Last updated: 30 October 2026

This policy sets out what Flower Bulb Shop collects when you use this shop, why we collect it, who else sees it, and how to get it corrected or deleted. It is written to be read, not to be skimmed past.

If you want to skip to the part that matters to you: write to flowerplantshop1@gmail.com and a person will answer. That address reaches whoever can actually export or delete your data, not a ticket queue.

Who we are

Flower Bulb Shop is an online retailer of flower bulbs, corms, tubers and bare-root plants, selling to customers in the United States. We are the controller of the personal data described below. Our contact address for anything in this policy is flowerplantshop1@gmail.com.

What we collect

Order and account data. Your name, billing and shipping address, email address, telephone number if you give one, the items and quantities you ordered, any delivery note you add, and the IP address and timestamp recorded with the order. If you create an account, we also keep your saved addresses and order history.

Payment data. Card numbers are entered on the payment provider’s own secure page and are never stored on our server. We receive back only the card brand, the last four digits, and whether the payment was authorised.

Messages. Anything you send us through the contact form, the live chat window, or by email — including your name, email address and the content of the message.

Newsletter. Your email address and the date you subscribed, stored in the shop’s own database. Nothing else.

Reviews and questions. The display name you choose, your email address (never published), and the text of the review or question.

Technical data. IP address, browser and device type, pages viewed, the site you arrived from, and the approximate location that can be inferred from an IP address. Collected through cookies and analytics, described below.

Why we use it

  • to take payment, pack your order, ship it and handle any replacement;
  • to answer your messages and honour the 30-day guarantee;
  • to send the newsletter, if you asked for it;
  • to keep the shop working — remembering your cart, your currency and your logged-in session;
  • to see which pages and products people actually use, so we can improve them;
  • to meet tax, accounting and consumer-protection obligations.

We do not sell personal information. We do not hand it to advertisers for their own use, and we do not build profiles for resale.

Who else sees it

We use a small number of service providers, each of which sees only what it needs to do its job:

  • Hostinger — hosting. Stores the site and its database, which includes all of the data above.
  • Payment providers — our card processor and PayPal. They receive your name, billing address, email address and order total in order to authorise and settle the payment.
  • Delivery carriers — your name, delivery address and telephone number, so the parcel can be delivered.
  • Google — Google Analytics 4 and Google Ads, connected through Site Kit. They receive technical data (IP address, device, pages visited, conversions) for measurement and advertising.
  • Chatway — the live chat window. Receives your messages, your name and email if you type them, and technical data about the session.
  • Our email delivery service — your email address and the content of the message, in order to deliver order confirmations, dispatch notices and newsletters.
  • UpdraftPlus — the backup service that keeps an off-site copy of the site database.

Each of these companies handles data under its own privacy policy and under a contract that limits its use of your data to providing the service to us. We do not authorise any of them to use your data for their own marketing.

Cookies and similar technologies

Cookies are small files a site stores in your browser. This shop uses four kinds:

  • Necessary. A session cookie that keeps your cart and checkout working, a cookie that remembers the currency you selected, and a cookie that keeps you logged in if you have an account. These cannot be switched off without breaking the shop.
  • Analytics. Google Analytics cookies that count visits and show which pages are used. The data is aggregated; we do not use it to identify you.
  • Advertising. A Google Ads cookie that tells us whether a visit came from an advert we paid for. It does not give us your name or contact details.
  • Chat. A cookie set by the live chat window so that a conversation survives a page change.

You can clear or block cookies in your browser settings at any time. Blocking the necessary ones will stop the cart and checkout from working. To opt out of Google Analytics across all sites you visit, Google publishes an opt-out browser add-on; to limit advertising cookies, use Google’s ad settings page.

How long we keep it

  • Orders and invoices — seven years, because tax and accounting rules require it.
  • Account details — until you ask us to close the account.
  • Newsletter subscription — until you unsubscribe; removal within seven days of asking.
  • Contact messages and chat transcripts — 24 months, so that a replacement claim can be checked against what was said.
  • Reviews — until you ask us to remove them.
  • Analytics — up to 14 months.
  • Backups — on a rolling basis; older copies are overwritten automatically.

Your choices and rights

Write to flowerplantshop1@gmail.com and we will, within 30 days:

  • send you a copy of the personal data we hold about you;
  • correct anything that is wrong;
  • delete your account, your marketing data and, where the law allows, your order history;
  • stop marketing email immediately — you can also use the unsubscribe link at the foot of any newsletter.

Two limits we would rather state than hide: we must keep order and invoice records for the tax period even after a deletion request, and we may need to keep a record of a dispute for as long as it is live. If a request cannot be fully carried out, we will tell you which part and why.

California residents. Under the CCPA and CPRA you have the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell personal information. The only sharing that could count as advertising is the Google Ads cookie described above, and you can opt out of it through Google’s ad settings or by blocking the cookie.

Children

This shop is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us information, write to us and we will delete it.

Security

The whole site runs over HTTPS. Administrative access is limited to the shop owner, card data never reaches our server, and the database is backed up off-site. No system is perfect. If a breach ever affects your data, we will email you rather than wait for you to read about it.

Changes to this policy

If we change how we handle data, we update the date at the top of this page. For a material change — a new category of data, or a new recipient — we will also email account holders and newsletter subscribers before the change takes effect.

Contact

Questions about this policy, or about the data we hold on you: flowerplantshop1@gmail.com.