Privacy Policy
The short version. This website does not set cookies, does not run analytics or advertising trackers, does not have user accounts, and does not process payments. The order form sends your request straight to the bakery by email. It is not stored on this website or in any database. The “Sprig” chat helper does send what you type to Cloudflare’s AI service to generate a reply, so please treat it as you would any chat box and keep personal details out of it. The only information the bakery receives through this site is what you choose to send by email.
1. Who this policy is from
This policy covers the website for Buttercup’s Baking Society, a home bakery serving Decatur and the surrounding areas.
- Business name: Buttercup’s Baking Society
- Registered or legal entity name: TODO:REPLACE
- Postal address: TODO:REPLACE: required in most privacy policies
- Privacy contact: Kim@buttercupsbakingsociety.com
2. What this website collects
As implemented today, this website collects nothing directly. There is no database, no back-end application and no form delivery service connected to it. Specifically:
| Feature | On this site? | Notes |
|---|---|---|
| Cookies | No | The site sets no cookies of any kind. No consent banner is required because there is nothing to consent to. |
| Analytics | No | No Google Analytics, no page-view counter, no heatmaps, no session recording. |
| Advertising / tracking pixels | No | None present. |
| Local or session storage | No | The site’s JavaScript stores nothing in your browser. |
| Order form delivery | Yes | What you type is sent to this site’s server, turned into an email and delivered to the bakery through Brevo, a transactional email provider. Nothing is written to a database or kept on the website; once the email is handed to Brevo the site retains no copy. Brevo processes the message in order to deliver it and keeps its own delivery records. If sending fails, the form falls back to opening your own email app so your request is not lost. |
| Chat helper (“Sprig”) | Yes | What you type is sent to Cloudflare Workers AI, which runs the model that writes the reply. The message and the reply are not logged or stored by this website, and no chat history is kept once you close the page. Allergy and dietary questions are intercepted before the model ever sees them and are answered with a fixed message telling you to contact the bakery. If the AI service is unavailable, Sprig falls back to a short list of answers held in the page. Please do not type anything sensitive into it. |
| Email newsletter sign-up | No | Not offered. |
| User accounts / logins | No | Not offered. |
| File uploads | No | Not offered. |
| Online payments | No | No payment processor is connected. Nothing can be paid for on this site. |
| Scheduling / booking tool | No | Not offered. |
| Embedded maps | No | None. No Google Maps or equivalent is loaded. |
| Embedded video | No | None. |
| Social media embeds or feeds | No | None. There are no social media links or widgets on the site. |
| External APIs | No | The site makes no API calls. |
| Web fonts | Yes | See section 3. This is the one third-party request the site makes. |
3. Third parties that do receive something
Two service providers are involved in delivering this website to you. Neither is used for marketing or profiling.
Google Fonts
The site loads two typefaces (Fraunces and Nunito Sans) from Google’s font servers at fonts.googleapis.com and fonts.gstatic.com. To deliver those files, your browser makes a request to Google, which necessarily discloses your IP address, your browser and operating system version, and the address of the page requesting the font. Google states that it does not use these requests to build advertising profiles. No cookie is set by this request.
If you would prefer the site make no third-party requests at all, the two font files can be self-hosted instead. TODO:REPLACE: decide whether to self-host fonts before launch; if you do, delete this subsection.
Brevo (order form delivery)
When you send an order request, the name, contact detail, item, date and message you entered are transmitted to Brevo, which delivers them as an email to the bakery. Brevo acts as the delivery provider and holds its own sending records under its privacy policy. This website stores nothing: there is no database, and no copy of your request is kept once it has been handed over.
What the bakery then holds is simply the email in its mailbox, covered by section 4 below.
Website hosting
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes the technical information needed to serve a page, including your IP address, the time of the request and the page requested, and may retain it briefly in server logs for security and reliability purposes. The bakery does not have access to an analytics dashboard built from this data and does not use it to identify visitors.
4. Information you send the bakery directly
If you email Kim@buttercupsbakingsociety.com, the bakery will have your phone number or email address and whatever you tell it about your order: typically a name, a date, an occasion and a delivery or collection preference. That information is used to quote, bake and hand over your order, and for nothing else. It is not sold, rented or shared with advertisers.
The email address is published on this site as a plain link. Your message goes to the bakery’s own mailbox through your own email provider; this website plays no part in sending, receiving or storing it.
How long it is kept: TODO:REPLACE: state how long order enquiries, texts and order notes are retained (for example, "order notes are kept for 12 months, then deleted")
5. Children
This site is aimed at adults arranging orders. It is not directed at children, and no part of it knowingly collects information from children.
6. Your choices and rights
Because the site itself collects nothing, there is no website data to access, correct, export or delete. For information you have sent the bakery by email, you can ask for it to be deleted at any time by contacting the bakery at the address above.
Depending on where you live, you may have additional statutory rights over personal information a business holds about you. TODO:REPLACE: confirm which state or national privacy laws apply to this business and add the specific rights and response times they require
7. Do Not Track
The site does not track visitors, so there is no tracking behaviour for a Do Not Track signal to change.
8. When this policy will need to change
Important. This policy describes the site exactly as it is built today. Two planned changes would each make it inaccurate, and it must be rewritten before either goes live:
9. Changes to this policy
If this policy changes, the "Last updated" date at the top will change with it. Material changes will be reflected on this page rather than communicated individually.
10. Contact
Questions about this policy can go to Kim@buttercupsbakingsociety.com.
About this document. This is a website policy draft prepared from an audit of what this specific site actually does, together with the business information supplied by the owner. It is not legal advice, and it has not been reviewed by a lawyer. Privacy obligations vary by state and by how a business operates offline, so please have it reviewed against your own circumstances, and resolve every TODO:REPLACE above, before publishing it.