Privacy Policy
The short version. This website does not set cookies, does not run advertising trackers, does not have user accounts, and does not process payments. Its host counts page views in aggregate, without cookies and without following you anywhere. The order form sends your request straight to the bakery by email. It is not stored on this website or in any database. The “Sprinkles” chat helper does send what you type to Cloudflare’s AI service to generate a reply, so please treat it as you would any chat box and keep personal details out of it. The only information the bakery receives through this site is what you choose to send by email.
1. Who this policy is from
This policy covers the website for Buttercup’s Baking Society, a home bakery serving Decatur and the surrounding areas.
- Business name: Buttercup’s Baking Society
- Structure: a home bakery run by its owner as a sole proprietor. There is no registered company or separate legal entity.
- Where it operates: Decatur, Wise County, Texas
- Privacy contact: [email protected]
Because the bakery works out of a private home, no street address is published here. Email is the contact route for any privacy question, and a postal address will be provided on request where someone genuinely needs one.
2. What this website collects
As implemented today, this website collects nothing directly. There is no database, no back-end application and no form delivery service connected to it. Specifically:
| Feature | On this site? | Notes |
|---|---|---|
| Cookies | No | The site sets no cookies of any kind. No consent banner is required because there is nothing to consent to. |
| Analytics | Limited | No Google Analytics, no heatmaps, no session recording, and no advertising analytics. The site’s host, Cloudflare, does count page views through its own Web Analytics, which is served from this site’s domain. It sets no cookie, stores nothing in your browser and does not follow you to other websites; the bakery sees only aggregate counts, never individuals. |
| Advertising / tracking pixels | No | None present. |
| Local or session storage | No | The site’s JavaScript stores nothing in your browser. |
| Order form delivery | Yes | What you type is sent to this site’s server, turned into an email and delivered to the bakery through Brevo, a transactional email provider. Nothing is written to a database or kept on the website; once the email is handed to Brevo the site retains no copy. Brevo processes the message in order to deliver it and keeps its own delivery records. If sending fails, the form falls back to opening your own email app so your request is not lost. |
| Chat helper (“Sprinkles”) | Yes | What you type is sent to Cloudflare Workers AI, which runs the model that writes the reply. The message and the reply are not logged or stored by this website, and no chat history is kept once you close the page. Allergy and dietary questions are intercepted before the model ever sees them and are answered with a fixed message telling you to contact the bakery. If the AI service is unavailable, Sprinkles falls back to a short list of answers held in the page. Please do not type anything sensitive into it. |
| Email newsletter sign-up | No | Not offered. |
| User accounts / logins | No | Not offered. |
| File uploads | No | Not offered. |
| Online payments | No | No payment processor is connected. Nothing can be paid for on this site. |
| Scheduling / booking tool | No | Not offered. |
| Embedded maps | No | None. No Google Maps or equivalent is loaded. |
| Embedded video | No | None. |
| Social media embeds or feeds | No | None. Recommendations shown in the “Kind words” section carry a plain link to the bakery’s Facebook Page, which does nothing until you click it. No Facebook script, widget, feed or pixel is loaded, and Facebook is not told that you visited this site. |
| External APIs | No | Your browser only ever talks to this site’s own domain. The Facebook recommendations are fetched by a scheduled job on the server, so no visitor request reaches Meta. |
| Web fonts | No | The two typefaces are served from this site’s own domain. Nothing is requested from Google or any other font host. |
3. Third parties that do receive something
Simply opening this site sends nothing to anyone but this site’s own server: the typefaces are self-hosted, and there is no analytics, no cookie and no embedded third-party content. The providers below are involved only when you choose to do something, and none is used for marketing or profiling.
Brevo (order form delivery)
When you send an order request, the name, contact detail, item, date and message you entered are transmitted to Brevo, which delivers them as an email to the bakery. Brevo acts as the delivery provider and holds its own sending records under its privacy policy. This website stores nothing: there is no database, and no copy of your request is kept once it has been handed over.
What the bakery then holds is simply the email in its mailbox, covered by section 4 below.
Website hosting
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes the technical information needed to serve a page, including your IP address, the time of the request and the page requested, and may retain it briefly in server logs for security and reliability purposes. The bakery does not have access to an analytics dashboard built from this data and does not use it to identify visitors.
4. Information you send the bakery directly
If you email [email protected], the bakery will have your phone number or email address and whatever you tell it about your order: typically a name, a date, an occasion and a delivery or collection preference. That information is used to quote, bake and hand over your order, and for nothing else. It is not sold, rented or shared with advertisers.
The email address is published on this site as a plain link. Your message goes to the bakery’s own mailbox through your own email provider; this website plays no part in sending, receiving or storing it.
How long it is kept: order enquiries, texts and order notes are kept for 12 months and then deleted. That is long enough to recognize a returning customer and remember what was made last time, and short enough to be a real limit rather than keeping everything forever. If you would like your details removed sooner, ask and they will be.
5. Children
This site is aimed at adults arranging orders. It is not directed at children, and no part of it knowingly collects information from children.
6. Your choices and rights
Because the site itself collects nothing, there is no website data to access, correct, export or delete. For information you have sent the bakery by email, you can ask for it to be deleted at any time by contacting the bakery at the address above.
Texas has a state privacy law, the Texas Data Privacy and Security Act, which exempts businesses of this size from most of its obligations. Rather than lean on that exemption, the bakery will honor these requests from anyone who asks, whether or not the law compels it:
- tell you what information it holds about you
- correct anything that is wrong
- delete what it holds, unless it is needed to finish an order you have placed
Email [email protected] and you will get an answer within 30 days. There is no charge, and you will not be asked why.
7. Do Not Track
The site does not track visitors, so there is no tracking behaviour for a Do Not Track signal to change.
8. When this policy will need to change
Important. This policy describes the site exactly as it is built today. Two planned changes would each make it inaccurate, and it must be rewritten before either goes live:
9. Changes to this policy
If this policy changes, the "Last updated" date at the top will change with it. Material changes will be reflected on this page rather than communicated individually.
10. Contact
Questions about this policy can go to [email protected].
About this document. This is a website policy draft prepared from an audit of what this specific site actually does, together with the business information supplied by the owner. It is not legal advice, and it has not been reviewed by a lawyer. Privacy obligations vary by state and by how a business operates offline, so it is worth having reviewed against the bakery’s own circumstances if that ever changes.