Noteboxd
Last updated: 3 July 2026
Effective: 3 July 2026
Noteboxd ("Noteboxd", "we", "us", "our") operates the website at noteboxd.com and any associated mobile applications (collectively, the "Platform").
Data Controller:
Noteboxd
Contact for privacy matters:
[email protected]
We are responsible for the personal data we collect and process through the Platform. We aim to handle your data in accordance with the data protection and privacy laws that apply in the jurisdictions where we operate and where our users are located.
This Privacy Policy applies to all personal data we collect when you:
It does not apply to third-party websites linked from our Platform.
| Data | Why we collect it | Basis |
|---|---|---|
| Email address | Account creation, login, transactional emails | To provide the service |
| Username | Public identity on the Platform | To provide the service |
| Display name (optional) | Personalisation of your public profile | With your consent |
| Password (hashed) | Account security | To provide the service |
| Profile avatar (optional) | Public profile | With your consent |
| Bio / location (optional, freetext) | Public profile | With your consent |
We do not ask for your full legal name on your public profile. If you choose to enter your real name in any optional field, that is your choice.
| Data | Why we collect it | Basis |
|---|---|---|
| Cabinet entries (fragrances you own) | Core product functionality | To provide the service |
| Wishlist entries | Core product functionality | To provide the service |
| Wearing today check-ins | Social feed and wearing statistics | To provide the service |
| Reviews and ratings | Product functionality, community scoring | To provide the service |
| Lists and collections | Product functionality | To provide the service |
| Likes and follows | Social graph | To provide the service |
When you buy or sell through our marketplace we collect additional data for payment processing and transaction integrity:
| Data | Why we collect it | Basis |
|---|---|---|
| Billing and shipping address | Order fulfilment | To provide the service |
| Payment method details | Processed by Stripe — we do not store raw card data | To provide the service |
| Transaction history | Order records, dispute resolution | Service delivery / legal requirement |
Verified Seller applicants only:
| Data | Why we collect it | Basis |
|---|---|---|
| Legal full name | Identity verification, KYC compliance | Legal requirement |
| Government-issued ID | Identity verification | Legal requirement |
| Bank account details | Stripe Connect payouts | To provide the service |
| Tax identification number (if applicable) | Tax authority reporting obligations | Legal requirement |
This information is held privately. It is never displayed on your public profile.
| Data | Why we collect it | Basis |
|---|---|---|
| IP address | Security, fraud prevention, analytics | Legitimate business interest |
| Browser type and version | Platform compatibility | Legitimate business interest |
| Device type | Platform compatibility | Legitimate business interest |
| Pages visited and time spent | Product improvement, analytics | Legitimate business interest |
| Referrer URL | Marketing attribution | Legitimate business interest |
| Error logs | Debugging and reliability | Legitimate business interest |
When you contact us by email or through any support channel, we retain those communications and your contact details to handle your enquiry and maintain a record.
We use cookies and similar tracking technologies. See our Cookie Policy for full details, including how to manage your preferences. In summary:
You can withdraw consent for non-essential cookies at any time via the cookie preference centre accessible at the footer of every page.
We do not sell your personal data. We share it only in the following circumstances:
We share data with third-party processors who act under our instruction and are contractually bound by data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database hosting | EU (AWS eu-west-1) |
| Vercel | Application hosting and CDN | Global (data stored EU) |
| Stripe | Payment processing and KYC | Global |
| Resend | Transactional email delivery | United States |
| PostHog | Usage analytics | United States |
| Sentry | Error monitoring | United States |
When you complete a marketplace transaction, certain information is shared with the other party as necessary to fulfil the order — specifically your shipping address (if you are a buyer) or your seller username and shipping address (if you are a seller). We do not share legal names between buyers and sellers unless both parties are Verified Sellers or unless required for a dispute.
Your username, profile information, and public activity (reviews, wearing check-ins you choose to post, cabinet entries you choose to make public) are visible to other users of the Platform. You control visibility settings in your account settings.
We may disclose personal data where required to do so by law, court order, or to protect the rights, property, or safety of Noteboxd, our users, or others. This includes sharing with law enforcement or fraud prevention agencies where legally required.
If Noteboxd undergoes a merger, acquisition, or sale of all or part of its assets, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
Some of our service providers are located in countries other than where you live, including the United States. Whenever we transfer personal data internationally, we take steps to ensure it remains protected in accordance with this Policy and applicable data protection law, including putting appropriate contractual safeguards in place with our service providers.
We retain your personal data only for as long as necessary for the purposes described in this Policy, or as required by law.
| Category | Retention period |
|---|---|
| Account data | Duration of account + 2 years after deletion |
| Fragrance activity (reviews, cabinet, check-ins) | Duration of account. If account deleted, public reviews are anonymised (username replaced with [deleted user]) rather than removed, to preserve community data integrity. Inform us at deletion if you want full removal. |
| Marketplace transaction records | As required by applicable tax and accounting laws (typically up to 7 years) |
| Verified Seller KYC documents | 5 years post-last transaction (identity-verification and anti-money-laundering requirements) |
| Support communications | 3 years |
| Server logs / IP addresses | 90 days |
| Anonymised analytics | Indefinitely |
Depending on where you live, you may have some or all of the following rights over your personal data:
Right of access — You can request a copy of the personal data we hold about you.
Right to rectification — You can ask us to correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — You can ask us to delete your personal data. We will comply unless we have a legal obligation to retain it (e.g. transaction records) or a legitimate overriding interest.
Right to restriction — You can ask us to restrict processing of your data in certain circumstances (e.g. while you contest its accuracy).
Right to data portability — You can request your data in a structured, machine-readable format (JSON or CSV). This applies to data you provided to us and that we process on the basis of consent or contract.
Right to object — You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds.
Right to withdraw consent — Where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right not to be subject to automated decisions — We do not make solely automated decisions that produce legal or similarly significant effects about you.
To exercise any of these rights, contact [email protected]. We will respond within a reasonable time and within any period required by applicable law. We may need to verify your identity before acting on a request.
Right to complain: You may have the right to lodge a complaint with the data protection or privacy regulator in your jurisdiction.
We implement appropriate technical and organisational measures to protect your personal data, including:
No system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the relevant authorities in accordance with our legal obligations.
The Platform is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, contact us at [email protected] and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by prominent notice on the Platform. The "last updated" date at the top of this document reflects the most recent revision. Continued use of the Platform after changes take effect constitutes acceptance.
Privacy queries:
[email protected]