Privacy Policy

What we collect, and why

When you place an order: your name, email address and phone number. For deliveries we also collect the recipient's name and phone number, the delivery address, and anything you choose to add, such as a card message or delivery notes. We use this only to make, deliver and confirm your order and to contact you or the recipient about it.

When you pay: payment is handled by Stripe on their own secure page. We never see or store your card number. We receive confirmation that you paid, plus your name, email and phone number.

When you create an account or sign in: our sign-in provider (Clerk) stores your name, email address and sign-in details, including if you use Google to sign in. An account lets you see your past orders and write reviews.

When you contact us: your name, email address, optional phone number and your message, so we can reply.

When you write a review: your rating, your comment and your name appear publicly on the product page. Your email address is never shown.

Free-flower giveaways

When you reserve a giveaway bouquet we collect your name, email and phone number, and email you a link to confirm the address is yours. To keep giveaways fair (one bouquet per person), we also keep a scrambled code made from your internet connection for that giveaway. We can't turn it back into your IP address; it only tells us when several reservations come from the same connection. We use your details only to run the giveaway, send your pickup code and a reminder, and send a thank-you note afterwards.

Newsletter and email

Order emails (confirmation, status updates, refunds) are part of your order. They are not marketing.

Newsletter emails are sent only if you subscribe (or tick the box when reserving a giveaway bouquet). Subscribing means you agree to receive news and offers from us. You can withdraw that consent at any time with the unsubscribe link at the bottom of every newsletter, or by emailing us, and we will stop right away. Each newsletter identifies us as the sender and shows how to reach us.

Website visits (analytics)

We count visits to learn which pages and arrangements people find most useful. This counting is anonymous: we don't use advertising or tracking cookies, and we don't store your IP address. We record the page you viewed, the type of device (phone, tablet or computer), the website or tagged link that brought you here, and when you add an item to your cart, join the newsletter, or send us a message. To count unique visitors we use a scrambled code that changes every day, so a visit can't be linked back to you or followed from one day to the next. Our own visits as the site owner are not counted.

Cookies and storage on your device

We use only what the site needs to work: your sign-in session (set by Clerk), your shopping cart and wish list (kept in your own browser so they are still there when you come back), and security features of our payment and sign-in providers. We do not use advertising cookies.

Who we share information with

We never sell your information. We share it only with the companies that help us run the shop, and only what each one needs:

• Stripe processes payments (stripe.com/privacy).
• Clerk handles account sign-in, including Google sign-in if you choose it.
• Resend delivers our emails (orders, giveaways and the newsletter).
• Vercel hosts the website, and Prisma Postgres stores our database.
• Cloudinary hosts the product and gallery photos.

Some of these companies are based in, or store data in, the United States or other countries, so your information may be handled outside Canada and may be accessible to authorities there under local law. We may also share information if the law requires it.

How long we keep it

• Orders and payment records: for at least six years, as Canadian tax and accounting rules require.
• Newsletter subscribers: until you unsubscribe. We keep a record that you opted out so we don't email you again by mistake.
• Contact messages and giveaway details: only as long as we need them to reply or run the giveaway.
• Analytics: anonymous, with no personal details.

How we protect it

The website uses encrypted connections (HTTPS), payment details never touch our servers, and access to orders and customer details is limited to the shop owner and protected by a private sign-in. No online service can promise perfect security, but we take reasonable steps to protect your information and will tell you if a problem affects you.

Your choices and rights

You can ask us at any time to:

• show you the personal information we hold about you,
• correct anything that is wrong,
• delete your information (we may need to keep order records for tax reasons), or
• stop sending you marketing emails.

Email floralhyang@gmail.com and we will reply within 30 days. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Children

Our website is meant for adults. We do not knowingly collect information from children under 16. If you believe a child has given us their details, tell us and we will delete them.

Changes to this policy

If we change how we handle information, we will update this page and the date at the top.

Contact

Questions about privacy? Email floralhyang@gmail.com.