What I do with your details

• An order needs a name, an email address and a phone number.
• There are no accounts and no passwords, so there is nothing to sign up for.
• Card details are never asked for, because payment is by bank transfer.

The order form asks for a few details to help me get everything just right:

• Your name: so I know who your order is for.
• Your email address: this is where I’ll send your order confirmation and any updates.
• Your phone number: just in case I need to reach you on the day.
• Your delivery address: only if you choose delivery.
• Your notes or custom request: tell me anything that will help, such as allergies, the occasion, or how you’d like your bake to look.
• Inspiration photos or links: always welcome if you have something in mind.
• Your order and preferred date: so I know exactly what you’d like and when you need it.

Only your name, email address and phone number are required. Everything else is there to help me make your order just the way you’d like it, so only share what feels useful.

When an order is submitted the server keeps a scrambled, one-way fingerprint of the internet address it came from. It is there to notice one machine firing off a dozen orders in a minute, and it cannot be turned back into an address or matched to you.

Your basket is not sent anywhere until you press the button. Until then it sits in your own browser’s storage, on your own device, and clearing your browsing data clears it.

No card numbers, ever. Once I have confirmed the day and the price I send bank details, and the transfer happens in your own banking app. The only part of it this site sees is the reference on your order.

I use Vercel’s Web Analytics and Speed Insights to see how many people visited, which pages they looked at, and how slow the site felt on a phone. Both are cookie-free: nothing is stored on your device, you are not followed from site to site, and no profile of you is built.

The private link to an order’s status page is stripped out before either one is told about the visit, so it never leaves your browser.

This site sets no cookies on a customer’s browser. The only one it sets anywhere is the login session for the back office, which is mine. That is why there is no consent banner in your way: there is nothing to consent to.

Three services keep the shop running, and each handles only what it needs to:

• Supabase stores the orders and any photos you attach.
• Vercel hosts the site and runs the code that takes the order.
• Resend delivers the emails, and tells me if one bounced or was marked as spam.

Their servers sit outside New Zealand, so that is where your details are stored. Nobody else is given them, and they are never sold or handed to advertisers.

Your confirmation email includes a private link to your order, which makes it easy to come back and check your order details. Because anyone with the link can view the order, please keep it somewhere safe and avoid sharing it.

The link isn’t listed publicly on the website, and search engines are asked not to include it in their results.

The day after you collect an order I send one email asking how it went. It links to a short form: your name, whatever you’d like to say, a mark out of five for each thing you ordered, and a tick box. Answering is entirely up to you, and nothing happens if you don’t. The marks are optional on their own, so you can write something and leave them alone.

What you write is kept with your order and read by me. Nothing you write goes on the website on its own.

• Leave the box unticked and what you wrote stays between us. I’ll still read it, and it will never be quoted anywhere.
• Tick it and I may quote what you wrote on the site, under the name you typed into the form. Never your email address, your phone number, or what you ordered.

I choose which words go up, and I read them before they do. Changed your mind, either way? Email valencia.vvbakes@gmail.com and I’ll take it down.

The marks out of five work differently, and the form says so where it asks for them. They are never quoted and never carry your name, so the tick box does not decide anything about them. Each is added to an average shown on that product’s page, and that happens on its own, without me reading it first. While a product has only been marked once or twice the average sits very close to the marks behind it, so treat it as public rather than hidden in a crowd. Email valencia.vvbakes@gmail.com if you would rather yours were not counted and I’ll remove it, along with the words it came with.

That email has a link at the bottom that stops me asking again, and your own mail app’s unsubscribe button works too. Either one is enough: I keep the address on a short list of people not to ask, and nothing else about you goes on it. Emails about an order you place keep coming, because those are how you find out it’s confirmed and when to collect it.

I keep basic order records for seven years, as required for business and tax record-keeping in New Zealand.

Your inspiration photos and personal notes are treated separately and aren’t kept as part of those long-term sales records.

Email valencia.vvbakes@gmail.com and you can ask what I hold about you, ask me to fix anything that’s wrong, or ask me to delete what I am not required to keep. The Privacy Act 2020 gives you a right to the first two, and I will come back to you within 20 working days.

If you are unhappy with how I handled it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Anything that changes is posted here with a new date. Last updated 22 September 2026.

Anything here you want explained, just ask: valencia.vvbakes@gmail.com, or the order form if it is about an order you are placing.