Privacy policy

• About you: your name, email address and phone number. If you set a password, we store it only in a scrambled form that can't be turned back into the password. If you sign in with Google, Google tells us your name and email address.
• About your business: its name, time zone and settings.
• Your work: events, recipes, purchases, expenses and payments.
• About other people: what you type about your clients, such as names, email addresses, phone numbers and event details, and about your team members, such as names, email addresses and pay rates.

We don't collect your card number. Stripe collects it on its own pages.

You own the details you store about your clients and team members. We keep them only to run your account. We don't contact them for our own purposes, and we never sell their details.

The app emails your team members only when you invite them to an event or end their access. You are responsible for having permission to store your clients' and team members' details. If one of them asks us about their data, we will refer them to you.

We use your data to run your account. That means signing you in, saving your work, sending the emails and texts the app needs, billing you for the plan, answering you when you write to us, and keeping the app secure.

We don't sell anyone's data. We don't share it for advertising, and we don't use it to show you ads.

We use these companies to run the app. Each one receives only what it needs for its job.

• Stripe handles billing. It receives your card and billing details when you choose the plan, and an ID for your business.
• Resend sends our emails. It receives each email's address, subject and text. The app emails sign-in codes, and team invitations and their endings.
• Twilio sends our texts. It receives your mobile number and your sign-in code.
• Google runs Sign in with Google. If you use it, Google shares your name and email address with us.
• Railway hosts the app and its database, so your data is stored on its servers. Its server logs may record your IP address.

We may also share data when the law requires it, or to protect our rights or someone's safety. If the business is sold, your data moves to the new owner under this policy.

If you sign in with a phone number, we text you a sign-in code. We send sign-in codes only, never marketing.

Msg and data rates may apply. Reply STOP to stop texts, or HELP for help. After STOP, you can still sign in with email or Google.

We never share or sell your mobile number to anyone for marketing. Your agreement to receive texts is never shared with anyone else either.

The app sets three cookies. You need all three to sign in, and none of them track you.

• florist-session keeps you signed in. It lasts 7 days, or until you sign out.
• florist-challenge protects a Google sign-in while it is in progress. It lasts 10 minutes.
• florist-credential protects an email or text sign-in code while you enter it. It lasts 10 minutes.

If you hide the side menu on a computer, one more cookie, sidebar_state, remembers that. While you edit, your browser tab keeps unsaved changes in its own storage so a reload doesn't lose them. Signing out clears them.

The sign-in, sign-up and Account pages load Google's sign-in script, which may set Google's own cookies. Google's privacy policy covers those.

We use no analytics, advertising or tracking cookies, so there is no cookie banner. We don't track you across other sites, so the app works the same whether or not your browser sends a Do Not Track signal.

We keep your data while your account exists. If you cancel or your business locks, we keep your records so you can come back.

To have your account and data deleted, email hello@thefloristledger.com. We will delete it and confirm by email. We keep only what the law requires, such as billing records.

You can see and change most of your data in the app. To get a copy of your data, or to have us delete it, email hello@thefloristledger.com from the address on your account. The app has no delete button.

California residents have the right to know what we collect, to correct it and to delete it. We don't sell or share personal information, so there is nothing to opt out of. We won't treat you differently for using these rights.

If you are a florist's client or team member, ask that florist first. Your details are in their account, and they control them.

The app encrypts data between your browser and our servers. The database keeps each business's records apart from every other business. Sign-in codes expire after 10 minutes.

No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

The app is for businesses. It is not meant for children, and we don't knowingly collect data from anyone under 13.

We may update this policy. The date at the top shows when it last changed. If a change matters, we will email you before it takes effect.

Questions or requests? Email hello@thefloristledger.com.