Privacy & Cookies

Last updated: October 2026

What we collect

When you place an order, we collect only what's needed to fulfil it: your name and email, the recipient's name, phone and address, your card message, and the order details. Payments are processed by PayPal - we never see your card number or passwords.

For invoicing, we also collect the payer's billing address, separately from the delivery address. Invoices and order confirmations are emailed through Resend to the buyer and our shop. Invoices and their email delivery records are stored privately; we do not publish public links to them.

Cookies & analytics

Your cart and favourite arrangements are stored locally in your browser. Favourites do not sync to an account or another device. For order coordination, we also save your phone number and preferred contact method, separately from the recipient’s phone number.

We group cookies into three categories:

• Essential - needed for the cart, checkout and security. These are always active and cannot be switched off, because the site does not work without them.
• Analytics - Google Analytics (GA4) (visit and usage statistics) and Microsoft Clarity (session replay and heatmaps - anonymised interactions such as mouse movement, clicks and scrolling; Clarity automatically masks text you type).
• Marketing - Meta Pixel and the Meta Conversions API. We use these to measure which of our Facebook and Instagram ads lead to orders. The Meta Pixel loads only if you consent to marketing - until then no request is made to Meta's servers at all.

What is shared with Meta

If you consent to marketing, then when an order completes we send Meta: the order value and currency, the product IDs and quantities, the order number, and your email, phone and name in hashed (irreversibly encrypted) form - Meta receives only the one-way hash, never the original text. We also send your IP address and browser details, which Meta uses to match the order to the ad you saw.

We never send Meta your greeting-card message, delivery instructions, map pin location, or any card or PayPal credentials.

Campaign measurement

When you arrive from an ad, we store the link's parameters (such as utm_source, utm_campaign and the ad ID) locally in your browser so we can tell which campaign led to an order. This stays on your device and is only attached to an order you actually complete. It is never published.

Your control

Analytics and marketing are off by default until you make a choice in the cookie banner. Using "Customise" you can accept analytics without marketing, or the other way round. If you choose "Decline", none of these tools are enabled.

Declining does not affect browsing, the cart, payment or delivery - everything continues to work normally. Your choice is remembered on this device and can be changed by clearing this site's browser data.

Deleting or accessing your data

You can ask for a copy of the data we hold about you, correction of anything wrong, or complete deletion.

Email flowershop.support@gmail.com with the subject "Data deletion" and the email address or phone number you used to order. We reply within 30 days.

If you created an account, you can delete it yourself from My orders, or ask us by email.

What gets deleted: your name, email, phone, recipient addresses, card messages and order history. What we must keep: the minimum payment records required by accounting law, and whatever PayPal retains under its own policy.

For data collected through Facebook or Instagram ads, you can also request deletion directly in your Meta account's privacy settings.

Contact

Privacy questions: flowershop.support@gmail.com.