Privacy Policy
This policy explains who is responsible for your data, what Essentia and its providers process, why they process it, how long it is kept and how to exercise your rights.
Last updated 26 September 2026
At a glance
Essentia does not guarantee that catalogue reviews were written by people who bought or used the fragrance. The site does not currently accept reviews: it displays stored catalogue records with the author name and text as supplied. A “Verified wear” label, if shown, reflects only the stored verification flag and is not proof of purchase. Reviews may be sorted by date, rating, helpful reactions or the verification flag; signed-in reactions update anonymous aggregate counters.
Scope
The data controller for Essentia is José Sanz. For any privacy question or request, write to contact@essentiadiscovery.com.
Essentia has no contact form. If you email the address above, the email address, message and any information you include are processed only to answer and manage that request.
Visitors can also register and sign in with an email and a password. Authentication itself is handled by Supabase Auth. In Essentia's database, hosted and managed by Supabase, an account is a profile row — an id and the display name you choose — protected so that only its owner can read or update it, plus the favourites and perfume votes linked to it. Your email address is not part of those tables: it lives in Supabase's own authentication schema, not in Essentia's database tables.
Reacting to a review sends the review ID and your reaction to the API, which updates an aggregate count without an account identifier. Normal request metadata still reaches the infrastructure. The choice that prevents the same browser from reacting twice remains in that browser's local storage. Essentia does not use these data for profiling or automated decisions.
Legal basis
The table states the data, purpose, legal basis and retention rule for each processing activity. Article references are to the GDPR.
| Processing | Data and purpose | Legal basis | Retention |
|---|---|---|---|
| Site delivery and security | IP address, timestamp, requested URL, user agent and Referer in access records, to deliver the site, investigate failures and prevent abuse. | Legitimate interests in secure, reliable delivery (Art. 6(1)(f)). | Under the hosting and security providers' operational needs and DPA deletion/anonymisation criteria; Essentia keeps no independent copy. |
| Email enquiries | Email address, message and supplied details, to answer and manage the enquiry. | Legitimate interests in responding and keeping an appropriate record (Art. 6(1)(f)). | Until the enquiry is resolved, then only as needed for legal claims or obligations. |
| Account and sign-in | Your email address and password credentials, held by Supabase Auth in its own authentication schema, to create the account and let you sign in; and, in Essentia's own database, a profile row with an account identifier and the display name you choose, to recognise you as its owner and show that name in the header. | Performance of the account service you asked for (Art. 6(1)(b)), not consent or legitimate interests: without these data there is no account to provide. | While the account exists. An account whose email address is never confirmed is deleted automatically once 30 days have passed since it was created. There is no self-service deletion yet: ask at the address above. Deleting the authentication record removes the profile row with it automatically — the database enforces that, so the two cannot drift apart. It leaves the live database immediately and the daily backups within seven days. No separate period is set, because neither record has a purpose once the account is gone. |
| Favourites and perfume votes | The perfumes you mark as a favourite, and your vote on a perfume: an overall score from 0 to 10 and, if you give them, longevity, sillage, gender, value for money and when you would wear it. One row per person and perfume, so changing your mind replaces your previous answer instead of adding a second one. | Performance of the service you asked for when you created the account (Art. 6(1)(b)). | While the account exists. Favourites are private and never aggregated. Votes feed the public averages shown on the perfume page, without your name. Deleting the authentication record removes your votes and favourites along with the profile row — the database enforces that — and because those averages are computed when the page is read, your contribution disappears from them at the same moment. There is still no self-service deletion: ask at the address above. |
| Review reactions | The reaction you already chose is kept in this browser's local storage so the same browser does not react twice; the API receives the review ID and the reaction to update its count. Reacting requires being signed in, but the stored count records no identity. | Legitimate interest in providing the requested features and preserving reaction integrity (Art. 6(1)(f)). | Local entries remain until you clear them; the anonymous count remains while the review exists. |
| Google advertising and consent (paused) | No advertising or Funding Choices scripts are loaded by this version. The AdSense verification meta tag and ads.txt do not make browser requests to Google. | No new advertising processing is enabled. Any future activation will require a separate privacy and consent review. | Previously stored cookies may remain until expiry or deletion. Pausing scripts does not delete data previously held by Google. |
| Web Analytics (paused) | Page-view and custom-event collection through Vercel Web Analytics is disabled in this version, including affiliate clicks and promotion code copies. | No new optional analytics processing is enabled. | Pausing collection does not delete previous aggregate results, whose retention follows Vercel's service and DPA criteria. |
| Affiliate clicks | IP address, user agent, Referer, Awin publisher/advertiser IDs, the public brand- or perfume-page slug and the campaign/placement reference, to redirect and attribute a possible purchase. | Legitimate interests in funding Essentia and attributing commissions transparently (Art. 6(1)(f)); optional tracking storage requires consent where applicable. | Under Awin's and the destination retailer's policies. Essentia does not currently send click or code-copy events to Vercel Web Analytics. Affiliate redirection still occurs when you choose an affiliate link. |
| Remote catalog images | IP address, user agent, Referer and requested image URL, to deliver images directly from the source host. | Legitimate interests in presenting the catalog and crediting its source material (Art. 6(1)(f)). | Under each image host's access-record and cache policy; Essentia creates no additional visitor record. |
Device storage
Essentia sets two cookies of its own. The first is essentia_locale. It records the language you pick with the switcher in the header or footer, so the site stops choosing for you from your browser's language settings. It holds nothing but that choice and lasts a year. As a first-party cookie, it accompanies requests to Essentia and is processed by its hosting infrastructure. You can delete it with this site's browser data at any time.
The second is the session cookie, sb-<project-ref>-auth-token, set by Supabase Auth. It exists only once you sign in: it carries the session that keeps you signed in as you move between pages, and the Supabase browser client may split it into numbered parts (.0, .1) when the value does not fit in a single cookie. It is first-party, it is not used for tracking, advertising or audience measurement, and it disappears when you sign out or clear this site's browser data. If you never create an account, this cookie is never set.
Advertising and consent scripts are currently disabled. The following is a historical reference for Google cookies that may remain from a previous visit, not an inventory of cookies set by this version. Their presence depends on previous activity, location and browser. You can remove old cookies through your browser's site-data settings.
| Name | Owner | Purpose | Duration |
|---|---|---|---|
| FCCDCF | Google LLC — Funding Choices | Stores the consent choice on the partner domain. | 13 months |
| __gads, __gpi | Google LLC — AdSense | Advertising delivery and measurement, and advertising security. | 13 months |
| IDE | Google LLC — doubleclick.net | Advertising delivery, personalisation where consented, measurement and security. | 13 months in the EEA and UK; 24 months elsewhere |
| DSID | Google LLC — doubleclick.net | Advertising functionality, security and respect for ad-personalisation choices. | 2 weeks |
Google's official advertising-cookie inventory is the source for these purposes and periods and may change over time.
Cookies are not the same as localStorage. Essentia uses localStorage for fragranica-review-reactions (the review reaction already chosen in this browser). This local record is not uploaded; submitting a reaction separately sends its review ID and reaction to the API. It remains until removed or you clear this site's browser storage. essentia-collection is no longer written: it held saved perfumes before accounts existed, and the first time you open your favourites while signed in, anything left in it is added to your favourites, and the key is deleted from this browser once everything has been saved.
essentia-theme remembers the theme you select, and essentia:es-notice-dismissed remembers when you dismiss the Spanish-language notice. These preferences remain on your device until overwritten or cleared. They support your choices, not advertising or audience measurement.
There is no advertising consent dialog or active consent control in this version because the advertising and optional analytics integrations are paused. No acceptance is inferred from browsing the catalog.
Infrastructure
The core recipients are Vercel Inc. (hosting), Cloudflare (network and security infrastructure), Supabase (database infrastructure) and Awin (affiliate redirection and attribution). Supabase stores the catalog data and the anonymous review-reaction counts, and, if you create an account, your authentication record — email address and password credentials — plus the profile row with your display name; it does not receive the local collection stored in your browser.
Hosting and security providers receive the network data needed to serve each request. Vercel Web Analytics, Google AdSense and Funding Choices are paused, separately from necessary hosting operations. When you choose an affiliate link, your browser contacts Awin before the retailer and sends the normal network metadata plus the publisher, advertiser, public page slug and campaign/placement click references. See the Google partner-sites notice (for previous activity), Vercel Privacy Notice, Cloudflare Privacy Policy, Supabase Privacy Policy and Awin Privacy Policy.
That list is not the whole network surface. Because catalog images are served unoptimised from their source URLs, the visitor's browser contacts the current configured hosts directly: fimgs.net, images.pexels.com, cdn.fragella.com, fragella.com, d2k6fvhyk5xgx.cloudfront.net, cdn.fragrancenet.com, www.olfactoryfactoryllc.com and hlhgrbxbjogicnokmcqi.supabase.co. Each receives the requested image URL, IP address, user agent and Referer under its own policy. The configured list can change as catalog sources change.
Some providers may process data outside the EEA, including in the United States. Where Articles 44–49 GDPR require a transfer safeguard, transfers rely on standard contractual clauses and/or the EU–U.S. Data Privacy Framework, according to each provider's current policy and the processing concerned. Essentia does not treat membership as a blanket or permanent fact. Relevant terms are Google's data-transfer frameworks, the Vercel DPA and the Supabase DPA.
Control
Under the GDPR, where applicable, you may request access, rectification, erasure, restriction and portability of personal data concerning you, and object to processing based on legitimate interests. You may also withdraw consent at any time without affecting processing that was lawful before withdrawal.
Exercise those rights directly with Essentia by writing to contact@essentiadiscovery.com. Essentia will handle the request and, where a provider controls the relevant data, identify or coordinate with that recipient instead of simply redirecting the request.
You can clear this site's cookies and local storage in your browser. This resets your preferences and saved collection, but does not delete information already held by providers. For earlier Google activity, you can also manage ad personalisation in My Ad Center. Blocking advertising cookies does not prevent use of the catalog.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
Upkeep
If Essentia changes a provider, purpose, legal basis, retention rule or feature that stores data, this page and the last-updated date are revised together. There is no privacy-policy mailing list, so the date at the top records the latest substantive revision.
Questions, objections and rights requests go to contact@essentiadiscovery.com.