What I do with your details

• An order needs a name, an email address and a phone number.
• There are no accounts and no passwords, so there is nothing to sign up for.
• Card details are never asked for, because payment is by bank transfer.
• Nothing is sold, rented, or used to advertise to you anywhere.

The order form asks for:

• your name, so I know whose box it is;
• your email address, which is where the confirmation and the order link go;
• your phone number, for the day itself if something changes;
• a delivery address, only if you choose delivery;
• anything you type into the notes or the custom request — allergies, an occasion, how you want it to look;
• any inspiration photos or link you attach;
• what you ordered, and the date you picked.

Only the first three are required. The rest is there because it is useful to you, so leave out whatever you would rather not send.

When an order is submitted the server keeps a scrambled, one-way fingerprint of the internet address it came from. It is there to notice one machine firing off a dozen orders in a minute, and it cannot be turned back into an address or matched to you.

Your basket is not sent anywhere until you press the button. Until then it sits in your own browser’s storage, on your own device, and clearing your browsing data clears it.

No card numbers, ever. Once I have confirmed the day and the price I send bank details, and the transfer happens in your own banking app. The only part of it this site sees is the reference on your order.

I use Vercel’s Web Analytics and Speed Insights to see how many people visited, which pages they looked at, and how slow the site felt on a phone. Both are cookie-free: nothing is stored on your device, you are not followed from site to site, and no profile of you is built.

The private link to an order’s status page is stripped out before either one is told about the visit, so it never leaves your browser.

This site sets no cookies on a customer’s browser. The only one it sets anywhere is the login session for the back office, which is mine. That is why there is no consent banner in your way — there is nothing to consent to.

Three services keep the shop running, and each handles only what it needs to:

• Supabase stores the orders and any photos you attach.
• Vercel hosts the site and runs the code that takes the order.
• Resend delivers the emails, and tells me if one bounced or was marked as spam.

Their servers sit outside New Zealand, so that is where your details are stored. Nobody else is given them, and they are never sold or handed to advertisers.

The link in your confirmation email is the key to that order — anyone holding it can see the order, so it is worth keeping to yourself. It is not listed on the site, and search engines are told to stay out of it. If you would rather it stopped working, say so and I will cancel it.

Order records are kept for seven years, which is how long New Zealand tax law asks a business to hold its sales records. Inspiration photos and the notes on an order are not part of that, so I will delete those sooner if you ask.

Email valenciangadi@yahoo.com and you can ask what I hold about you, ask me to fix anything that’s wrong, or ask me to delete what I am not required to keep. The Privacy Act 2020 gives you a right to the first two, and I will come back to you within 20 working days.

If you are unhappy with how I handled it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Anything that changes is posted here with a new date. Last updated 15 September 2026.

Anything here you want explained, just ask — valenciangadi@yahoo.com, or the order form if it is about an order you are placing.