Legal
Privacy Notice
There is no app yet, so there is very little to collect. This website does one thing: it takes an email address, with your consent, so we can tell you when My Fragrance Shelf is ready. We never sell your data, and you can have it deleted at any time by asking.
1. Who We Are
My Fragrance Shelf is a project of Nisshagen Advisory AB (Org.nr 559526-6742), a company registered in Stockholm, Sweden. We are the data controller for personal data collected through the myfragranceshelf.com website.
Contact us at hello@myfragranceshelf.com for any privacy-related question, including data subject requests under the GDPR.
This notice covers the website only. My Fragrance Shelf is not yet a released application, and there is no app, no account and no login. If and when an app is released, this notice will be replaced by one that covers it, and anyone on the list will be told before that happens.
2. What Data We Collect
Only what arrives when you submit the sign-up form, plus the small amount of context sent with it so we can prove your consent and understand where interest is coming from.
| Data | Why we collect it | Where it’s stored |
|---|---|---|
| Email address | To tell you when My Fragrance Shelf is ready to try, and to send occasional short progress notes | Supabase (EU) |
| App identifier | Which list you joined: here, fragrance_shelf. The same sign-up endpoint serves the other “my X shelf” sites | Supabase (EU) |
| Consent (yes / no) | A record that you ticked the box, kept so we can demonstrate a lawful basis for holding your address | Supabase (EU) |
| Consent wording | The exact sentence shown beside the box at the moment you ticked it, so it is clear what you agreed to | Supabase (EU) |
| Date and time of sign-up | The moment you signed up and gave consent, recorded automatically, so we can show that consent was given and when. Required under GDPR Article 7(1) | Supabase (EU) |
| Page address | The address of the page you signed up from, so we know which parts of the idea land | Supabase (EU) |
| Referrer | The link that brought you here, if any, so we know where interest is coming from | Supabase (EU) |
| Language preference (locale) | To judge whether the app would need languages other than English | Supabase (EU) |
| Hashed IP address | Not your IP address itself, but a salted SHA-256 hash of it, truncated to 32 hexadecimal characters and stored on the row alongside your address. It exists only to hold sign-ups to five per hour from one network. The raw address is never written down, and the hash cannot be turned back into an address. It is still personal data, and it is deleted with the rest of your row | Supabase (EU) |
We do not use cookies for the sign-up form. We do not ask for your name, your location, your collection or anything else. There is nowhere to put it.
The website uses Vercel Web Analytics for aggregate, anonymous traffic measurement (page views, referrers, country-level location). It is cookieless, does not track individuals across sessions or sites, and does not build user profiles. The website uses no other tracking pixels or non-essential cookies. If we add any, we will update this notice before they take effect.
Web fonts are loaded from Google Fonts, which means your browser makes a request to Google’s servers and Google receives your IP address as part of that request. If you would rather it did not, blocking third-party font loading in your browser will not break this site.
3. Legal Basis for Processing
We process your personal data under the following legal bases as defined by the GDPR:
- Consent: your email address is held, and emailed to, only because you ticked the consent box. The box is never pre-ticked, and the form will not submit without it. You may withdraw consent at any time, and withdrawing it is as easy as giving it.
- Legitimate interests: storing a salted, truncated hash of your IP address alongside your sign-up so the form can be limited to five sign-ups per hour per network, and basic error monitoring, so the sign-up form stays available and is not abused. The hash is stored, not transient; it is kept for as long as the row it sits on, and it is deleted when that row is deleted.
4. Third-Party Services
We use a small number of trusted third-party services to run this website:
- Supabase: database and sign-up endpoint, hosted in the EU
- Vercel: website hosting and cookieless aggregate analytics
- Google Fonts: serving the two typefaces used on these pages
If we later use a dedicated email delivery provider to send the announcement, we will name it here before the first email goes out.
We do not sell your data to any third party, and none of our providers use your data for advertising purposes.
5. How Long We Keep Your Data
We keep your email address until one of the following happens, whichever comes first:
- You withdraw consent or ask us to delete it; we remove it within 30 days
- You tell us to stop, by replying to any email we send
- My Fragrance Shelf is abandoned rather than built; in that case we tell the list once and then delete the list
- Twenty-four months pass with no launch and no contact from us; the list is deleted rather than left sitting
6. Your Rights Under GDPR
As a user in the European Economic Area, you have the right to:
- Access: request a copy of the data we hold about you
- Rectification: ask us to correct an inaccurate address
- Erasure: ask us to delete your address and the consent record attached to it
- Portability: request your data in a portable format
- Object or restrict: object to processing or ask us to restrict it
- Withdraw consent: at any time, by replying to any email from us or writing to the address below. Withdrawal does not affect processing carried out before you withdrew.
To exercise any of these rights, contact us at hello@myfragranceshelf.com. We will respond within 30 days. If you believe we have handled your data badly, you may also complain to your national supervisory authority; in Sweden that is Integritetsskyddsmyndigheten (IMY).
7. Removing Yourself From the List
There is no account to delete, so removal is a single request: email hello@myfragranceshelf.com from the address you signed up with, or reply to any email we send you. No email has been sent yet and no mailing system has been set up, so writing to that address is currently the only route; when we do start sending, the messages will carry a one-click way out. Your address, its consent record and the hashed IP stored with it are all removed, and we keep no copy.
8. International Transfers
Your data is stored in the European Union. Where a provider processes data outside the EEA in the course of serving the site, that transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.
9. Children
This website is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us an email address, write to us and we will delete it.
10. Changes to This Notice
If we make material changes to this notice (in particular when the app itself exists and starts processing collection data), we will email everyone on the list and ask them to review the updated notice. The version number and effective date at the top of this page will be updated accordingly.
11. Contact
Questions or concerns about your privacy? Contact us at hello@myfragranceshelf.com.
Nisshagen Advisory AB, Stockholm, Sweden.