Studio Privacy Policy and Consumer Data Rights
This document describes how Aromahome processes inquiry parameters, laboratory specifications, telemetry identifiers, and advertising attribution signals. Built under an engineering ledger framework with real retention horizons and direct statutory controls.
Effective Date and Validation
This privacy policy took effect on October 27, 2026. It applies to all technical sessions, component catalog inquiries, chat transcripts, and advertising traffic delivered to aromahome.click.
Data Controller Identity
The data controller responsible for personal information processed through this website is Aromahome, trading at aromahome.click. Our registered physical studio address is 1301 Barton Springs Road, Austin, Texas 78704, United States. Telephone: +1 (340) 808-3421. Email desk: office@aromahome.click.
Underage Visitors and Minors
This catalog website provides industrial candlemaking components, bulk wax flakes, concentrated aroma compounds, and workshop bookings for adult craft artisans. The site is not directed to children under 16 years of age, and we do not knowingly solicit or collect personal information from minors. In the event we identify an inquiry submitted by a minor without verifiable parental consent, records are deleted immediately.
Categories of Data Collected
Aromahome records only data required to calculate component orders, assess formulation specs, and process dispatch logistics. Specifically:
site_consent_v2 in localStorage holding binary flags for telemetry storage.
Processing Purposes
We process personal data for four defined purposes: transmitting itemized quotes and formulation sheets in response to requests; coordinating studio workshop reservations; diagnosing server delivery and securing form endpoints against scripted spam; and evaluating advertising conversion signals from authorized paid search and discovery campaigns.
Legal Bases for Processing
| Data Category | Processing Purpose | Statutory Basis |
|---|---|---|
| Form Specifications (Name, Email, Phone, Address) | Quotation preparation and logistics dispatch | Contract / Steps Prior to Contract |
| Consent Choice (site_consent_v2) | Regulatory record-keeping | Legal Obligation (Art. 6(1)(c) GDPR) |
| Advertising Identifiers & Telemetry | Attribution and conversion auditing | Explicit Consent (Art. 6(1)(a) GDPR) |
| IP Address & Server Logs | Network defense and rate limiting | Legitimate Interests (Art. 6(1)(f) GDPR) |
Advertising Platforms and Click Identifiers
Aroma Home runs active customer acquisition campaigns. The site receives visitors delivered directly through google ads, microsoft advertising, and Meta Ads. When a user clicks a paid advertisement, the respective platform appends a unique parameter to the destination URL:
gclid (Google Click Identifier) to correlate landing interactions with ad impression auctions.
msclkid (Microsoft Click Identifier) to audit search network delivery and query relevance.
fbclid (Meta Click Identifier) to measure discovery campaign interactions.
Google Consent Mode v2 Standards
We enforce Google consent mode v2 as an active technical barrier. Upon page load, all four regulatory signals are held strictly denied:
ad_storage: deniedad_user_data: deniedad_personalization: deniedanalytics_storage: denied
No advertising cookies or conversion trackers are written until the visitor provides affirmative approval via our docked consent banner. If the visitor selects “Deny Optional” or re-opens preferences to revoke consent, all four parameters are immediately switched back to denied.
Global Privacy Control (GPC)
We honor the global privacy control browser signal (Sec-GPC: 1). When an incoming HTTP request carries this header, our site automatically suppresses all non-essential storage, declines commercial advertising tags, and restricts data sharing without requiring additional interaction.
Third-Party Data Processors
Aromahome shares data with third-party service providers solely to maintain web operations and deliver ad attribution:
International Data Transfers
Our studio servers and primary inquiry systems operate within the United States. When European or foreign visitors transmit inquiries, data is transferred to the United States. We ensure legal transfer mechanisms including Standard Contractual Clauses (SCCs) and adherence to the EU-U.S. Data Privacy Framework principles by our cloud service vendors.
Data Retention Schedules
We do not hold data indefinitely. In accordance with strict data minimization principles, records are scheduled for automated purge:
Technical and Operational Security
All traffic between your browser and our server is secured using current Transport Layer Security (TLS 1.3) with HSTS enforcement. Inquiry records reside on firewalled database instances with strict role-based access. Form processing scripts utilize cryptographic time validation and non-visible field barriers to deflect automated bot attacks without capturing biometric user information.
European Visitor Rights Under GDPR
If you visit our catalog from the European Economic Area or the United Kingdom, you possess specific statutory rights under gdpr:
US State Privacy Rights & CCPA Disclosures
Residents of California under ccpa (as amended by the CPRA), alongside residents of Texas, Virginia, Colorado, Connecticut, Utah, and Oregon, hold explicit statutory protections:
- Right to Know & Access: You may request the categories and specific pieces of personal information collected about you over the preceding 12 months.
- Right to Delete: You have the right to request deletion of personal information collected directly from you.
- Right to Correct: You may demand correction of inaccurate personal data maintained on our records.
- No Sale or Sharing of Personal Data: Aroma Home does not sell personal information for monetary compensation, nor do we disclose personal data to third parties for cross-context behavioral profiling without affirmative consent.
- Non-Discrimination: We do not alter component pricing, refuse workshop enrollment, or adjust service tiers for exercising privacy rights.
Supervisory Authority Complaints
If you believe our processing violates applicable privacy statutes, you hold the right to lodge a complaint. In Texas, you may file with the Office of the Texas Attorney General. In California, complaints may be lodged directly with the California Privacy Protection Agency (CPPA). In the European Union, you may contact the national Data Protection Authority of your residence.
How to Submit a Data Subject Access Request
To exercise your rights of access, correction, erasure, or opt-out, contact our Austin desk using the official coordinates below:
To protect your privacy, we verify your identity by matching your request against email records and past inquiry parameters before disclosing or deleting data.
Notice of Material Changes
We evaluate formulation bench protocols and regulatory mandates periodically. Any material modifications to this policy will be posted directly to this page with an updated effective date header. Where processing revisions alter the scope of consent previously granted, we prompt returning visitors for re-authorization.
Direct Privacy Inquiries
If you have questions regarding our bench telemetry, Consent Mode v2 implementation, or wish to clarify component data handling, contact our designated human representative:
