Privacy Policy

Petal Post LLC ("PetalPost," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our desktop application, web application, and related services (collectively, the "Service").

Please read this privacy policy carefully. By using PetalPost, you agree to the collection and use of information in accordance with this policy.

1.1 Information You Provide

• Account Information: Email address and password when you create an account
• Business Information: Business name, address, phone number for your profile
• Payment Information: Subscription billing is processed securely by Shopify, our merchant of record; we never see or store your card numbers
• Support Communications: Messages you send to our support team

1.2 Information Collected Automatically

• Usage Data: Features used, time spent, pages visited, error logs for improving the Service
• Device Information: Operating system, app version, browser type, IP address
• Local Data: Product catalogs, orders, and settings stored locally on your device (desktop app only)
• Cookies: Session cookies for authentication and preference storage (see Section 4)

1.3 Information from Third Parties

• Shopify: Product and order data if you connect your Shopify store
• Billing Provider: Subscription and transaction confirmations from Shopify (our billing merchant of record)
• Wholesaler Data: Product catalogs from connected wholesale vendors

1.4 Desktop Application Telemetry

When using the PetalPost desktop application, we may collect system information to improve compatibility and diagnose issues. This includes: operating system version, CPU architecture, memory usage, application version, hostname, and system username. This data is used solely for crash reporting and performance monitoring. You can disable telemetry by setting DISABLE_TELEMETRY=true in your application settings.

1.5 Publicly Available Business Information

We collect publicly available business contact information (business name, business email, business phone, business address) from public directories, industry associations, and business listings for the purpose of informing wholesale flower industry professionals about our platform. This data is collected under the legitimate interest basis (GDPR Article 6(1)(f)) and is used solely for direct B2B outreach. We do not collect personal or sensitive information about individuals through this process.

If you have received a communication from us and wish to opt out, you can unsubscribe using the link in any email or contact us at support@petalpost.shop. We honor all unsubscribe requests immediately.

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send technical notices, updates, and security alerts
• Respond to your comments, questions, and support requests
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations

PetalPost is primarily a local-first application. This means:

• Your business data (products, orders, customers) is stored locally on your device
• We do not have access to your local data unless you explicitly share it
• Sensitive credentials are encrypted using AES-256 encryption
• Cloud sync (if enabled) uses encrypted connections (TLS 1.3)
• Subscription billing is handled entirely by Shopify (PCI-DSS compliant), our merchant of record — PetalPost never processes your card directly. If you connect your own payment processor (such as Stripe, Square, or Shopify Payments) to accept your customers' payments, those charges run through your own account, not ours
• Passwords are hashed using bcrypt with per-user salts

We implement industry-standard security measures, but no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

4.1 Essential Cookies

We use essential cookies to maintain your session and authentication state. These are strictly necessary for the Service to function and cannot be disabled.

• session_token — Authentication session (httpOnly, secure)
• refresh_token — Session refresh (httpOnly, secure)

4.2 Analytics Services

We use the following third-party analytics services to understand how the Service is used. These services may collect IP addresses, browser information, and usage data:

• Google Analytics 4 (GA4): Tracks page views, sign-ups, feature usage, and campaign attribution. Google may use this data in accordance with their Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on.
• Meta Pixel (Facebook): Tracks page views, sign-ups, and conversions for advertising measurement. Meta may use this data in accordance with their Privacy Policy.

4.3 Error Monitoring

We use our own internal error monitoring system for error tracking and performance monitoring. When errors occur, error context and stack traces may be collected and stored in our database. This data is used solely for debugging purposes and is not shared with third-party error tracking services. Passwords and payment information are never included in error logs.

4.4 Email Tracking

Our outreach emails may include tracking pixels (small transparent images) and tracked links to measure open rates and engagement. This data is used to improve our communications. You can opt out of all email communications using the unsubscribe link in any email.

4.5 Local Storage

We use browser local storage to save your preferences (theme, layout, navigation order) and cached data for performance. This data remains on your device and is cleared when you log out or clear your browser data.

We do not sell your personal information. We may share information in these circumstances:

• Service Providers: With vendors who assist in providing the Service (Shopify for subscription billing, Vercel for hosting, Neon for our cloud database, Resend for email delivery, Google and Meta for analytics)
• Business Partners: With wholesalers or florists you connect with through the Service (only data necessary for transactions)
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Legal Requirements: When required by law or to protect rights and safety
• With Your Consent: When you explicitly authorize sharing

6. Web Scraping and Data Collection

PetalPost includes features for collecting publicly available product information from wholesale vendor websites. Our scraping practices:

• Only collect publicly available commercial data (prices, product names, availability)
• Respect robots.txt directives and Terms of Service
• Never collect personal information about individuals
• Implement rate limiting to avoid server overload
• Maintain a blocklist of sites that prohibit automated access
• Comply with CFAA, GDPR, CCPA, and DMCA regulations

Scraped data is stored locally and subject to automatic expiration (90 days) unless you are the data administrator.

7. Your Rights (GDPR/CCPA)

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing of your data
• Restriction: Request limited processing of your data
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at support@petalpost.shop. We will respond within 30 days.

8. California Residents (CCPA/CPRA)

PetalPost does not sell your personal information to third parties. We do not share personal information for monetary or other valuable consideration as defined under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

We may share limited business contact information with service providers (such as our email delivery provider) solely for the purpose of sending communications on our behalf. These providers are contractually bound to use the data only for the services we have engaged them to perform.

If you are a California resident, you may request access to, deletion of, or information about your personal data by contacting us at support@petalpost.shop.

9. European Residents (GDPR)

If you are in the European Economic Area (EEA), our legal basis for processing your data includes contract performance (providing the Service), legitimate interests (improving the Service, B2B outreach), and consent (where applicable, such as analytics cookies). You have the right to lodge a complaint with your local data protection authority.

10. Data Retention

• Account Data: Retained while your account is active, deleted within 30 days of account closure
• Local Data: Stored on your device; you control deletion
• Scraped Data: Automatically expires after 90 days (unless administrator-exempt)
• Usage Logs: Retained for 12 months for analytics, then deleted
• Legal Records: Retained as required by law

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. Our service providers (Vercel, Neon, Shopify, Resend, Google, Meta) may process data in various locations. We ensure appropriate safeguards are in place, including Standard Contractual Clauses for transfers from the EU/EEA.

12. Children's Privacy

PetalPost is a business application not intended for children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Material changes will be communicated via email or in-app notification.