The short version. We collect only what we need: your email if you join our list, your name and address to ship samples, your ratings, and what you send us. We do not sell your personal information, we do not share it for targeted advertising, and our website analytics do not use cookies.
01Who we are
This Privacy Policy explains how O3 Holdings LLC, a Virginia limited liability company operating as MA(“we,” “us” or “our”), collects, uses, shares and protects personal information when you visit our website, join our list, contact us, or buy our products (together, the “Services”). For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), O3 Holdings LLC is the controller of your personal data.
This policy should be read with our Terms of Sale & Use.
02Information we collect
Information you give us
- List sign-ups and reminders: your email address and which fragrance code you asked to be reminded about.
- Sample requests: your name, email address, shipping address, the codes you requested, the shipping charge, your marketing preference, and payment status. To enforce the one-sample-per-code limit we also store a one-way fingerprint (hash) of your normalized address.
- Accounts (optional): your name, email address and marketing preference. Your password is stored only in hashed form by our authentication provider (Supabase); we never see it.
- Ratings: your overall rating, longevity and projection answers, whether you would buy a full bottle at the price we ask about, and any note, linked to your sample request.
- Messages: your name, email address, the topic, any order number, and the content of messages you send through our contact form or by email.
- Payments: card details are entered directly with Stripe, our payment processor; we do not receive or store your full card number. Stripe tells us whether a payment succeeded. When full-size products launch, we will also collect the order details needed to fulfil them.
- Reviews and feedback: anything you choose to send us about our products.
- Adverse reaction reports: if you report a reaction to a product, the details you provide, which may include information about your health. We use this only to investigate the report, meet our legal obligations as a cosmetics company, and improve product safety.
Information collected automatically
- Analytics: aggregated information about how the website is used, such as pages viewed, the referring website, approximate country, and browser, operating system and device type. See Section 7.
- Technical and security data: our hosting provider processes your IP address and request information to deliver the website, protect it against abuse, and diagnose errors.
Information from others
Payment providers, e-commerce platform providers and shipping carriers may give us information such as payment confirmation, fraud-screening results and delivery status.
We do not intentionally collect sensitive personal information, except as described above for adverse reaction reports that you choose to send us.
03How we use it
- to process, ship and support your sample requests and, later, your orders, returns and refunds;
- to apply the one-sample-per-code limit and prevent duplicate or abusive claims;
- to run your optional account and show your sample orders and ratings;
- to inform which fragrances we produce, using ratings alongside other factors, and to show rating totals on the website (never with your name);
- to tell you when ordering opens or a new fragrance is released, if you asked us to;
- to respond to your messages and requests;
- to operate, secure and improve the website, and to understand how it is used in aggregate;
- to detect and prevent fraud, abuse and security incidents;
- to record and investigate adverse reaction reports and meet product safety obligations;
- to comply with tax, accounting and other legal obligations, and to establish or defend legal claims.
We do not use your information for automated decision-making that has legal or similarly significant effects on you.
04Legal bases (EEA & UK)
If the GDPR applies to you, we rely on the following legal bases:
- Contract: to process and ship your sample requests and orders, run your account if you create one, and respond to requests related to them.
- Consent: to send you marketing emails and release announcements. You can withdraw consent at any time.
- Legitimate interests: to run, secure and improve our website, prevent fraud, measure website use in aggregate, and respond to general enquiries, where those interests are not overridden by your rights.
- Legal obligation: to keep tax and accounting records and to meet product safety and consumer protection obligations.
- Explicit consent: for any health information you choose to include in an adverse reaction report.
05Emails & marketing
We send release announcements and marketing emails only to people who asked to receive them. Every marketing email includes an unsubscribe link, and you can also ask us to remove you through privacy@maunseen.com. After you unsubscribe, we keep only the minimum needed to make sure we do not email you again. We will still send transactional messages about orders you place, such as order and shipping confirmations.
08How long we keep it
- List sign-ups: until you unsubscribe, or 24 months after our last contact with you, whichever is sooner.
- Sample requests and ratings: up to 3 years after the request, so we can apply the one-per-code limit and compare demand across batches; payment records as required by law.
- Accounts: until you ask us to close your account, then deleted within 30 days except records we must keep.
- Messages and support requests: up to 24 months after the matter is resolved.
- Order, payment and tax records: as long as required by tax and accounting law, generally seven years.
- Adverse reaction reports: as long as required by applicable product safety law.
- Security logs held by our hosting provider: for the limited period set by that provider.
We may keep information longer where needed to resolve disputes, enforce our agreements, or comply with law.
09Security
We use reasonable administrative, technical and organizational measures to protect personal information, including encrypted connections (HTTPS), access controls that limit who can read stored data, and reputable service providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and regulators as the law requires.
10International transfers
We are based in the United States, and our service providers may process information in the United States and other countries. If you are in the EEA, UK or Switzerland, your personal data will be transferred to the United States. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for more information about these safeguards.
11Your rights
Depending on where you live, you may have the right to: know what personal information we hold about you and access a copy; correct inaccurate information; delete your information; receive your information in a portable format; restrict or object to certain processing; withdraw consent at any time (without affecting processing already carried out); and opt out of marketing. We extend these rights to all of our customers regardless of where they live, subject to the exceptions the law allows.
To make a request, contact us through privacy@maunseen.com. We will need to verify your identity, usually by confirming you control the email address associated with your information. You may use an authorized agent, who must provide proof of authorization. We will respond within the time the law requires (for example, one month under the GDPR and 45 days under most U.S. state laws, which may be extended where permitted). We will not discriminate against you for exercising your rights.
If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority, or in the UK with the Information Commissioner’s Office. We would appreciate the chance to address your concern first.
12U.S. state privacy rights
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other U.S. states with consumer privacy laws may have the rights described in Section 11, plus the right to opt out of the sale of personal information, targeted advertising, and profiling. We do not sell personal information, share it for targeted advertising, or use it for profiling that produces legal or similarly significant effects.
Appeals. If we decline to act on your request, you may appeal by replying to our decision or contacting us through privacy@maunseen.com with the subject “Privacy appeal.” We will respond within 60 days, explaining our decision. If your appeal is denied, you may contact your state Attorney General (for Virginia residents, the Office of the Attorney General of Virginia).
California. In the past 12 months we have collected the categories of personal information described in Section 2 (identifiers, commercial information, internet activity in aggregate, and customer records), from the sources and for the purposes described above, and disclosed them for business purposes only to the categories of recipients in Section 6. California’s “Shine the Light” law allows California residents to ask about disclosures to third parties for their direct marketing purposes; we make no such disclosures.
13Children
Our Services are not directed to children under 13, or under 16 in the EEA and UK, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
14Changes to this policy
We may update this policy as our Services change, for example when checkout launches. We will post the updated version with a new effective date and, for material changes, notify you by email or on the website before the change takes effect where the law requires.
15Contact
O3 Holdings LLC, a Virginia limited liability company, operating as MA. Questions and requests about this policy can be sent through privacy@maunseen.com.