Privacy standards govern every inquiry and platform tag.

Effective date and regulatory baseline.

This Privacy Policy took effect on October 27, 2026. It applies to all electronic inquiries, direct consultation exchanges, support chat sessions, and advertising network interactions routed through aromaoil.click. All terms reflect active compliance enforcement for United States state privacy laws and cross-border standards for international visitors.

Data controller identity and trade presence.

The data controller responsible for the processing operations described on this site is Aromaoil, trading at aromaoil.click. Our registered physical workshop and consultation office is located at 720 South Michigan Avenue, Chicago, Illinois 60605, Chicago, Illinois, United States. Telephone communications route directly to +1 (340) 006-6875 and written privacy inquiries to office@aromaoil.click. Our commercial registration is maintained as an active filing with the Illinois Secretary of State.

Categories of data collected across interactions.

We limit data intake strictly to operational and inquiry requirements. We do not operate user accounts, customer logins, or binding checkout portals. The data categories collected comprise:

• Direct Inquiry Data (zogu4dd.php): Name, telephone number, electronic mail address, postal or delivery address, inquiry classification, formulation notes, custom diffusion specifications, and explicit consent records.
• Real-time Support Interactions (kevo997.php): Conversation message history and a generated alphanumeric session token preserved locally in browser localStorage to maintain dialog continuity.
• Technical Server Telemetry: Internet Protocol (IP) address, browser user-agent string, operating system type, HTTP referring URL, page rendering timestamp (ts), and server dispatch timestamp.
• Advertising Click Identifiers: Inbound campaign click tokens appended by verified advertising partners, specifically gclid for Google, msclkid for Microsoft, and fbclid for Meta.

Purposes of data processing operations.

Data collected through aromaoil.click is used for precise, delimited operational activities:

1. Preparing and responding to custom aroma oil formulation inquiries and volume quotes.
2. Calculating diffuser dosage, drop density, and carrier vehicle compatibility for specific room hardware.
3. Facilitating scheduled client consultations at our 720 South Michigan Avenue workshop.
4. Preventing automated abuse and bot form submissions via non-intrusive honeypot fields (`department` and `site`).
5. Measuring inbound advertising campaign conversion efficacy across Google Ads, Microsoft Advertising, and Meta Ads in strict compliance with the visitor’s declared consent signals.

Legal bases for processing under applicable frameworks.

Each processing activity is executed under an established legal basis:

Active advertising platforms and click identifiers.

This website is an active destination for paid commercial acquisition. We purchase advertising placements across google ads, microsoft advertising, and Meta Ads. When a visitor reaches this site by clicking a sponsored commercial link, the corresponding advertising network automatically appends a unique alphanumeric click identifier to the landing URL:

• gclid: Google Click Identifier, utilized by google ads for campaign attribution and performance measurement.
• msclkid: Microsoft Click Identifier, appended by microsoft advertising to track ad engagement across the Bing search ecosystem.
• fbclid: Meta Click Identifier, appended by Meta Ads across Facebook and Instagram properties.

These identifiers allow platforms to determine which campaign generated an inquiry. They do not grant us access to your private profile credentials on those platforms. No advertising platform has reviewed, approved, or certified this studio or catalog.

Google Consent Mode v2 operational architecture.

In full compliance with contemporary digital advertising directives, aromaoil.click deploys consent mode v2. Prior to any visitor interaction with the consent banner, four fundamental tracking flags are initialized in the script layer with an explicit default state of denied:

1. ad_storage — denied
2. ad_user_data — denied
3. ad_personalization — denied
4. analytics_storage — denied

While in the denied state, advertising scripts do not write persistent cookies or transmit personal user identifiers. If the visitor clicks “Accept All”, these four signals are updated to granted. If the visitor selects “Strictly Necessary” or navigates away without accepting, all four parameters remain denied. If consent is subsequently withdrawn via the footer settings control, all four parameters are instantly reverted back to denied.

Third-party data processors and infrastructure partners.

Personal data is shared only with verified service providers necessary to operate this catalog and manage inbound communications:

• Google LLC / Google Ireland Ltd: Web analytics and Google Ads conversion processing subject to Consent Mode v2 gating.
• Microsoft Ireland Operations Ltd: Microsoft Advertising conversion telemetry and audience measurement. Visitors can review complete platform handling directly at the Microsoft privacy statement: privacy.microsoft.com.
• Meta Platforms Ireland Ltd: Meta Ads conversion tracking and ad delivery analytics.
• Hosting & Storage Infrastructure: Secure web servers maintaining our application code, zogu4dd.php endpoint, and local SQLite/JSON inquiry storage in United States enterprise data facilities.
• Mail Routing Relay: Encrypted SMTP relay delivering notification copies of website inquiries to the formulator inbox at office@aromaoil.click.

International data transfers and cross-border safeguards.

Aroma Oil Studio is based in Chicago, Illinois, United States. If you access aromaoil.click from outside the United States, your inquiry data and technical telemetry will be transferred to, stored, and processed on servers located within the United States. Where personal data of European Economic Area or United Kingdom residents is transferred, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent adequacy determinations under international frameworks.

Data retention schedules and automated purging.

We enforce finite, deterministic data retention schedules. Information is never retained indefinitely under ambiguous “as long as necessary” disclaimers:

• Catalog Inquiries & Email Records: Retained for 18 months from submission to reference formulation batches, past bottle specs, and repeat trade requests, after which they are permanently deleted.
• Support Chat Transcripts: Retained for 6 months from conversation termination to resolve ongoing formulation advice.
• Server Web Access Logs: Retained for 90 days for security auditing, DDoS analysis, and server debugging, after which files are automatically rotated and purged.
• Consent Preference Records: Retained in the browser under site_consent_v2 for 12 months, requiring periodic renewal.

Technical and organizational security measures.

We protect your data against unauthorized access, alteration, and loss. All network communications are encrypted in transit using Transport Layer Security (TLS 1.3 with HTTPS enforcement). Server access is restricted through SSH key-based authentication with strict firewall rules. Database records are stored with hardened directory permissions, and inquiry forms are guarded by server-side rate limiters, input sanitization, and hidden honeypot validation.

European visitor rights under GDPR framework.

Visitors located in the European Union and European Economic Area possess statutory rights under the General Data Protection Regulation (gdpr):

• Right of Access: You may request confirmation of whether we process your personal data and obtain a machine-readable copy.
• Right to Rectification: You may correct inaccurate or incomplete formulation notes or contact details.
• Right to Erasure (“Right to be Forgotten”): You may request complete deletion of your past inquiries and chat records.
• Right to Restriction: You may ask us to pause processing during an active dispute over data accuracy.
• Right to Data Portability: You may receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to data processing carried out under our legitimate interest basis.
• Right to Withdraw Consent: You may revoke consent at any moment via the footer cookie settings control without affecting lawful processing conducted prior to revocation.

United States state privacy disclosures and CCPA standards.

Under California law (the California Consumer Privacy Act as amended by the California Privacy Rights Act — ccpa / CPRA), as well as privacy statutes in Illinois, Virginia, Colorado, Connecticut, Utah, and Oregon, residents have specific rights regarding their personal information:

• Right to Know and Access: California and US residents may request the categories and specific pieces of personal information collected over the preceding 12 months.
• Right to Delete: You may request that we delete personal information collected directly from you.
• Right to Correct: You may request correction of inaccurate personal details maintained in our records.
• Sale and Sharing Prohibition: We do not sell personal information for monetary value. We do not share personal information with third parties for cross-context behavioral advertising without affirmative consent.
• Non-Discrimination: We never discriminate against any client, withhold catalog quotes, or alter formulation pricing based on the exercise of statutory privacy rights.

Global Privacy Control browser signal recognition.

Our website recognizes and respects the global privacy control (GPC) signal broadcast via HTTP headers (Sec-GPC) or DOM properties by compatible web browsers. When our system detects an active GPC signal, all optional marketing storage and conversion tracking tags are automatically maintained in their denied state, functioning as a valid statutory opt-out of cross-context behavioral tracking without requiring manual interaction with our consent banner.

Protection of minors and child privacy policy.

Our catalog, commercial room fragrance products, and consultation services are intended exclusively for adult homeowners, business operators, and individuals aged 18 and older. We do not knowingly solicit, collect, or retain personal data from children under the age of 16. If we become aware that an inquiry was submitted by a minor under 16 without verified parental consent, we will immediately purge the record from our database and email logs.

Supervisory authorities and dispute complaints.

If you believe our processing of your personal information infringes statutory privacy standards, you have the right to lodge a formal complaint with an appropriate supervisory authority:

• Illinois Residents: Office of the Illinois Attorney General, 100 West Randolph Street, Chicago, IL 60601.
• California Residents: California Privacy Protection Agency (CPPA) or the Office of the California Attorney General.
• European Union Residents: The competent Data Protection Authority (DPA) in the EU Member State of your habitual residence or place of work.

Exercising data subject rights and DSAR protocol.

To exercise any of the statutory rights described in this policy, you may submit a formal Data Subject Access Request (DSAR) through our dedicated portal at aromaoil.click/data-request.html or by emailing our privacy team directly at office@aromaoil.click.

We must verify your identity before releasing or deleting records. Verification requires matching your request email or telephone against an existing inquiry in our database. We answer every verified data request within 10 days of receipt, at zero administrative cost to the applicant.

Notification of policy revisions and archival records.

We may periodically revise this Privacy Policy to reflect modifications in our formulation catalog, changes in digital marketing infrastructure, or revisions to governing statutory requirements. When updates are published, the effective date at the head of this document is updated accordingly. Substantive amendments that expand how personal inquiry data is processed will be announced via a prominent notice on our homepage thirty days prior to implementation.

Human privacy contact and studio inquiry desk.

For questions regarding this Privacy Policy, your rights, or our platform tagging practices, contact our primary operator directly: