Privacy policy

This site has two forms. Each collects only what is listed here.

• Order ahead for pickup: required: what you want to order, the pickup day and time, your name and your phone number (we text you about the order), and your agreement to be contacted. Optional: your email address and a short note such as an allergy.
• Catering and wholesale enquiry: required: what you need (from a list), the date, how many people, your name and email address, and your agreement to be contacted. Optional: your phone number and details such as time, place, dietary needs or budget. We keep the correspondence that follows.

Notes and details are used only to prepare your order or quote. Please name an allergy, nothing more: no medical details, card or ID numbers.

Our hosting provider records basic technical data (IP address, browser type, pages requested) to keep the site secure and working, and the forms use your IP address briefly to limit repeated submissions.

• To prepare your order and confirm it by text, or to answer a catering or wholesale enquiry.
• To contact you about that order, for example if something has sold out.
• To protect the site from spam and abuse.
• If you accept analytics, to understand which pages are useful, in aggregate.

The site works without optional cookies. Analytics is switched on only when the shop has configured it; then a banner asks first. If you click Accept in the cookie banner we load Cloudflare Web Analytics, a privacy-friendly service that counts page views without building a profile of you. If you click Decline, nothing optional loads.

Your choice is stored in your own browser. You can change it any time with the Cookie settings link in the footer.

We do not sell your information or use it for marketing unless you ask us to. We share it only with services that help us run the site, under contracts that protect it:

• Website hosting (for example Cloudflare or Vercel).
• Storage of orders and enquiries for the shop’s inbox (for example Cloudflare KV or Upstash).
• Email delivery of orders and enquiries to the shop (for example Resend).
• Spam protection on both forms (for example Cloudflare Turnstile), when it is switched on.
• Cloudflare Web Analytics, only if it is configured and you click Accept.

The map in the visit section is Google Maps. It loads only when you press “Load the map”; until then no request goes to Google. Once loaded, Google’s privacy policy applies to it.

Orders are deleted within 12 months of the pickup date and catering enquiries within 12 months of the event, unless you ask us to keep your details for a standing order.

You can ask to see, correct or delete the information we hold about you, or object to how we use it. Email hello@example.com and we will reply within 30 days.

If you live in California, you have the right to know what personal information we collect and how we use it, to ask for a copy, to have it corrected or deleted, and to opt out of its sale or sharing. We do not sell your personal information or share it for cross-context behavioral advertising, and we do not knowingly collect information from anyone under 16.

We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out, and we turn analytics off for that browser. To use your other rights, email hello@example.com. We will confirm your request and reply within 45 days. You can use an authorized agent, and we will not treat you differently for using any of these rights.

We will post any changes on this page with a new date. Questions? Contact Coffee & Bakery LLC at hello@example.com, 12 Sample Street, Sample City, OR 97000.