Back
PRIVACY POLICY

Privacy Policy

Last updated: June 27, 2026

1. Overview

This Privacy Policy explains how CraFume (“we”, “us”, “our”) collects, uses, stores, shares, and protects information about people who visit our website, place an order, or interact with our services. It also describes your privacy rights and how to exercise them. By using our website or completing a purchase, you confirm that you have read and understood this Policy.

This Policy is designed to comply with applicable data-protection laws, including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other U.S. state privacy laws. If any term here conflicts with a right granted to you by law, the law controls.

2. Information We Collect

We collect the following categories of information:

  • Order & contact data: name, email address, phone number, shipping and billing address, and order history.
  • Payment data: your card details are collected and processed directly by Stripe. We receive only a tokenized reference, the last four digits, card brand, and the result of the charge. We never store your full card number on our servers.
  • Customization data: the fragrance notes, scent strength, colors, bottle styles, custom perfume names, and AI prompts you select or type while building a custom perfume or using our AI assistant.
  • Device & technical data: IP address, browser type, operating system, device type, screen and viewport size, language, and the referring URL.
  • Behavioral & usage data: detailed interaction events described in Section 3.
  • Cookies & identifiers: cookies, local storage, and analytics/advertising identifiers described in Sections 3 and 8.

3. Exactly What We Track

We believe in being specific. Below is a plain-language list of the analytics and tracking we actually run on this site so you can make an informed choice.

a) Google Analytics 4 (event tracking)

We use Google Analytics 4 (via Google’s gtag.js) to understand how visitors use our store. Google receives data about your visit and assigns a Google-generated identifier. Please note that we do not anonymize or truncate your IP address before it is sent to Google. Specifically, we record events such as:

  • Page views and navigation between pages (including the full URL and query string).
  • Button, link, and call-to-action clicks (which button, in which section).
  • Product clicks and product-list selections, “add to cart,” and item details (product, variant, and price).
  • Scroll depth milestones (10%, 25%, 50%, 75%, 90%, and 100% of a page).
  • Which on-page sections you see and how long you dwell on each one (time-per-section).
  • Time on page and a “page exit” event capturing total time, the deepest scroll point reached, and the last section viewed when you leave or close the tab.
  • Customizer activity: steps viewed, fragrances added/removed, size and bottle selections, product-detail views, naming your perfume, and finishing/adding to cart.
  • Checkout activity: begin checkout, completion of the contact / shipping-address / shipping-method / payment steps, selected shipping method and cost, payment-info readiness, “pay” clicks, payment errors, and completed purchases (transaction ID, amount, tax, and shipping).

Google may use this information in accordance with its own privacy policy, available at policies.google.com/privacy.

b) Affiliate / referral tracking (GoAffPro)

When you arrive from an affiliate or referral link (for example a link containing a ?ref= code), we use GoAffPro to store that referral in a cookie so the correct affiliate is credited if you later place an order. At checkout, basic order details (order number, total, items, and contact details) are shared with GoAffPro to confirm the conversion.

c) Payments (Stripe)

Card entry and payment authorization are handled by Stripe, including their built-in fraud-prevention tooling. Stripe processes your payment details as an independent controller under its own privacy policy.

d) Address autocomplete & shipping

We use Google Places Autocomplete to help you enter your address quickly, and ShipEngine plus our shipping carriers to calculate rates and deliver your order. The address and contact information you provide are shared with these services for that purpose.

e) Cookies & storage

We use cookies and browser local storage for cart and checkout functionality (so your cart and checkout progress persist), session management, analytics, and affiliate attribution. See Section 8 for how to control these.

4. AI Model Training

CraFume uses de-identified and aggregated customer data to train and improve our internal AI models. This includes (but is not limited to):

  • Fragrance-note combinations you build in the bottle customizer.
  • Prompts and descriptions submitted to our AI fragrance assistant.
  • Click, scroll, dwell, and conversion behavior captured via Google Analytics.
  • Cart, checkout, and post-purchase patterns.

We use this data to make better product recommendations, improve our chatbot, and refine the customization experience. We do not sell raw personal data, and training datasets are de-identified before being used. Where required by law, this processing relies on your consent or our legitimate interest in improving our products, and you may object as described in Section 6.

By placing an order you acknowledge and consent to your interaction data being used to train our AI models in the manner described above.

5. How We Use Your Information & Legal Bases

We use your information to:

  • Process orders, payments, shipping, and customer service (performance of our contract with you).
  • Send order confirmations and shipping updates (contract / legitimate interest).
  • Prevent fraud and protect the security of our store (legitimate interest / legal obligation).
  • Analyze and improve our products, site, and AI features (consent, where required, or legitimate interest).
  • Comply with legal, tax, and accounting obligations (legal obligation).

Where we rely on consent (for example, certain analytics or marketing cookies), you may withdraw it at any time without affecting processing already carried out.

6. Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to object to or restrict certain processing; and to withdraw consent. To exercise any right, contact us using the details in Section 12. We will verify your request and respond within the timeframes required by law. We will not discriminate against you for exercising your rights.

EEA/UK (GDPR): you also have the right to lodge a complaint with your local data-protection authority.

California (CCPA/CPRA): you have the right to know what personal information we collect and how it is used and shared, to request deletion or correction, and to opt out of any “sale” or “sharing” of personal information. We do not sell your personal information for money. However, our use of analytics and advertising cookies (Section 3) may be considered “sharing” for cross-context behavioral advertising under California law; you can opt out via the controls in Section 8 or by sending a request to us. Note that de-identified training data may not be reversible.

7. Sharing Your Information

We share data only with vendors required to deliver our service, each acting under contractual data-protection obligations:

  • Stripe — payment processing and fraud prevention.
  • ShipEngine and shipping carriers — rate calculation and fulfillment.
  • Google (Analytics & Places) — analytics and address autocomplete.
  • GoAffPro — affiliate referral attribution.
  • Our email/SMS provider — order and shipping notifications.

We may also disclose information when required by law, to enforce our terms, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets. We do not sell your personal information for money.

8. Cookies & Your Choices

We use cookies and similar technologies for cart functionality, session management, analytics, and affiliate attribution. You can:

  • Disable or delete cookies in your browser settings (some features may break).
  • Opt out of Google Analytics using Google’s browser opt-out add-on.
  • Use a Global Privacy Control (GPC) signal or browser “Do Not Track” setting — where required by law, we treat a recognized GPC signal as a request to opt out of “sharing.”

9. Data Retention & Security

We keep personal data only for as long as necessary to fulfill the purposes described here, including order fulfillment, customer service, and legal, tax, and accounting requirements, after which it is deleted or de-identified. We use administrative, technical, and physical safeguards (including encryption in transit) to protect your data, but no method of transmission or storage is 100% secure.

10. International Transfers

Your information may be processed in the United States and other countries where our service providers operate, which may have different data-protection laws than your home country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

11. Children’s Privacy

Our store is intended for adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will delete it.

12. Contact

For privacy questions, data requests, or to exercise your rights, contact us through the support form on our website. We respond within a reasonable time frame and within any period required by applicable law.

13. Final Sales Notice

All purchases through CraFume are final. Please review our Refund Policy and Terms of Service before completing checkout.

14. Changes

We may update this Privacy Policy from time to time. The most current version is always posted on this page with a new “Last updated” date; continued use of the site constitutes acceptance of the updated Policy.

Return to checkout