Privacy and trust

Trust is the commercial moat. If users think their private scent memory is being sold, the brand intelligence product dies. If retailers think the corpus is loose, the API product dies. If brands can buy irrelevant recommendations, the consumer product dies.

User data

• Private notes stay private.
• Partner data needs partner consent.
• Brand dashboards use aggregate, thresholded data only.
• Admin exports must not leak raw rows.
• User deletion and export flows must be respected across comms and analytics.

Sponsored surfaces

• Label sponsorship clearly.
• Show only when relevant.
• Keep organic explanation separate from paid placement.
• Store impression and click logs.
• Allow users to understand why something appeared.

Commercial access

• API keys are hashed at rest.
• Scopes are narrow.
• Usage is metered.
• Rate limits are enforced.
• Enterprise contracts do not override privacy rules.
• MCP writes are explicit, audited, and reversible where possible.

Corpus trust

• Confidence tiers are visible.
• Source evidence is tracked.
• Corrections are auditable.
• Limited data is labelled.
• No blocked-source scraping.