Privacy Policy

Scope: Website & Mobile Application

This Privacy Policy applies to both the Blooms In Ribbon website (bloomsinribbon.com) and the Blooms In Ribbon mobile application for iOS and Android. Wherever this policy refers to “our services,” it covers your use of the website and the mobile app alike. Where a practice is specific to the mobile app, we call it out below.

It also covers Blooms Admin, the app our own team uses to run the shop. What that app collects about the people who use it is described in “Blooms Admin (the staff app)” below.

Information We Collect

When you use our services, we may collect the following information:

• Personal Information: Your name, email address, phone number, and physical delivery address when you place an order or create an account.
• Gift Recipient Information: When you send flowers as a gift, we collect the recipient’s name, phone number, and delivery address so we can complete and deliver your order. If you provide someone else’s details, you confirm you are entitled to share them with us for this purpose.
• Payment Information: Card number, expiry, and CVV are tokenized in your browser or device by our payment processors (Square, and Stripe for Apple Pay) and are never stored on our servers. We retain only the card brand, the last four digits, and a processor reference for display and order support.
• Order & Purchase History: Details about your purchases, delivery preferences, gift and card messages, and special instructions.
• Shopping Activity: In-app and on-site search queries, your wishlist and favorites, and checkout-funnel activity (including abandoned-cart and attribution data) used to improve your experience.
• User-Generated Content: Product reviews you submit — including the review text, your author name, and any photo you upload — which are publicly displayed on our services. This also includes gift and card messages attached to orders.
• SMS / Verification Data: Your phone number and the one-time passcodes (OTP) used for login and verification, plus transactional and marketing SMS you have opted into.
• Device & Push Notification Data (mobile app): Your push notification token, device model, operating system/platform, app version, and locale. We use this to send order-status push notifications and to understand which platform an order came from.
• Communication Data: Messages and inquiries you submit through our contact form or customer service channels.

What we do not collect: We do not collect your device’s GPS or precise location — the Blooms In Ribbon app does not request a location permission. We do not embed third-party advertising, analytics, or crash-reporting SDKs.

How We Use Your Information

We use the information we collect to:

• Process, fulfill, and deliver your flower orders, including gift deliveries to recipients
• Communicate with you about your orders by email, SMS, and push notification, including delivery updates
• Verify your identity and secure your account with phone-based one-time passcodes
• Display and manage your order history, wishlist, and product reviews
• Provide customer service and respond to inquiries
• Improve our website, mobile app, products, and services
• Send promotional offers and seasonal updates (with your consent, where required)
• Prevent fraud and ensure security
• Comply with legal, tax, and financial record-keeping obligations

Third-Party Service Providers & Data Sharing

We do not sell your personal information. We share it only with the service providers that help us operate our services, and only to the extent each provider needs it to perform its function on our behalf:

• Square — payment processing and card tokenization.
• Stripe — payment processing for Apple Pay transactions.
• Twilio — delivery of SMS one-time passcodes and transactional/marketing text messages (receives your phone number).
• Resend — delivery of transactional and marketing email (receives your email address).
• Apple Push Notification service (APNs), Google Firebase Cloud Messaging (FCM), and the Expo push service — delivery of mobile push notifications (receives your device push token).
• OpenStreetMap — the in-app delivery-zone map loads map tiles from tile.openstreetmap.org, which receives your IP address and the approximate area derived from your address in order to render the map.

These providers act as our processors under contract and are not permitted to use your information for their own purposes. We may also disclose information where required by law or to protect our rights.

Blooms Admin (the staff app)

Blooms Admin is the app our own team uses to run the shop: the owner, our florists and our couriers. It is not for customers, and its accounts are created by the shop. This is what it collects about the people who use it:

• Your account: your name, phone number and role. You sign in with a one-time code we send to your phone by text message (through Twilio); the code works for ten minutes and we store it only in hashed form. We note when you last signed in.
• Notifications: your device’s push token, platform and app version, so we can tell you about your work, such as a delivery given to you or a review waiting to be shown. They are removed when you sign out.
• Photos: the photos you take or choose in the app — a bouquet at the door just before it is handed over, a bouquet’s photo for the catalogue, a photo for a review. The app removes the location data from a photo before sending it. A delivery photo is kept with its order, with the name of the courier who took it, and only the shop sees it unless the owner picks it for the gallery of delivered bouquets on our website. Catalogue and review photos appear on our website.
• Location (couriers): only if you ask the app to plan your route from where you are, and only with your permission while the app is open. Your current position is sent with that one request, and our server and Mapbox use it to work out the order of your stops and the driving distances. It is not saved to your account or to any order, and the app does not follow your location in the background.
• Your work on orders: what you do in the app, such as changing an order’s status, assigning a courier or marking a delivery done, is recorded with the order, together with your name and the time.

What you see: each role sees only what it needs. A courier sees their own deliveries and what each one needs — the recipient’s name and phone number, the address, the time and the delivery note — and nothing about who paid or how much. Directions open the map app you choose (Apple Maps, Google Maps or Waze), which receives the delivery address.

Sharing: we do not sell this information or use it for advertising, and Blooms Admin contains no advertising, analytics or crash-reporting SDKs. Twilio, Apple’s and Google’s push services, the Expo push service and Mapbox handle it only as described above, as our service providers.

Keeping and deleting it: your account is kept while you work with us. When you leave, the owner switches it off and your sessions end at once. Your work on orders and your delivery photos stay with the orders, as order records do (see “Data Retention”). To have your account and its personal data deleted, write to privacy@bloomsinribbon.com.

Data Security

All data is encrypted in transit using HTTPS. Payment card details are tokenized on your device by our payment processors and never reach our servers, which keeps the app outside the scope of card-data (PCI) handling. We apply appropriate technical and organizational measures to protect the information we hold.

Data Retention

We keep your account and profile information for as long as your account is active. We retain order and transaction records — which contain the personal information needed to identify a purchase — for the period required to meet our financial, tax, and legal record-keeping obligations, even after you close your account. Other data, such as your wishlist and saved devices, is deleted when it is no longer needed or when you delete your account.

Data Deletion

You can request deletion of your account and associated personal data at any time. See our Account & Data Deletion page for how to make a request from within the mobile app or by email, what is removed, and how long it takes.

Please note that order and transaction records containing personal information are retained as described in “Data Retention” above for legal and financial compliance, even after your account is deleted.

Your Rights

Under California law (CCPA), you have the right to:

• Know what personal information we collect about you
• Request deletion of your personal information
• Opt out of the sale of your personal information (we do not sell data)
• Non-discrimination for exercising your privacy rights

To exercise these rights, please contact us at privacy@bloomsinribbon.com or call (916) 203-3662. To delete your account and data, see our Account & Data Deletion page.