Privacy policy

NEXT LVL YOUNG SRL, with its registered office in Strada Păcii, Nr. 8, Plopeni, Județ Prahova, registered with the Trade Registry under no. J29/2512/2022, VAT ID 46743402, is the controller of your personal data within the meaning of Regulation (EU) 2016/679 (GDPR).

For any question about your data, you can write to us at hello@oryn.ro.

Onboarding data: your quiz answers and, if you choose the conversation, the transcript of your discussion with our assistant. These may include information about your preferences, memories and personality, to the extent you choose to share them with us.

Order and delivery data: name, e-mail address, phone number, delivery address, order history.

Payment data: payments are processed by Stripe; we do not store your card details, only the confirmation and the transaction identifier.

Technical data: standard information about your use of the website (IP address, browser type), required for security and proper operation.

Creating your perfume: we use your onboarding answers to compose your olfactory profile and your unique formula. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Order processing and delivery: we handle payment, preparation and shipping of the product, as well as order-related communications. Legal basis: performance of the contract.

Legal obligations: we issue and retain fiscal documents. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Security and service improvement: we analyse how the website operates, measure in aggregate how many people complete or abandon each step of the order flow, and prevent fraud. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for automated decisions with legal effects, and we never sell your data to anyone.

Onboarding conversation transcripts and quiz answers are kept for as long as your account exists: they are the basis of your profile and of any later evolution of it. We delete them together with your account, or whenever you ask us to.

Your olfactory profile and your perfume's formula are kept for as long as you want to be able to reorder your perfume; we delete them at your request.

Fiscal documents are kept for the period required by tax legislation (currently 10 years). Order and delivery data are kept for 3 years after your last order, for any conformity-related claims.

We use a small number of processors, each with access only to the data strictly necessary for the service provided: Stripe (payment processing), Supabase (database hosting), Vercel (application hosting), Anthropic (processing of AI assistant conversations), Resend (transactional e-mails), Amplitude (product usage analytics), Sentry (error monitoring) and the courier company (order delivery).

Some of these providers may process data outside the European Economic Area. In such cases, the transfer is based on appropriate safeguards, such as the standard contractual clauses approved by the European Commission.

Analytics events sent to Amplitude include an approximate location (country, region, city), estimated from the request's IP address; the IP address itself is not shared with Amplitude.

Under the GDPR, you have the right of access to your data, the right to rectification, the right to erasure ("the right to be forgotten"), the right to restriction of processing, the right to data portability and the right to object.

To exercise any of these rights, write to us at hello@oryn.ro; we respond within 30 days at the latest. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

We apply appropriate technical and organisational measures to protect your data: encrypted communications, role-based access restrictions, storage with certified providers and access monitoring. No system is infallible, however; in the event of a security incident posing a risk to your rights, we will notify you as required by law.

We only use cookies strictly necessary for the operation of the website (for example, to remember your chosen language and your session). The necessary session identifier is also used server-side, in aggregate, to count how many people go through each step of the order flow. We do not use advertising cookies and we do not track your activity on other websites.

We may update this policy to reflect legislative or operational changes. We will publish any new version here, together with the date of the update, and for significant changes we will inform you by e-mail.