Privacy policy

My Valentine Floral Design is a one-person flower studio in Allan, Saskatchewan. This page explains what we collect when you order flowers or get in touch, why we collect it, and what we do with it. It is written to be read, not to be survived.

The short version: we collect what we need to make an arrangement and get it to the right door, we do not sell it to anyone, and we do not run advertising trackers on this site.

What we collect

When you place an order

To take an order we need your name, your email address and a phone number, so we can reach you if something about the delivery is unclear. We also need the recipient’s name, the delivery address, and any instructions you leave about where to put the flowers or how to find the place. We do not ask for your own address. The only address we need is the one the flowers go to.

If you write a card message, it is saved with the order. Anne reads it, because she writes it out by hand.

When you show us where a place is

Rural addresses here are hard to find. A postal code in this part of Saskatchewan can cover a town and the countryside around it for many kilometres, so at checkout you can optionally give a legal land description and move a map to mark the yard. If you do, we keep what you typed and the point you marked, on that order.

This is optional and no order needs it. We use it to drive to the right approach and for nothing else: it is never shown publicly, never used for advertising, and never shared beyond getting the flowers to the door. Anne may open the point you marked in a map app such as Google Maps to plan the drive. The map at checkout is drawn using imagery from Esri and OpenStreetMap, which means your browser requests map tiles from them while the map is open. They receive the area you are looking at, as any map does. They are not told who you are or what you ordered.

When you pay

Card payments are handled by Stripe, a payment processor. Your card number is entered on Stripe’s own form and goes straight to Stripe. It never reaches this website and we never see it or store it. What we get back is confirmation that the payment succeeded, the last four digits, and the card brand.

Stripe’s own script loads on the order page and at checkout so the payment form and quick-pay buttons work, and Stripe uses it to spot fraudulent payments. If you choose Link, Stripe’s way of saving your card for next time, those details are saved with Stripe, not with us.

Stripe has its own privacy policy covering what it does with that information, and it is worth reading if you want the detail.

When you buy a gift card

A gift card needs your name and email address, the recipient’s name and email address, the message you want them to read, and the day it should go out. We keep those with the card so it can be sent, checked and spent.

On the day you chose, the site emails the recipient a link to their card. The card lives at that private link and nowhere public. Anyone who has the link can see the card, its message and its code, so pass it on the way you would hand over a card in an envelope.

When you use the site

The delivery checker remembers the postal code and the date you last gave it, so you are not asked the same question on every page. That is held in the shop’s session, which a cookie in your browser points to. It is not attached to your name unless you go on to order, and the session ends on its own after two days, or a week if you are signed in.

WooCommerce, the shop software this site runs on, sets cookies to keep track of what is in your cart and to keep you signed in if you have an account. Without those the cart empties every time you open a new page. Stripe’s script, on the order page and at checkout, can set cookies of its own for the fraud checks described above.

Like any web server, ours keeps routine logs of the requests it receives, such as the address a request came from, the page asked for and the type of browser, so problems and attacks can be traced.

The shop software also notes how you arrived: the site or link you came from (Facebook, Instagram, a Google search, or typing the address yourself), the first page you landed on, what kind of device and browser you are using, and how many pages you looked at. It keeps this in cookies whose names start with sbjs_. Most of them last only until you close your browser, and the one counting pages lasts thirty minutes. If you place an order, that note is saved with it, so Anne can tell whether Facebook, Instagram, Google or word of mouth is what brings people to order. It stays in her own shop records. It is not sent to Google, to an advertising network or to anyone else, and the cookies are not used for advertising.

There are no advertising cookies on this site, no tracking pixels, and no outside analytics service watching what you read.

When you ask the site a question

The “Ask a question” box in the corner of the page is answered by an AI assistant, not by Anne. It runs on Claude, a model made by Anthropic. When you send it a message, what you typed goes to Anthropic so the assistant can answer, together with the rest of that conversation, the address of the page you are on, and, on the order page, what you have chosen so far. It is not sent your name, your email address, your IP address, or anything about orders you have placed. Anthropic does not use these messages to train its models.

We keep a copy of each question you ask on this website, with the page it was asked from, so Anne can see what people want to know. It carries no name and nothing else that identifies you, unless you type it into the question yourself, so please do not put personal details there. Only the most recent six hundred questions are kept. Older ones are deleted.

If the assistant cannot answer, it offers to pass your question to Anne. That part asks for your name and email address in an ordinary form on the page, and they go to the shop directly. They are never sent to the AI.

While a conversation is open, your browser keeps it in that tab so it follows you from page to page. It is cleared when you close the tab. To stop the assistant being flooded, the site also counts how many messages arrive from each network over a few minutes. That count is kept against a scrambled form of part of your internet address, never alongside anything you said, and it is deleted within a day.

When you write to us

The contact page, the request form on each sympathy piece, and the assistant’s offer to pass a question to Anne all save what you send on this website first, as a private enquiry only the shop can open, and then email it to Anne. Saving it first means nothing is lost if an email goes astray. An enquiry holds your name, your email address, your phone number if you gave one, what you asked, the page you sent it from, and for a funeral piece the details of the service and the card message.

The wedding and subscription enquiries work differently. They compose a message and hand it to your own email program, so what you send goes directly to Anne’s inbox the same way any email would, and nothing is stored on this website in between.

If you have an account

You do not need an account to order. If you have one, it holds your name, your email address, your delivery addresses and your past orders, so you do not have to type them again.

Who else sees it

Anne. That is the honest answer to most of this, because there is one person in the studio.

Beyond that:

• Stripe, to take the payment.
• Brevo, the email service this site sends through. Order confirmations, enquiries on their way to Anne, and gift cards on their way to the recipient all pass through it.
• Anthropic, which runs the question box, and sees only what is described above.
• Esri and OpenStreetMap, which draw the map at checkout, as described above.
• The web host, which stores the site and its database, as any host does.
• The web developer who built and looks after this site, who can reach its database to keep it working and does not use what is in it for anything else.
• The recipient, who is handed the flowers and the card you wrote, or sent the gift card.

Stripe, Brevo and Anthropic are based outside Canada, so what they handle may be stored and processed in the United States or Europe, under the laws there.

We do not sell your information, rent it, trade it, or hand it to a marketing company. We do not pass orders to a wire service or to a florist in another town, so nothing about your order travels beyond this studio and the services listed here.

The one exception is the ordinary one: if we are legally required to produce records, for example to the Canada Revenue Agency, we will.

How long we keep it

Order records are kept for as long as tax and business records have to be kept in Canada, which is six years from the end of the tax year the order falls in. That is not a preference, it is a requirement.

Card messages and delivery instructions are saved as part of the order, so they are kept with it. They are not used for anything once the flowers are delivered.

Gift cards are kept with the order records, and for as long as the card still has money on it.

Enquiries stay in the shop’s enquiry list, and in Anne’s email, until she deletes them. If you would like yours gone, ask.

If you have an account, it stays until you ask us to close it.

What you can ask for

Under Canadian privacy law you can ask us what personal information we hold about you, ask us to correct it if it is wrong, and ask us to delete it. Write to us and we will answer.

Deletion has one limit worth naming up front: we cannot delete the order records we are required to keep for tax purposes until that period has passed. Everything else can go.

Children

This is a flower shop. The site is not aimed at children and we do not knowingly collect information from anyone under thirteen.

If this page changes

The date at the top of this page is the day it last changed. If we change something that matters, that date changes with it.

Getting in touch

Questions about any of this go to the phone number and email address at the foot of this page, and they reach Anne.

If you are not satisfied with how we have answered, you can raise it with the Office of the Privacy Commissioner of Canada.