Privacy Policy

01

Who we are & what this policy covers

This Privacy Policy describes how Amber’s Roses handles personal information in connection with this storefront, its contact form, gift card features, and maintenance-password access. It applies to information handled by the storefront operator and does not replace the separate privacy notices of hosting, authentication, or other independent service providers.

This notice reflects the site’s current implementation. Some shopping features allow you to prepare a bouquet or review details without completing a paid order. We distinguish browser-only details from information actually sent to the server. A feature becoming available does not authorize undisclosed use of your information; material changes to our practices will be reflected in this policy and any required notices or choices.

02

Information you provide

• Contact inquiries: name, email address, optional phone number and order reference, inquiry category, message, and submission date. A hidden anti-spam field also helps reject automated submissions.
• Bouquet and gift details: selected products, rose colors, quantities, optional personal notes, and gift-card design or amount choices. Bouquet details are stored in your browser and are sent when needed for server price and availability checks.
• Checkout details: contact, delivery, billing, and gift-recipient fields entered into the current review form. The present review flow displays these details in your browser; it does not itself submit a paid order or store those address fields in our order database.
• Gift cards: a code supplied for balance verification or checkout eligibility. Issued card records include a protected code representation, last four characters, balance, status, and ledger entries.
• Restricted access: a maintenance password you submit to unlock the store, and authentication information used for administrator access.

Provide recipient information only when authorized and necessary for your gift. Do not place card numbers, government identifiers, medical information, or other unnecessary sensitive information in messages or gift notes.

03

Technical information & sources

Hosting and security infrastructure can process your IP address, requested URL, request time, browser or device headers, response status, and diagnostic logs. These records help deliver the website, detect failures, and prevent abuse. Request metadata may also include a referring page. We do not use the current storefront to request precise device location, access your contacts, or collect microphone or camera recordings.

Information comes directly from you, from your browser or device, from a gift purchaser who supplies recipient information, and from authentication or infrastructure providers needed to operate the site. Administrators who sign in through our protected authentication service provide an account identifier and email through the authentication service; a name may also be supplied. The store uses this information to verify administrative authorization, not to create a public customer profile.

04

Why we use information

We use personal information to provide and secure the storefront; maintain bouquet selections; calculate current prices and stock; verify discount eligibility and gift card balances; respond to inquiries and privacy requests; manage authorized store credit and adjustments; administer restricted access; investigate misuse; and maintain records needed for legal, accounting, dispute-resolution, or security purposes.

If ordering and fulfillment are enabled, the information required for those functions must be identified before submission and used to process the requested purchase and delivery. Submitting an inquiry or supplying a gift recipient’s details does not subscribe either person to marketing. When you choose to join our newsletter, we store your email address, signup time, source, and consent record so we can administer your subscription. Newsletter signup is optional and separate from service emails. You may withdraw consent or request removal through Contact us; marketing messages will include an unsubscribe option.

05

Cookies & browser storage

The storefront does not currently install advertising pixels or behavioral analytics tags. We do not currently use nonessential cookies for cross-site advertising. Browser restrictions on cookies or local storage may prevent the bouquet or restricted-access features from working as intended. Clearing browser data does not delete an inquiry already submitted to us.

06

Disclosures & service providers

Our storefront uses service providers for hosting, database, file storage, authentication, and security. If an announcement uses an optional web font, your browser requests the selected font from Google Fonts, which receives the technical request information needed to deliver it. Information may be processed by those providers as needed to supply their services. Administrator authentication is handled through our hosting provider’s protected sign-in service. We do not transmit your contact inquiry as an instruction to a generative AI model through a storefront AI feature.

When our administrator enables transactional email, we use Twilio SendGrid to send contact notifications and acknowledgments and gift card messages. The information needed for each message, such as the recipient’s email address, inquiry details, gift message, and private gift card code, is sent to SendGrid for that purpose. Our integration disables email open and click tracking. We retain operational send logs containing the recipient, subject, purpose, time, and provider acceptance status; these logs do not contain gift card codes or full email bodies.

Authorized administrators can access contact messages, gift card records, catalog controls, and operational audit records. We may disclose information where reasonably necessary to comply with law or valid process, protect rights or safety, investigate fraud, obtain professional advice, or support a business transfer subject to appropriate protections. We do not publish contact messages or gift notes. Payment processors, carriers, and email-marketing services are not currently connected to a completed purchase or subscription flow on this storefront; disclosures will be updated before materially different processing begins.

07

Sale, sharing & privacy signals

The current storefront does not sell personal information or share it for cross-context behavioral advertising, and it does not use targeted-advertising profiles. We do not knowingly sell or share information about minors. Operational disclosure to hosting or security providers is described separately above.

We do not currently perform cross-site behavioral tracking, regardless of a browser’s Do Not Track setting. Because no advertising sale or sharing is enabled, a Global Privacy Control signal does not require an additional advertising opt-out action in the current store. Essential security, requested service functionality, and administrator authentication continue to operate. If practices change, we will provide any legally required opt-out mechanism, recognize applicable preference signals, and update this notice before introducing the new use.

08

Retention & protection

We retain information only as reasonably necessary for the purpose for which it was collected, including responding to an inquiry, administering store credit, preventing fraud, meeting legal obligations, and resolving disputes. Retention depends on the type of record, whether it remains needed, legal requirements, and the time required for backup or provider-managed deletion. There is no single retention period for all records. We do not retain information indefinitely merely because storage is available.

Contact submissions are stored in access-restricted storage. Gift card codes are checked using a cryptographic hash; administrators generally see masked card references, although a newly issued full code is displayed once to the issuing administrator. Maintenance passwords are stored using salted password hashing rather than plaintext, and access cookies are signed and protected from ordinary page scripts. Administrative actions are logged. No system is completely secure; use a trusted device, keep gift codes private, and avoid sending unnecessary sensitive information.

09

Your choices & privacy requests

You can clear local bouquet data through your browser, decline optional form fields, choose not to submit an inquiry, and clear maintenance cookies. To request access, correction, deletion, a copy of submitted information, or information about how it is used, open Contact us, select “Other,” and begin your message with “Privacy request.” Identify your request and the email or other information used in the relevant interaction. Do not send passwords, full gift card codes, or identification documents in the initial message.

We may request proportionate verification before releasing, changing, or deleting information, to protect it from unauthorized access. An authorized agent may submit a request with appropriate evidence of authority. We will respond within the timeframe required by applicable law and explain any lawful exception or inability to act. Deletion may be limited where retention is needed for a legal obligation, security, an unresolved dispute, or a valid financial record. We will not discriminate against you for exercising applicable privacy rights. If you disagree with a response, use the same form to request review and include “Privacy appeal.”

10

California & other regional rights

Depending on your residence and whether a particular privacy law applies to this business, you may have rights to know or access information, obtain a portable copy, correct inaccuracies, delete information, opt out of qualifying sale, sharing or targeted advertising, limit certain uses of sensitive information, and appeal a denied request. Applicability and exceptions depend on law; this policy does not claim that every regional law applies to every interaction.

California residents can review the California Attorney General’s consumer privacy guidance and submit a request using the process above. The categories described here include identifiers, communications, shopping selections and gift-card activity, and technical interaction data. We do not use the current site for automated decisions producing legal or similarly significant effects or to infer sensitive personal characteristics. Nothing in this notice limits a right provided by applicable law.

11

Children, international access & outside links

The store is intended for a general adult audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information, contact us so we can investigate and take appropriate deletion steps. Do not submit information about a child unless necessary, authorized, and lawful.

Providers may process information in the United States and other countries where their infrastructure operates. Those countries’ protections may differ from those where you live. We use providers and safeguards appropriate to the processing and applicable law; visiting the site is not treated as a blanket waiver of international privacy rights. Links to external services lead to independent privacy practices. Review their notices before providing information directly to them.

12

Changes & contacting us

This policy is effective October 27, 2026. We will revise the date when we update it. If changes materially affect how information is handled, we will provide additional notice and obtain consent where required. New terms do not retrospectively authorize an incompatible use of information already collected.

For questions about this policy or a privacy request, use our contact form and select “Other.” This provides a direct submission to the store’s private contact inbox, including while maintenance mode is enabled. You can review our Terms of Service for product, order, guarantee, and gift card conditions.