Privacy Policy

Scope: Website & Mobile Application

This Privacy Policy applies to both the Blooms In Ribbon website (bloomsinribbon.com) and the Blooms In Ribbon mobile application for iOS and Android. Wherever this policy refers to “our services,” it covers your use of the website and the mobile app alike. Where a practice is specific to the mobile app, we call it out below.

Information We Collect

When you use our services, we may collect the following information:

• Personal Information: Your name, email address, phone number, and physical delivery address when you place an order or create an account.
• Gift Recipient Information: When you send flowers as a gift, we collect the recipient’s name, phone number, and delivery address so we can complete and deliver your order. If you provide someone else’s details, you confirm you are entitled to share them with us for this purpose.
• Payment Information: Card number, expiry, and CVV are tokenized in your browser or device by our payment processors (Square, and Stripe for Apple Pay) and are never stored on our servers. We retain only the card brand, the last four digits, and a processor reference for display and order support.
• Order & Purchase History: Details about your purchases, delivery preferences, gift and card messages, and special instructions.
• Shopping Activity: In-app and on-site search queries, your wishlist and favorites, and checkout-funnel activity (including abandoned-cart and attribution data) used to improve your experience.
• User-Generated Content: Product reviews you submit — including the review text, your author name, and any photo you upload — which are publicly displayed on our services. This also includes gift and card messages attached to orders.
• SMS / Verification Data: Your phone number and the one-time passcodes (OTP) used for login and verification, plus transactional and marketing SMS you have opted into.
• Device & Push Notification Data (mobile app): Your push notification token, device model, operating system/platform, app version, and locale. We use this to send order-status push notifications and to understand which platform an order came from.
• Communication Data: Messages and inquiries you submit through our contact form or customer service channels.

What we do not collect: We do not collect your device’s GPS or precise location — the app does not request a location permission. We do not embed third-party advertising, analytics, or crash-reporting SDKs.

How We Use Your Information

We use the information we collect to:

• Process, fulfill, and deliver your flower orders, including gift deliveries to recipients
• Communicate with you about your orders by email, SMS, and push notification, including delivery updates
• Verify your identity and secure your account with phone-based one-time passcodes
• Display and manage your order history, wishlist, and product reviews
• Provide customer service and respond to inquiries
• Improve our website, mobile app, products, and services
• Send promotional offers and seasonal updates (with your consent, where required)
• Prevent fraud and ensure security
• Comply with legal, tax, and financial record-keeping obligations

Third-Party Service Providers & Data Sharing

We do not sell your personal information. We share it only with the service providers that help us operate our services, and only to the extent each provider needs it to perform its function on our behalf:

• Square — payment processing and card tokenization.
• Stripe — payment processing for Apple Pay transactions.
• Twilio — delivery of SMS one-time passcodes and transactional/marketing text messages (receives your phone number).
• Resend — delivery of transactional and marketing email (receives your email address).
• Apple Push Notification service (APNs), Google Firebase Cloud Messaging (FCM), and the Expo push service — delivery of mobile push notifications (receives your device push token).
• OpenStreetMap — the in-app delivery-zone map loads map tiles from tile.openstreetmap.org, which receives your IP address and the approximate area derived from your address in order to render the map.

These providers act as our processors under contract and are not permitted to use your information for their own purposes. We may also disclose information where required by law or to protect our rights.

Data Security

All data is encrypted in transit using HTTPS. Payment card details are tokenized on your device by our payment processors and never reach our servers, which keeps the app outside the scope of card-data (PCI) handling. We apply appropriate technical and organizational measures to protect the information we hold.

Data Retention

We keep your account and profile information for as long as your account is active. We retain order and transaction records — which contain the personal information needed to identify a purchase — for the period required to meet our financial, tax, and legal record-keeping obligations, even after you close your account. Other data, such as your wishlist and saved devices, is deleted when it is no longer needed or when you delete your account.

Data Deletion

You can request deletion of your account and associated personal data at any time. See our Account & Data Deletion page for how to make a request from within the mobile app or by email, what is removed, and how long it takes.

Please note that order and transaction records containing personal information are retained as described in “Data Retention” above for legal and financial compliance, even after your account is deleted.

Your Rights

Under California law (CCPA), you have the right to:

• Know what personal information we collect about you
• Request deletion of your personal information
• Opt out of the sale of your personal information (we do not sell data)
• Non-discrimination for exercising your privacy rights

To exercise these rights, please contact us at [email protected] or call (916) 203-3662. To delete your account and data, see our Account & Data Deletion page.