Privacy Policy

Scalp Sentry controls the information described in this Privacy Policy.

For privacy questions, access requests, deletion requests, correction requests, appeals, or complaints, contact us at official@nanaslab.org.

We collect information you choose to provide, including shampoo product selections, ratings, dates used, scalp concern tags, notes, product request submissions, feedback, and saved review history.

If you create or use a signed-in account, we process account and authentication information such as your Supabase authentication user id, email address, session data, and account continuity data.

When you use Scalp Sentry without signing in and start a save flow, we create a pseudonymous browser-based identifier so review history, recommendation progress, and product request status can remain available from the same browser or device.

We also generate profile and recommendation signals from your inputs, including scalp oiliness, hair thickness, hair pattern, fragrance sensitivity, review-derived scalp profile signals, ingredient preference signals, recommendation runs, saved result snapshots, and recommendation feedback.

If optional analytics are enabled, we collect analytics event data such as page views, feature usage, recommendation opens, product request events, review counts, product ids, retailer click destinations, browser/device information, IP-derived network data, and Mixpanel identifiers.

We use your information to save review history, maintain progress, calculate recommendation previews, build scalp profile and ingredient signals, show product and request status, and support account continuity if you sign in.

We use product request submissions and feedback to review missing products, improve catalog quality, troubleshoot product issues, prevent abuse, protect the service, and respond to user requests.

When optional analytics are enabled, we use analytics data to understand product usage, improve review and recommendation flows, measure funnels, diagnose reliability issues, and evaluate whether users can complete key tasks.

We use cookies, local storage, and similar technologies in three main categories: essential auth/session storage, essential service-state storage, and optional analytics storage.

We do not sell personal information. We also do not share personal information for cross-context behavioral advertising as that term is used under California privacy law.

We disclose information to service providers and subprocessors that help us operate Scalp Sentry, including AWS for hosting, CloudFront delivery, Lambda execution, logs, and PostgreSQL/RDS infrastructure; Supabase for optional authentication and session handling; and Mixpanel for optional analytics when analytics are enabled.

These providers may process identifiers, account/session data, usage data, analytics data, review-related data, product request data, logs, and operational metadata only as needed to provide, secure, monitor, and improve the service.

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including providing saved review history and recommendations, maintaining account continuity, handling product requests, keeping security and operational records, complying with legal obligations, resolving disputes, and enforcing our terms.

Review history, profile signals, recommendation snapshots, product request records, and browser-based identifiers are generally retained while they remain needed to provide the service or until you request deletion and we can verify and process the request. Optional analytics data is retained according to the settings and retention controls of our analytics provider and our operational needs.

When we delete information, some copies may remain temporarily in backups, logs, or security records until they are overwritten or no longer needed for legal, security, or operational reasons.

Depending on where you live, you may have rights to know or access the personal information we collect about you, request deletion, request correction, opt out of certain uses or disclosures, withdraw consent where processing is based on consent, limit certain sensitive data uses, and appeal a denied request.

To exercise these rights, email official@nanaslab.org and describe the request. If you are signed in, contact us from the email address associated with your account when possible. If your request concerns browser-based use, include enough information for us to reasonably verify and locate the relevant browser-based record without sending unnecessary sensitive information.

We may ask for additional information when needed to verify your request, protect your account, prevent fraud, or confirm that we are acting on the correct data. We will not require you to create a new account just to submit a rights request.

California: the categories of personal information we may collect include identifiers, commercial information, internet or electronic network activity, inferences, account/session data, product and review information, and information you choose to provide in notes, requests, or feedback. Sources include you, your browser or device, authentication providers, service providers, and our own generated recommendation/profile outputs. We use this information for the purposes described above, disclose it to service providers for business purposes, and do not sell or share it for cross-context behavioral advertising.

Washington consumer health data: depending on your location and the details you provide, scalp symptoms, scalp concern tags, fragrance sensitivity, scalp profile signals, product experiences, ingredient signals, and related recommendation outputs may be considered consumer health data. We collect and use this information to provide the review, recommendation, profile, product request, and support features you request. We may disclose it to service providers only as needed to provide, secure, monitor, and maintain the service, and you may contact official@nanaslab.org to access, delete, withdraw consent where applicable, or appeal a decision about this data.

Scalp Sentry is not a medical service and does not provide medical advice, diagnosis, or treatment.

We may update this Privacy Policy as our service, data practices, providers, or legal obligations change. When we make material changes, we will update the last updated date and provide additional notice when appropriate.