry-standard measures, including:

• TLS (HTTPS) for all data in transit.
• Bcrypt password hashing — your password is never stored in readable form.
• Short-lived JSON Web Tokens for session auth, with separate access controls for admin features.
• Webhook signatures from Square verified using HMAC before any booking is confirmed.

No system is perfectly secure. If we discover a breach that affects your personal information, we will notify affected individuals and the Alberta Privacy Commissioner as required by law.

The Services are intended for users 16 and older. Participants under 16 are welcome to attend a workshop if accompanied by a paying adult, but only the adult should create an account or provide personal information through the website.

If we make material changes — for example, adding a new processor or a new category of data — we will update the “Last updated” date at the top and, where appropriate, notify account holders by email. Continued use of the Services after a change means you accept the updated policy.

Privacy questions, access requests, or anything else: email hello@scentsation.ca. We aim to respond within 30 days, as required by PIPA.

See also our Terms of Service.