Privacy Policy

What we collect

• When you order: your name, phone, email, delivery addresses, the names and phone numbers of the people receiving your order, gift messages, the items and the delivery date.
• If you create an account: your email, your password (stored only in scrambled form, never readable by us), your saved addresses, and the cards you choose to save.
• When you message us: what you write in the chat or contact form, and any photos or PDFs you send.
• Payments: you type your card into Square's secure payment box. We never see or store your full card number; for a saved card we keep only Square's reference to it, the card brand and the last four digits.
• In your browser: small cookies and saved settings that keep you signed in, hold your cart and remember your chat. We use no advertising or tracking cookies.

How we use it

To take, make and deliver your order, take payment, send your receipt, invoice and order updates, answer your messages, and run your account. We do not sell or rent your information, and we do not use it for advertising.

Who helps us

We share only what each service needs to do its job:

• Square, to take card payments and keep saved cards
• Supabase, which stores our data, and Vercel, which runs the website
• Resend, which sends our emails
• Google Maps, for address suggestions while you type and for planning delivery routes
• Our own drivers, who see the delivery address, the recipient's name and phone, and the items

Plaid. We use Plaid only to connect Fruits N Flair's own business bank account to our bookkeeping. We never use Plaid to reach customers' bank accounts. Plaid's handling of data is described in the Plaid End User Privacy Policy.

How long we keep it

• Orders, invoices and payment records: 7 years, as tax and accounting records.
• Business bank transactions brought in through Plaid: 7 years, as business records. The bank connection itself is deleted as soon as we disconnect it.
• Chat messages and the files sent in them: deleted 2 years after the last message.
• Accounts and contact details: kept until you ask us to delete them. We delete them within 30 days of your request, keeping only what the law requires us to keep with past orders.

Once a year we review what we keep and delete what these rules no longer allow.

Your choices

• Ask to see, correct or delete your information by emailing fruitnflair@gmail.com. We answer within 30 days.
• With an account, you can change your name, addresses and saved cards yourself, and remove a saved card at any time.

Keeping it safe

Everything travels over encrypted connections and is stored encrypted. Our staff see only what their job needs, and anyone with full access signs in with a password plus a code from an authenticator app.

Children

This website is not meant for children under 13, and we do not knowingly collect their information.

Changes and contact

If we change this policy, we update this page and the date at the top. Questions? Email fruitnflair@gmail.com.