Privacy policy

This policy explains what personal data Aura Deco Candles SL collects when you use Molekule, why we process it, who we share it with and the rights you have under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law.

Who is responsible for your data

The data controller is Aura Deco Candles SL, ESB119394022, Paseo de la Zona Franca 145, A61, 08038 Barcelona, Spain. You can reach us about anything in this policy at admin@auradecocandles.com.

What we collect

• Account data — your name and email address, managed through our authentication provider when you sign up or sign in.
• Content you upload — fragrance safety data sheets (SDS), formulations, product and brand details, and label designs you create in the app.
• Billing data — your subscription plan and payment status. Card details are handled by our payment provider; we never see or store your full card number.
• Usage and technical data — your language preference, log data, anonymous first-party analytics about which pages are viewed (no cookies are set and no IP address is stored), and metadata about the AI processing we run on your behalf (such as token counts and cost), used to operate, secure and improve the service.

Why we process it and on what legal basis

• To provide the service you have asked for — performance of our contract with you (Art. 6(1)(b) GDPR).
• To bill you and keep accounting records — performance of the contract and compliance with our legal obligations (Art. 6(1)(b) and (c)).
• To secure and improve the service — our legitimate interests in running a reliable, safe product (Art. 6(1)(f)).
• For optional communications such as product updates — your consent, which you can withdraw at any time (Art. 6(1)(a)).

Who we share it with

We use a small number of processors that handle data on our behalf under written agreements:

• Authentication — to manage your account and sign-in.
• Database and application hosting — to store your data and run the service; our application runs in an EU (Madrid) region.
• AI processing — to read your uploaded safety data sheets and extract the compliance data the service needs.
• Payment processing — to take subscription payments.

If you accept advertising cookies, Google (Google Ads, via Google Tag Manager) receives data about the ad you clicked and whether you then started a paid trial, so we can measure our advertising. Google acts as an independent controller for this data, and we rely on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the Cookie settings link in the site footer. See our Cookie policy.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. We do not sell your personal data.

How long we keep it

We keep your account and content for as long as your account is active, and delete or anonymise it after your account is closed, except where we must retain certain records (for example invoices) to meet our legal and accounting obligations.

Your rights

You have the right to access, rectify, erase, restrict and port your personal data, and to object to certain processing. You can withdraw any consent at any time. To exercise these rights, contact admin@auradecocandles.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Security and minors

We take appropriate technical and organisational measures to protect your data. The service is intended for businesses and is not directed at children; we do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy as the service evolves. We will change the "last updated" date below and, for material changes, take reasonable steps to let you know.