Privacy Policy

OLFANA — PRIVACY POLICY

Last updated: 17 September 2026

Applies to: Olfana for Android (com.velanta.olfana) and iOS

1. WHO WE ARE

Olfana is a fragrance discovery, collection and community service operated by Velanta (Private) Limited (“Olfana”, “we”, “us” or “our”).

Velanta (Private) Limited is the controller of the personal data described in this Privacy Policy.

Registered address:

House No. 92, Sitara Valley Phase 3
Faisalabad, Punjab 38000
Pakistan

Privacy and support contact:

olfanasupport@gmail.com

2. SCOPE

This Privacy Policy applies to:

• The Olfana mobile application
• Olfana’s Firebase backend
• Member profiles and community features
• Brand Pages and catalogue workflows
• Notifications and sponsored content
• Administrative, support and moderation tools
• Olfana’s public legal and support pages

This Privacy Policy does not govern third-party websites, social networks, messaging services or email applications opened through Olfana. Those services operate under their own privacy policies and terms.

3. DATA WE COLLECT

We collect only the information reasonably needed to provide, secure and improve the features you choose to use.

A. Account and authentication information

This may include:

• Firebase user ID
• Email address
• Email-verification status
• Sign-in provider
• Session and security information
• Name, relay email or other basic information supplied through Apple Sign In
• Google account identifier and email when Google Sign-In is used

We use this information for registration, authentication, account recovery, provider linking and account security.

If you use email and password authentication, your password is handled by Firebase Authentication. Olfana does not store your password in Cloud Firestore or its own application database.

Google and Apple receive the information necessary to complete the sign-in option you select. Apple may provide a private relay email address if you choose Hide My Email.

B. Profile information

This may include:

• Username
• Display name
• Optional biography
• Optional city
• Self-selected country
• Your choice about whether to display your country
• Profile photograph
• Private-account setting
• Profile and activity counters
• Verification status

We use this information to create and display your identity and privacy choices within Olfana.

C. Taste-profile information

This may include:

• Favourite fragrance notes
• Disliked fragrance notes
• Fragrance families
• Favourite brands
• Favourite fragrances
• Preferred occasions
• Preferred seasons
• Fragrance experience level

We use this information for onboarding, fragrance discovery, recommendations and taste comparisons.

D. Community and collection content

Depending on the features you use, this may include:

• Fragrance reviews and ratings
• Longevity, sillage and value assessments
• Occasion and season selections
• Gifted or sponsored-review disclosures
• Posts and captions
• Comments and replies
• Fragrance lists and list-cover images
• Layering combinations
• Collection entries and private notes
• Bottle-size information
• Wear-diary entries

We process this information to provide the community, collection, discovery and fragrance-diary features you choose to use.

E. Social and safety activity

This may include:

• Likes
• Saved content
• Follows
• Follow requests and approvals
• Brand Page follows
• Blocks
• Reports
• Optional report explanations and supporting information

We process this information to provide social features, enforce privacy choices, prevent abuse and perform moderation.

F. Images and media

This may include:

• Profile photographs
• Images attached to reviews
• Images attached to posts
• List-cover photographs
• Layering photographs
• Brand Page logos
• Brand Page cover images
• Brand Page post photographs
• Fragrance images submitted through Brand Page catalogue workflows

We process these images to display the content you choose to upload and to review Brand Page and catalogue submissions.

G. Brand Page information

This may include:

• Brand Page name and handle
• Brand description and country
• Logo and cover image
• Public website
• Instagram username or profile
• WhatsApp contact number
• Contact email
• Manager identities and roles
• Brand verification and ownership information
• Brand-claim submissions
• Fragrance catalogue proposals
• Submission decisions and moderation notes
• Brand Page posts
• Campaign requests and status

We use this information to create, manage, verify and publicly display Brand Pages and their approved catalogue content.

H. Notification information

This may include:

• In-app notification records
• Notification read status
• Notification preferences
• Device push-notification token
• Device platform
• Relevant activity, actor, Brand Page or destination identifiers

We use this information to provide the in-app Activity centre and, with your permission, push notifications.

I. Sponsored-content information

This may include:

• Eligible campaign and post identifiers
• Impression and interaction events
• Brand Page visits
• Attributed follows
• App language
• Self-selected country used for campaign eligibility
• Private deduplication and frequency-control records

We use this information to deliver, limit, secure and measure Olfana’s own sponsored Brand Page posts.

J. Support, moderation and administration information

This may include:

• Messages you send us
• Reports and supporting explanations
• Staff decisions and reasons
• Internal moderation notes
• Verification records
• Catalogue-review records
• Fragrance lifecycle and audit records
• Security and abuse-prevention records

We use this information for support, moderation, enforcement, accountability, dispute handling and legal compliance.

K. App, device and network information

This may include:

• App version
• Operating system
• Device model
• App-instance or device identifiers
• IP address
• Request metadata
• Crash reports
• Stack traces
• Technical and performance diagnostics

We use this information to operate and secure Olfana, analyse app performance, investigate errors and prevent fraud or abuse.

Search text is sent to our database to return matching results. Olfana does not currently maintain a separate search-history feature.

Your language, theme and a limited amount of account-related interface state may be stored locally on your device.

4. IMAGES, CAMERA ACCESS AND CLOUDINARY

When you choose an image, Olfana may use your device’s system photo picker or, after you grant permission, the camera.

On supported Android devices, the system photo picker allows you to choose specific images without granting access to your entire photo library. On iOS, the picker provides only the items you select.

Olfana does not request access to your contacts, microphone, calendar or health information. Olfana does not intentionally request or use precise device location for its current features.

Olfana does not use biometric authentication. Some Android dependencies may declare biometric-related capabilities, but Olfana does not collect or process fingerprint templates, facial templates or other biometric data.

Images are uploaded directly to Cloudinary using a short-lived, signed upload authorisation generated for your authenticated account or an authorised Brand Page.

Cloudinary may receive:

• The image file
• The authorised upload purpose
• A restricted storage folder
• A generated media identifier
• Your IP address
• Ordinary network and request information

Before storage, the required upload transformation limits the image dimensions, re-encodes the image and strips embedded profiles and metadata, including EXIF location metadata.

Olfana may retain the returned:

• Media identifier
• Delivery URL
• Dimensions
• File format
• File size
• Asset version
• Upload source
• Upload time

We use this information to validate, manage and display the image.

Images attached to public content, public profiles, Brand Pages or the public fragrance catalogue are publicly visible on those surfaces and may be accessible through a Cloudinary delivery URL.

Images associated with restricted member content follow the access controls described in Section 5. However, a media-delivery URL already obtained by another person should not be treated as confidential.

Do not upload an image that:

• You do not have permission to use
• Infringes another person’s copyright, trademark, privacy or publicity rights
• Contains information you do not want other people to see
• Violates the Olfana Terms of Use or Community Guidelines

Catalogue imagery may be supplied by a brand, licensed, editorial, created by Velanta, or submitted by an authorised Brand Page and approved through moderation.

Rights holders may report an image using the contact information in Section 17.

5. VISIBILITY AND PRIVACY CHOICES

“Public” means that information may be available through Olfana and, where a surface supports it, may be visible to signed-out visitors. It does not mean that every underlying database record can be directly searched or enumerated.

A. Catalogue information

Core fragrance, brand, fragrance-note and active catalogue information may be public.

B. Public member accounts

A public member’s profile may be opened by other signed-in members. Public community content may also be displayed to signed-out visitors on surfaces that support guest browsing.

A profile may include:

• Username
• Display name
• Optional biography and city
• Country, if the member chose to display it
• Profile photograph
• Profile counters
• Verification status
• Taste-profile information

Other signed-in members may be able to open a known profile.

C. Private member accounts

Private accounts are removed from member discovery, but the basic profile record is not treated as a secret record.

For a private account, authored content, collection information, wear diary and follow relationships are restricted to the member and approved followers, as applicable.

Pending requesters, strangers, signed-out visitors and blocked accounts do not receive access to protected private-account content.

Likes created by a private account are readable only by the member who created them.

Saved content, notification preferences, device tokens and private account settings are owner-only.

D. Lists and wear entries

Lists may have their own public or private visibility setting.

A wear entry appears in a social feed only when the member chooses to share it.

E. Brand Pages

Brand Pages, their approved public contact methods, published Brand Page posts and published catalogue content are public.

Manager identities, roles, verification materials, submission notes, commercial information and internal decisions are restricted to authorised representatives and Olfana staff.

F. Blocks and reports

Blocks are private to the person who placed them.

Reports are not readable by other app users, including the reporter after submission, unless Olfana specifically communicates with the reporter outside the reporting record.

Changing an account between public and private updates the relevant content and social records.

If a large privacy update is interrupted, Olfana may report that the operation was incomplete and allow you to retry. You should not assume that an update succeeded if the app reports an error or incomplete operation.

6. HOW WE USE PERSONAL DATA

Depending on applicable law, we process personal data using one or more of the following grounds:

A. Performance of our agreement with you

This applies when we:

• Create and operate your account
• Provide profiles, collections and community features
• Operate Brand Pages
• Provide notifications
• Publish content according to your choices
• Provide requested app functionality

B. Your choice or consent

This may apply to:

• Camera access
• Photo selection
• Push notifications
• Other optional device permissions
• Processing for which local law specifically requires consent

You can withdraw device permissions through your operating-system settings. Withdrawal does not affect processing already completed lawfully.

C. Our legitimate interests

Where permitted, this may include:

• Operating and improving Olfana
• Personalising discovery and recommendations
• Protecting users
• Preventing fraud and abuse
• Enforcing our Terms and Community Guidelines
• Moderating reports and catalogue submissions
• Diagnosing crashes and improving reliability
• Delivering and measuring sponsored Brand Page posts
• Protecting our legal rights and platform integrity

D. Legal obligations and legal claims

We may process and retain information when necessary to:

• Comply with applicable law
• Respond to lawful requests
• Maintain required business or tax records
• Establish, exercise or defend legal claims
• Protect the rights and safety of users or others

Some information is necessary to provide an account or a requested feature. If you do not provide it, that feature may be unavailable.

7. SPONSORED CONTENT, ADVERTISING AND PAYMENTS

Olfana may display clearly labelled “Sponsored” posts from verified Brand Pages in the For You feed.

These are existing Olfana Brand Page posts. They are not advertisements delivered through a third-party advertising network.

Sponsored-post eligibility and frequency controls may use:

• Authentication status
• App language
• Self-selected country
• Brand Page follows
• Brand Page management relationships
• Blocks

Olfana’s sponsored-post system does not use:

• Precise device location
• Contacts
• Wear diary
• Fragrance collection
• Taste profile
• An external advertising profile
• The Android advertising ID

The system may record an impression after the required visibility period, together with taps, Brand Page visits and an attributed follow within the applicable attribution window.

Brands receive aggregate campaign-delivery and engagement totals. They do not receive the identities of individual members who viewed or interacted with a sponsored post.

Olfana does not sell personal data and does not disclose personal data for cross-context behavioural advertising.

Olfana does not currently use a third-party advertising SDK.

The Android application includes Google Analytics for Firebase. Its dependency may declare access to the Android advertising-ID permission and may process device or app-instance identifiers depending on device and Firebase settings. Olfana’s own sponsored-post system does not use the Android advertising ID.

Olfana does not sell fragrances and does not process consumer purchases or payments inside the app.

If you visit a brand’s external website, Instagram account, WhatsApp destination or email address, any purchase or communication occurs directly between you and that external party. Olfana is not the seller, merchant, payment processor or contracting party for such a transaction.

Brand promotion terms and invoicing are handled separately from the consumer application and may be retained as restricted commercial records.

8. SERVICE PROVIDERS AND DISCLOSURES

We do not sell personal data.

We disclose information only as reasonably necessary for the purposes described in this Privacy Policy.

A. Google Firebase and Google Cloud

Used for:

• Firebase Authentication
• Cloud Firestore
• Cloud Functions
• Firebase Cloud Messaging
• Firebase Analytics
• Firebase Crashlytics
• Administrative hosting and tools
• Secrets and operational logging

B. Cloudinary

Used for:

• Signed image uploads
• Image processing
• Media storage
• Image delivery

C. Google Sign-In

Used when you choose to authenticate using your Google account.

D. Apple Sign In

Used when you choose to authenticate using your Apple ID.

E. Google Gmail

Used to receive and manage messages sent to our published support email address.

F. Google Sites

Used to publish Olfana’s public legal and support pages.

G. Other Olfana users and visitors

They receive information that you choose to make visible through your profile, community content, Brand Pages and public catalogue workflows.

H. Authorised Olfana staff

Authorised staff may access information as necessary to operate support, moderation, verification, catalogue, security and commercial workflows through restricted administrative tools.

I. Authorities, courts, advisers and transaction parties

We may disclose information:

• When required by applicable law or a valid legal process
• When reasonably necessary to protect rights, safety or platform integrity
• To professional advisers subject to appropriate duties
• In connection with a legitimate merger, financing, restructuring, acquisition or transfer of business assets, subject to appropriate safeguards

Firebase Storage is not currently used. Olfana uses Cloudinary for media storage and delivery.

Firebase App Check is not currently enforced. Other protections include Firebase Authentication, server-side authorisation, Firestore Security Rules, scoped media-upload authorisations, validation and restricted administrative access.

9. ANALYTICS, DIAGNOSTICS AND NOTIFICATIONS

Firebase Analytics and Firebase Crashlytics are enabled in non-debug versions of Olfana.

Depending on the platform and Firebase configuration, these services may process:

• App-instance identifiers
• Device information
• App engagement information
• IP-derived approximate location
• Crash reports
• Stack traces
• Performance and technical diagnostics

Olfana does not intentionally send the text of your posts, reviews, comments or reports to these services as analytics properties.

Provider retention periods are controlled through Firebase configuration and may change. You may contact us if you need information about the currently configured retention settings.

If you allow push notifications, Firebase Cloud Messaging supplies a token for your device.

Olfana stores the token under your account together with its platform and update time.

Notification records may identify:

• The type of activity
• A relevant member or Brand Page
• The related content
• The destination that should open when the notification is selected

Tokens are removed during sign-out where possible, removed through account deletion, rotated by the provider and pruned when reported invalid.

You may disable push notifications in your device settings and continue using the in-app Activity centre.

10. INTERNATIONAL PROCESSING AND TRANSFERS

Olfana’s Cloud Firestore database is hosted in Google’s nam5 United States multi-region. Cloud Functions primarily operate in us-central1.

Personal data may therefore be transferred to and processed in the United States.

Cloudinary operates a global content-delivery network. Images and request information may be processed in countries where Cloudinary or its service providers operate.

Google and Apple may also process information internationally under their own service arrangements.

Where applicable law requires additional safeguards, we rely on provider data-processing terms, contractual safeguards such as Standard Contractual Clauses, and other lawful transfer mechanisms.

The applicable transfer mechanism may depend on your location and the recipient.

11. DATA RETENTION

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

A. Account, profile, private settings and member content

Normally retained until:

• You remove the information
• Your account is deleted
• Moderation requires earlier removal or restriction

Some audit and safety exceptions are described below.

B. Push-notification tokens

Normally retained until:

• Sign-out
• Token invalidation
• Token replacement
• Account deletion
• Successful device or server cleanup

C. Reports, moderation and security records

Reports, moderation decisions, catalogue or verification records, fraud evidence and security records may be retained for as long as reasonably necessary to:

• Protect users
• Document decisions
• Prevent repeated abuse
• Resolve disputes
• Comply with legal obligations
• Establish, exercise or defend legal claims

These records may outlive removed content or a deleted account.

D. Brand Page records

Brand Page management, authorship and lifecycle records may be retained while the Brand Page or record remains necessary and afterwards when required for continuity, accountability, disputes or legal claims.

E. Sponsored-content records

Advertising event keys and per-member delivery budgets are normally retained for approximately 30 days.

Deletion may occur later if a cleanup process is delayed or information remains temporarily in provider backups.

Daily aggregate sponsored-delivery totals may be retained for up to 24 months for campaign reporting and disputes. These aggregate totals do not contain member identities.

F. Commercial and billing records

Brand Page commercial, invoicing and billing records may be retained as required for accounting, tax, contractual and dispute purposes.

G. Analytics, diagnostics, logs and support messages

These are retained according to configured provider settings and legitimate operational, security, support or legal requirements.

Deleted information may remain temporarily in caches, logs and routine provider backups until overwritten or expired under the provider’s normal retention cycle.

12. DELETING YOUR ACCOUNT

To delete your account in Olfana:

1. Open Settings.

2. Select Delete account.

3. Read the permanent-deletion warning.

4. Provide a reason.

5. Type the exact, case-sensitive word DELETE.

6. Submit the deletion request.

The reason is normalised and validated and must not exceed 500 characters. It is used to confirm deliberate intent and is not stored or logged.

The server identifies the account exclusively from your authenticated Firebase session. It does not accept a user ID supplied by the mobile interface.

Google-only, Apple-only and password users are not asked for a password or provider reauthentication during this deletion flow.

The resumable account-deletion process removes applicable information, including:

• Public profile
• Private settings
• Account email stored in Olfana records
• Username reservation
• Searchable member entry
• Collection and wear records
• Notifications and device tokens
• Authored reviews
• Member posts
• Comments
• Lists
• Layering combinations
• Comments on the deleted member’s content
• Likes
• Saved content
• Follow relationships in both directions
• Brand Page follows
• Blocks created by the member
• Firebase Authentication account

The Firebase Authentication account is deleted last so an interrupted deletion may be retried safely.

Important exceptions and limitations:

• A member who owns a live Brand Page must first transfer ownership or close the Brand Page. This prevents a public Brand Page from being left without an accountable owner.

• Reports, moderation evidence, audit records, restricted Brand Page authorship or management history, commercial records and blocks created by other people may retain the former account identifier when reasonably necessary for safety, accountability, disputes or legal claims. These records do not restore the deleted account as an active profile.

• We attempt to remove member-scoped Cloudinary uploads. Brand Page media belongs to the Brand Page and is not removed merely because one Brand Page manager deletes their personal account.

• A failed or interrupted upload, failed media purge or upload that never became attached to a database record may leave an orphaned Cloudinary asset until it can be safely removed manually or through a future cleanup system. Contact us if you believe media remains after account deletion.

• Deleting your Olfana account does not automatically revoke Olfana’s Apple authorisation from your Apple account. If desired, remove Olfana from the applications using your Apple ID through your Apple account settings.

• Account deletion is permanent. If a server failure interrupts the process, the deletion request is designed to be retryable. However, information already deleted during a partial attempt may not be recoverable.

If you cannot access the in-app deletion option, email:

olfanasupport@gmail.com

When possible, send the request from the email address associated with your Olfana account.

We may take reasonable steps to verify the request. We aim to complete verified deletion requests within 30 days, subject to lawful exceptions.

13. YOUR RIGHTS AND CHOICES

Depending on your location and applicable law, you may have rights to:

• Access your personal data
• Correct inaccurate information
• Receive a copy of certain information
• Request deletion
• Request restriction of processing
• Object to certain processing
• Withdraw consent
• Complain to a data-protection or privacy authority

You can manage many choices directly in Olfana, including:

• Editing your profile and content
• Changing account privacy
• Managing notification preferences
• Removing content
• Withdrawing device permissions through system settings
• Using the in-app account-deletion process

To exercise another privacy right, contact:

olfanasupport@gmail.com

We may need to verify your identity before completing a request.

A request may be limited where permitted by law, including when necessary to protect security, prevent fraud, preserve the rights of other people, or retain records that we are legally or reasonably required to maintain.

You may also complain to the competent privacy authority in your country.

14. CHILDREN AND MINIMUM AGE

Olfana is not directed to children.

You must be at least 16 years old to create an Olfana account.

We do not knowingly collect personal data from anyone under 16 and do not currently provide a parental-consent process.

If you believe a person under 16 has created an account, contact us at olfanasupport@gmail.com so we can investigate and take appropriate action.

Local law may require a higher minimum age or additional consent.

15. SECURITY

We use reasonable technical and organisational safeguards, including:

• Encrypted network connections
• Provider encryption at rest
• Firebase Authentication
• Default-deny Firestore Security Rules
• Server-side ownership and role checks
• Purpose-scoped and owner-scoped media-upload authorisations
• Restricted administrative access
• Input validation
• Rate limits
• Audit records
• Security and abuse monitoring

No service or transmission method is completely secure. We cannot guarantee absolute security.

16. EXTERNAL DESTINATIONS AND POLICY CHANGES

Brand Page buttons may open:

• A validated HTTPS website
• An Instagram profile
• A WhatsApp destination
• An encoded email destination

After you open an external destination, the third-party provider may independently receive ordinary connection information and any information you choose to provide.

Olfana does not control those external services, their availability, their privacy practices or transactions conducted through them.

We may update this Privacy Policy when Olfana’s features, providers, legal obligations or data practices change.

When we make an update, we will revise the “Last updated” date.

Where a change is material and applicable law requires additional notice, we may also provide notice through Olfana or another appropriate communication channel.

17. CONTACT US

Velanta (Private) Limited

House No. 92, Sitara Valley Phase 3
Faisalabad, Punjab 38000
Pakistan

Privacy and support email:

olfanasupport@gmail.com