Privacy policy

Fragrance Monday FM UG (haftungsbeschränkt), Neue Kantstraße 29, 14057 Berlin, Germany, represented by managing director Frederico Barela Manhani. For privacy enquiries and to exercise your rights, contact hello@fragrancemonday.com.

Vercel Inc., USA, hosts this website. Delivering pages and protecting the service requires processing connection data such as your IP address, request time, requested page, browser and operating system, and technical error information. The legal basis is our legitimate interest in providing a secure, reliable website (Art. 6(1)(f) GDPR).

Our database is hosted by Supabase in Frankfurt, Germany. It stores consent records and the information needed to provide the services described below. EU hosting does not exclude access by providers or subprocessors outside the EEA.

We use Sentry (Functional Software, Inc., USA) to identify technical errors. Reports contain error details and technical context. Before reports are sent, we remove user information, cookies, request and response headers and contents, and additional information in page addresses. We do not use Sentry to record browsing sessions or trace performance across requests. The legal basis is our legitimate interest in identifying faults and securing the website (Art. 6(1)(f) GDPR).

If you email us, we process your email address, the content of your message and any details you choose to provide to respond. The legal basis is Art. 6(1)(b) GDPR for enquiries concerning a contract or steps you request before a contract, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

The necessary session cookie NEXT_LOCALE remembers your language preference when it differs from your browser setting. It has no fixed expiry and normally lasts for the browser session.

The cookies fm_consent and fm_vid remember your choice and associate it with a random identifier in our consent record. They are set when you make a choice and expire after one year. We record acceptance or refusal, the time, language, version of the consent notice and a digital fingerprint of its wording. These records let us respect and demonstrate your choice (Art. 6(1)(c), together with Art. 7(1), GDPR). Necessary storage is based on §25(2) no. 2 TDDDG; optional analytics requires consent under §25(1) TDDDG and Art. 6(1)(a) GDPR.

You can use Cookie settings in the footer at any time and choose Essential only to withdraw analytics consent. Withdrawal stops further analytics collection in this browser and does not affect the lawfulness of earlier processing. Refusing analytics does not prevent use of the website. Choices apply to the browser in which you make them.

With your consent, we use PostHog (PostHog, Inc.), hosted in the EU, to understand how visitors use our website and improve it. PostHog is only loaded after you consent.

PostHog processes a pseudonymous visitor identifier, session identifiers, selected page visits and interactions, page departures, time on page, scroll depth, loading speed, visual stability and interaction responsiveness (Web Vitals), event time, language, browser, operating system and device category and, where applicable, your selected membership and the country you choose for delivery or to register interest.

We record only public page addresses, without additional URL information that could identify you. For websites that referred you to us, we record the domain rather than the full address. We also record campaign names from a predefined list.

PostHog’s servers receive your IP address to derive approximate country and city, then discard the IP address. Location may be inaccurate, for example when using a VPN. We do not create person profiles. Pseudonymous identifiers are personal data, not anonymous data. We do not send names, email addresses, payment details, advertising identifiers, private confirmation links or reservation access codes in our analytics events.

We record selected visits and interactions rather than automatically capturing every interaction. We do not record browsing sessions or create heatmaps. PostHog uses cookies on our website and browser storage for visitor and session identifiers. These cookies expire after up to one year; browser local storage has no automatic expiry. Withdrawing consent stops tracking and further storage of analytics identifiers. The legal basis is your consent (Art. 6(1)(a) GDPR and §25(1) TDDDG).

When you join the waitlist, we process your first name, email address, language, confirmation status and secure records of your confirmation links to handle your request and send necessary service emails through Resend (Art. 6(1)(b) GDPR). Confirmation and delivery records help us prevent misuse and maintain reliable delivery (Art. 6(1)(f) GDPR). We store a protected digital fingerprint of the IP address for abuse prevention, not the raw address in signup records.

Marketing is separate and requires your consent (Art. 6(1)(a) GDPR). We use Loops to send marketing emails only to people who have consented and confirmed their email address. You can unsubscribe using the link in a marketing email or by contacting us. Withdrawing marketing consent does not cancel a reservation or necessary service messages.

With analytics consent, the optional cookies fm_ref and fm_utm store referral and campaign information for up to 30 days and associate it with your signup to measure which campaigns lead to signups (Art. 6(1)(a) GDPR and §25(1) TDDDG). They are not set while signup is closed and are removed on withdrawal. We use this information to calculate commissions for creators who referred customers to us. Creators do not receive your name or email. Withdrawing analytics consent removes the referral link to your signup and stops further payments from being attributed to that referral; necessary financial and consent evidence may be retained for accounting obligations or legal claims.

When you make a reservation, we process your name, email address, country, chosen plan, reservation status, confirmation that you are at least 18, billing agreement and references from our payment provider to arrange your reservation and subsequent subscription (Art. 6(1)(b) GDPR). We record the time, version and a digital fingerprint of the age and billing wording you acknowledged; we do not collect your date of birth or an identity document. Stripe handles payment-method setup and billing. Saving a payment method is free; no deposit or reservation fee is charged. Subscription billing starts only when the reservation is activated for launch under the billing agreement.

Payment credentials and billing address are entered directly with Stripe. We receive the identifiers and status information needed to manage the reservation and billing, not full card details. Stripe also processes data for its own fraud-prevention and legal obligations under its privacy policy at https://stripe.com/privacy. Accounting records are processed to meet legal obligations (Art. 6(1)(c) GDPR).

We use Cloudflare Turnstile to distinguish human requests from automated abuse. Cloudflare processes browser and device signals and connection data, including IP addresses, to perform this check. The legal basis is our legitimate interest in preventing spam and fraudulent requests (Art. 6(1)(f) GDPR); strictly necessary device access is based on §25(2) no. 2 TDDDG.

The fm_signup cookie remembers your signup progress for up to 30 days; the fm_verified cookie lets you access a reservation after verifying your email for up to 24 hours. These cookies support the service you request and are not analytics cookies. The fm_delivery cookie remembers the delivery country chosen at signup for up to 30 days, so you do not have to select it again when reserving in the same browser.

Service providers process data on our behalf where they act as processors. Depending on the service, processing or support access may occur outside the EU/EEA, including in the USA. For these transfers, applicable safeguards include an adequacy decision under Art. 45 GDPR or the European Commission’s Standard Contractual Clauses under Art. 46 GDPR. You can request information about the safeguards relevant to your data and a copy by emailing hello@fragrancemonday.com.

We retain personal data only for as long as needed for the stated purpose, applicable legal obligations or the establishment, exercise or defence of legal claims. Enquiries are kept until the matter is resolved and any applicable retention or claims period has ended. We keep technical logs for as long as needed to diagnose faults and investigate abuse. Cookie expiry does not itself delete records held by us or our service providers.

Consent evidence is retained for as long as needed to demonstrate the choice and meet accountability obligations. Withdrawal stops future consent-based processing; it does not automatically erase evidence of earlier consent. Where statutory retention applies, §147 AO generally distinguishes ten years for books and accounts, eight years for accounting vouchers, and six years for business correspondence, usually counted from the end of the relevant calendar year. Longer retention may apply to ongoing proceedings. Pseudonymisation alone does not remove your data protection rights.

Analytics events collected through PostHog are retained for one year.

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability (Arts. 15–20 GDPR). You may withdraw consent at any time with effect for the future, without affecting the lawfulness of processing before withdrawal.

You may object to processing based on legitimate interests for reasons relating to your particular situation (Art. 21 GDPR). You may object to direct marketing at any time, without giving a reason.

Write to hello@fragrancemonday.com to exercise your rights. You may also complain to a supervisory authority, including the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de, https://www.datenschutz-berlin.de, or an authority in the country of your habitual residence, workplace or the alleged infringement.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

If we do not deliver to your country, you can submit your country and email address to register interest. We send an email to verify your request. Only confirmed requests that have not been withdrawn or expired count towards demand. Our legitimate interest is to assess demand and prevent duplicate or fraudulent submissions (Art. 6(1)(f) GDPR). Only if you separately opt in and confirm your email may we notify you when delivery becomes available in that country (Art. 6(1)(a) GDPR). This does not subscribe you to general marketing or create a reservation. Confirmation is handled by Resend, as described above. Use the withdrawal link in the confirmation email or contact hello@fragrancemonday.com to withdraw. Unconfirmed requests and their contact details expire after seven days; confirmed interest and contact details expire after twelve months unless renewed by a new confirmation. Restricted consent evidence follows the retention rules above. We assess demand using grouped country reports, which show results only when at least ten people have confirmed interest.