Privacy Policy

Who we are

Flourish Bakers (“Flourish Bakers”, “we”, “us”) is a software platform that provides home bakers with online storefronts, pre-order management, and related tools. Questions: privacy@flourishbakers.com

Information we collect

From customers (people who order from bakers):

• Name and email address (for order confirmations and status updates)
• Order details: items, pickup date, special notes, any tip you add, and any discount code you apply
• If you tell us someone else is picking up your order, that person's name and phone number (optional, shared with the baker only so they know who to expect at pickup)
• Your delivery address when you choose delivery (shared with the baker fulfilling that order only)
• Reviews and ratings you submit (the rating, your written review, and the name shown with it, see “Reviews” below)
• The bakers you save as favourites (so you can follow them and find them again)
• If you ask us to bring a baker to your area, the email and area (city/zip) you provide, used to decide where to recruit bakers and to let you know when one joins near you
• Account password (hashed; we never see the plaintext)

From bakers (store owners):

• Name, email, and store details (name, description, location)
• Your stated store location, which we convert into approximate map coordinates to power location-based discovery (see “Location information” below)
• Account credentials (password hashed via Supabase Auth)
• Order and revenue data for their own dashboard analytics

If you’re moving your store from another platform and you upload a customer list you already have (for example, a spreadsheet from a shop that closed), we store that list on your behalf so you can keep your own records. We don’t contact anyone on an imported list ourselves, and nobody on it is added to any Flourish Bakers or baker marketing list.

Automatically collected:

• Page views and navigation patterns (via Vercel Analytics, anonymous)
• Browser type, device type, and approximate location (country/region)
• When you click through to a baker from our marketplace, or view a baker’s storefront, we record an anonymised discovery event so we can show that baker how many people found them via Flourish Bakers. We identify the visit only by a one-way salted hash of your IP address and browser type. We never store the raw values, and the resulting count is aggregated and cannot be traced back to you.
• When you sign in or create an account, we record a fraud prevention entry. It holds one-way scrambled versions of your email address, your phone number if you gave us one, your browser and device, and your IP address, plus the country your request came from, and a fraud risk score we work out from them. We never store the raw values in that record. Separately, our sign-in provider, Supabase, keeps a session record for each sign-in that holds the IP address your request came from, your browser’s name and version, and a random identifier for your device, so that we can recognise a device we have not seen before and keep your account safe. See “Fraud prevention” below.
• Error logs for debugging (no PII included)

The waitlist, law-change notes and emailed slips

Our free guides and tools have a few places where you can leave an email address. When you join the founding bakers, we keep your email and, if you give them, your ZIP code and a few words about what you bake. When you ask for a home baker near you, we keep your email and ZIP code. When you ask to hear when your state’s cottage food law changes, or email yourself a slip from one of our calculators, we keep your email, your state and the page you asked from. The numbers on a slip go into that one email and the link inside it; we do not store them.

We use your address only for what you asked for: one note to say you are on the list, then word when we open near you, or a note when your state’s law changes. Each email about the list or about your state’s law has a link that takes you off the list in one press. To be taken off anything else, write to privacy@flourishbakers.com.

How we use your information

• Send order confirmation and status update emails
• Provide bakers with their store dashboard and order management tools
• Process customer order payments and baker subscription payments (via Stripe; we never see card numbers)
• Improve the platform through anonymised usage analytics
• Respond to support requests
• Send transactional emails (order updates, payment and pickup reminders, account alerts)
• If you follow (favourite) a baker, or ask to be told when a sold-out or not-yet-listed item is available, send you occasional updates about that baker, for example when they post a new special, a reminder if you haven’t ordered from them in a while, or that item becoming available. You can stop these any time by un-following the baker from your account, or the link at the bottom of any of those emails. We do not send unrelated marketing or sell your information to advertisers.

What bakers can see about you

When you place an order with a baker on Flourish Bakers, as a guest or a signed-in customer, that baker receives your name, email address, and the details of your order (items, pickup date, notes, and, if you provide it, the name and phone number of the person picking up) so they can prepare and hand off your order, and so they can see your past order history with their shop in their dashboard (e.g. to recognise repeat customers).

Bakers can only see this for customers who have actually ordered from their shop. A baker cannot look up or browse the name, email, or order history of customers who have never ordered from them. This is enforced at the database level, not just in the app’s interface.

Location information

To help customers find bakers near them, we convert a baker’s stated store location (for example, a city) into approximate latitude/longitude coordinates using a third-party geocoding service. These coordinates are tied to the public storefront, not to any individual customer.

If you, as a customer, choose to share your device’s location to sort bakers by distance, that location is used only in your browser to calculate distances. It is never sent to or stored by Flourish Bakers, and you can decline the request without losing access to discovery.

Reviews

When you review a baker after a completed order, your rating, written review, and the name you provide are shown publicly on that baker’s storefront and across the Flourish Bakers marketplace. Please don’t include sensitive personal information in a review. If you delete your account, your past reviews are kept but anonymised: the name is replaced and the review is no longer linked to your identity.

Reporting a problem with an order

If you report a problem with an order, we store your message, your email address, and the order it refers to, and we share all of it with the baker the report is about. They see it on their own order page and we email it to them, so nothing you tell us is hidden from them. We keep the report as a record of the complaint even if you later delete your account.

Third-party services

We use these trusted services to operate the platform. Each has its own privacy policy.

• Supabase: database and authentication. Data stored in US East (AWS). supabase.com/privacy
• Vercel: hosting, CDN, and analytics. vercel.com/legal/privacy-policy
• Resend: transactional email delivery (order confirmations and status updates). resend.com/privacy-policy
• Twilio SendGrid: backup transactional email delivery, used if our primary provider is unavailable. twilio.com/legal/privacy
• Stripe: payment processing for customer orders and baker subscriptions. stripe.com/privacy
• Upstash: rate limiting and abuse prevention; processes IP addresses transiently to protect the platform. upstash.com/trust/privacy
• OpenStreetMap / Nominatim: converts a baker’s stated location, and the ZIP code of a delivery address, into approximate map coordinates (we send the ZIP only, never the street address). osmfoundation.org/wiki/Privacy_Policy
• Slack: our team’s messaging. When you write to us from the help page, your name, email address, topic and message reach our team there, and so does a note that someone joined the waitlist, with the ZIP code they gave. slack.com/trust/privacy/privacy-policy

Fraud prevention

People have tried to game marketplaces like ours by making many accounts, so we keep a small record each time someone signs in or signs up. It notes your email address, your phone number if you gave us one, the browser and device you used, and the IP address the request came from. Every one of those is stored as a one-way scrambled value, which means we can tell that two sign-ins came from the same place without ever holding the original. We also keep the country your request came from, and nothing finer than that. The sign-in session record at our provider is separate from this one and does hold the raw IP address and the random device identifier.

We use this for one thing: spotting when a single person is running several accounts to claim rewards meant for different people. From these records we also work out a fraud risk score, which we store alongside them. It never affects whether you can sign in, and it never affects placing or paying for an order.

Here is the only thing it can do. If two accounts that look like one person refer each other, the referral credit between them waits for a person to look at it instead of paying out automatically. Nothing else changes: no bakery is charged differently, and no order is ever turned away because of this.

Sharing a computer or a network is not enough on its own for us to treat two accounts as one person. That takes a confirmed email address in common. A shared browser can still mean referral credit between those two accounts waits for a person to check it.

If we get this wrong, email us at privacy@flourishbakers.com and we'll fix it, or use the contact form in our help centre and we'll put it right.

To recognise a browser we set one first-party cookie of our own. It holds a random identifier and nothing else. There are no third-party trackers involved, no advertising networks, and none of this is ever sold or shared for marketing.

We delete each of these records after 12 months. You can see how many we currently hold for you in the “Download my data” export from your account.

Data retention

We retain your data for as long as your account is active. If you close your account, we delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes (e.g., transaction records for up to 7 years as required by tax law).

Account deletion & data retention

From your account settings, you can temporarily disable your account (it’s hidden, and reversible any time you sign back in) or request deletion. Requesting deletion starts a 30-day recovery window: sign back in any time before then to cancel the request and keep your account as-is.

If the 30 days pass without you signing back in, we permanently remove your login and personal profile information (name, email, password). Records of past orders are retained but anonymised: order totals, dates, and items stay in a baker’s records for tax and accounting purposes, but they are no longer linked to your identity. Bakers who request deletion have any active subscription cancelled as part of the same process.

Your rights

You have the right to:

• Access: request a copy of all data we hold about you
• Correct: update inaccurate information
• Delete: request deletion of your account and data
• Portability: receive your data in a machine-readable format
• Object: opt out of any data processing not strictly necessary

To exercise any of these rights, email privacy@flourishbakers.com. We will respond within 30 days.

Consent records & your rights

To honour our agreement with you and to defend against legal claims, we keep a record of your consent events. When you create an account, place an order, or update your preferences, we record the document accepted, its version, a timestamp, and the IP address and browser (user-agent) of the request. These consent records are retained even after account deletion, where the law allows, as evidence of agreement.

Marketing is strictly opt-in, per baker. We never add you to a baker’s announcement list automatically. You can opt in when you place an order (an optional checkbox at checkout), and you can withdraw at any time from Email preferences in your account, or via the unsubscribe link in any such email.

Download your data anytime. From your account you can use “Download my data” to receive a machine-readable copy of the personal data we hold about you: your profile, orders, reviews, favourites, and your consent records.

Cookies

We use only essential cookies required to maintain your login session. We do not use advertising cookies or third-party tracking cookies. Vercel Analytics uses anonymised data with no cookies.

Children

Flourish Bakers is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy as the platform evolves. Material changes will be communicated via email to registered users at least 14 days before taking effect. Continued use of the platform after that date constitutes acceptance.

Contact

Flourish Bakers
Email: privacy@flourishbakers.com