Privacy
Privacy policy
What we collect, why we collect it, who processes it, and how to change your mind.
Who we are
Buunch is a florist atelier in New York City. We are the controller of the personal information described here. You can reach us atcaroline@buunch.com, or by post at Buunch, 120 West 28th Street, 4J, New York, NY 10001, United States.
What we collect
- What you give us. Your name, email address, phone number, message, the delivery address and the card message you write for a recipient.
- What you order. The products, delivery date and window, and the amounts charged. Card details are entered on Shopify's checkout and handled by Shopify Payments; we never see or store a full card number.
- How the site is used. Pages viewed, links clicked, form fields used and scroll depth, plus a sampled session replay in which keystrokes in form fields are masked and password, card and file inputs are never recorded.
- Marketing. If you subscribe: your email address, the date you subscribed and whether you open or click a message.
Cookies and similar technologies
We use three categories. Essential storage keeps your cart and your session working. Analytics measures how the site is used.Advertising measures whether an ad led to an order. Where consent is required, we ask for it before analytics or advertising storage is set, and you can change your choice at any time through Cookie preferences in the store's footer.
| Provider | What it does | Category |
|---|---|---|
| Shopify | Store platform, checkout, payments, order records | Essential |
| Cloudflare | Hosting, content delivery and security for buunch.com | Essential |
| xix | Our own first-party analytics and sampled session replay | Analytics |
| Klaviyo | The email list, if you subscribe | Marketing |
| Google Ads | Conversion measurement, sent server-side — no Google tag runs in your browser on buunch.com | Advertising |
| Meta, Pinterest | Advertising measurement on the store | Advertising |
| Lucky Orange, Mailchimp | Session replay and a legacy newsletter widget on the store | Analytics / Marketing |
Why we use it
- To take, prepare and deliver your order, and to answer your inquiry.
- To keep the store and the site working, secure and fraud-free.
- To understand which pages and campaigns work, so we can improve them.
- To send the seasonal notes you asked for — only if you asked.
- To meet our legal, tax and accounting obligations.
Who processes it
We use service providers who process information on our behalf under contract: Shopify (store and payments), Cloudflare (hosting and delivery), Resend (sending our transactional email), Klaviyo (the email list), and the analytics and advertising providers listed above. They may process information in the United States. We do not sell your personal information for money.
Sale, sharing and your opt-out
Under California law, disclosing identifiers and usage data to advertising partners so they can measure or target advertising can count as sharing for cross-context behavioral advertising. You can opt out:
- use Do Not Sell or Share My Personal Information in the store's footer, or
- send the Global Privacy Control signal — we honor it automatically, or
- write to caroline@buunch.com.
How long we keep it
- Order and tax records: as long as tax and accounting law requires (currently seven years).
- Inquiries: up to 24 months after the last contact.
- Analytics identifiers: up to 14 months. Session replays: up to 30 days.
- Email list: until you unsubscribe, plus a suppression record so we do not email you again.
Your rights
You may ask to see the personal information we hold about you, to correct it, to delete it, to receive a portable copy, or to opt out of sharing. You may also ask us not to contact you. We will not discriminate against you for exercising a right. Write tocaroline@buunch.com; we answer within 30 days, and we may ask you to confirm your identity first. An authorised agent may act for you with written permission.
Security
Access to order data is limited to the atelier, connections are encrypted in transit, and analytics input capture is masked by default. No system is perfect: if a breach affects your information we will notify you and the authorities as the law requires.
Children
The site and the store are not directed to children under 16, and we do not knowingly collect their personal information.
Visitors outside the United States
We deliver within the New York City area. If you visit from elsewhere, your information is processed in the United States, where privacy law differs from your home jurisdiction.
Changes
If we change how we handle personal information we will update this page and its effective date. Material changes affecting existing customers are also announced by email.
Contact
Questions, requests, or a complaint:caroline@buunch.com · Buunch, 120 West 28th Street, 4J, New York, NY 10001.