Privacy policy

Who we are

Blue Whale Trees is a small native tree and shrub nursery in the United States, reachable at captain@bluewhaletrees.com. [Owner to confirm: legal business name and mailing address.]

What we collect, and why

• Account. Your email address and, if you give it, your name. We use passwordless sign-in: a one-time link is emailed to you, so we never store a password. Needed to show you your orders.
• Orders. What you bought, the price paid, your shipping address, a phone number for the carrier if you give one, and any note you add. Kept as our sales and tax record.
• Payment. Card payments are processed by Stripe. Your card number goes directly to Stripe and never touches our systems; we receive a confirmation, the last four digits and the payment reference. Stripe's handling of your data is described in its own privacy policy.
• Cart. A random cookie ties your cart to you while you shop. It contains no personal data.
• Messages. When you use the support form we store your name, email, topic and message so we can reply.
• Newsletter. Your email address, only if you sign up. Email us at any time to be removed. [Owner to confirm: how newsletters are sent and whether they carry an unsubscribe link.]
• Preferences. Your light or dark theme and, if you use the tree finder, your hardiness zone are stored in your browser so we can remember them. They never leave your device except the theme cookie, which lets us render the page in the right colors.
• Server logs. Our hosting provider (Cloudflare) records requests, including IP address and browser type, for security and to keep the site running. We use the IP address to limit abusive sign-in and form submissions.

What we do not do

• No advertising networks, no tracking pixels, no third-party analytics scripts, no social-media plugins.
• We do not sell, rent or trade personal data.
• We do not email you marketing unless you asked for the newsletter.

Who else handles your data

Only the services needed to run the store: Cloudflare (hosting, database and image storage), Stripe (payments), our transactional email provider for order confirmations and sign-in links [Owner to confirm: provider name], and the carriers who deliver your order, who receive your name, address and phone number for that purpose. We may disclose data where the law requires it.

Cookies

Three, all first-party: a session cookie when you sign in, a cart cookie and a theme cookie. Stripe sets its own cookies on its hosted payment page. None are used for advertising. Blocking cookies will stop the cart and sign-in from working.

How long we keep it

Orders and payment records for as long as tax law requires [Owner to confirm: retention period, typically seven years]. Support messages until answered and archived. Newsletter addresses until you unsubscribe. Accounts until you ask us to delete them. Sign-in links expire in 20 minutes and sessions expire automatically.

Your choices

Email captain@bluewhaletrees.com to see what we hold about you, correct it, or have your account and messages deleted. We will keep the parts of order records the law requires us to keep and delete the rest. Residents of states with privacy laws (such as California) have the rights those laws provide; we honor them for everyone.

Children

The store is for adults. We do not knowingly collect data from anyone under 16.

Changes

If this policy changes in a way that matters, the date at the top will change and the change will be described here.