Privacy

Our role

When a flower shop uses BouquetOS, the shop is the controller of its customers’ personal data: it decides what to collect and why. BouquetOS is a processor acting on that shop’s instructions. We do not sell personal data, we do not share it with third parties for their own purposes, and we do not use it to train models or to make automated decisions with legal or similarly significant effects.

What we collect

From the shop’s Shopify store, when the shop connects it: order records and the customer details attached to them — customer name, email address, phone number, the recipient’s name and phone number, and the delivery address. We also store order contents, amounts, the requested fulfillment date and time window, and the original order payload we received, so that an order can be re-checked if something maps incorrectly.

From the shop’s other sales channels: the same order and customer details for orders imported from a connected Square, Squarespace or WooCommerce store, or forwarded to the shop’s BouquetOS email address, and the supplier invoices forwarded there.

From the shop itself: the names, email addresses and roles of staff invited to the workspace, their working hours and pay rates where the timeclock is used, and the shop’s own settings — opening hours, closed dates, delivery rules.

From the shop’s bank and card accounts, when the shop connects them for Monthly Close: the transactions on those accounts — date, amount, description and status — read through Stripe Financial Connections, plus the bank’s name and the account’s last four digits. We never receive bank sign-in details, full account numbers or balances, and the connection is read-only.

From the shop’s storefront visitors: when the shop installs our storefront block, a shopper’s chosen fulfillment method, date and time window are written to their Shopify cart so the order arrives with those details. The block does not set advertising or analytics cookies and does not track shoppers across sites.

From this website: if you sign up, the email address and shop name you enter, plus billing details handled by our payment processor. We never see or store full card numbers.

Website analytics: www.bouquetos.com uses Google Analytics to count visits, see which pages are read and measure sign-ups. It records pages viewed, approximate location, device and browser type, and how a visitor arrived, using a first-party cookie. Advertising features are off and nothing is used for ads. For visitors in the European Economic Area, the UK and Switzerland, analytics cookies are off by default. This applies only to our own website: the BouquetOS console and the storefront block do not use it.

Why we use it

Only to run the service the shop is paying for: importing and scheduling orders, printing run sheets, syncing fulfillment status back to Shopify, calculating hours and pay, supporting the shop when something goes wrong, and having our own staff check an imported order our order reader wasn't sure of, so the shop doesn't have to. We use the minimum data each of those jobs requires, and we do not repurpose it. Website analytics are used only to understand and improve this website.

Who else processes it

We use a small number of vendors to run the service. Each processes data only to provide their part of it:

• Railway — application hosting and the PostgreSQL database where shop data is stored.
• Cloudflare — DNS, and object storage for images uploaded to orders and purchase orders.
• Vercel — hosting for this marketing site and the account portal.
• Resend — transactional email (invitations, sign-in links, order receipts sent on the shop’s behalf), and receiving the emails forwarded to a shop’s BouquetOS address.
• Google Gemini API — reads receipt photos, supplier invoices, and orders forwarded by email or imported from Square, Squarespace or WooCommerce, into draft purchase orders and orders.
• Stripe — subscription billing for the shop. Card details go directly to Stripe and never reach our servers. Stripe Financial Connections also links the bank and card accounts a shop connects, and shares their transactions with us.
• TypeSafe — suggests a label for a bank transaction our own matching couldn’t explain. It receives the transaction’s description and amount and the shop’s bill names, never account numbers or who owns the account.
• Google Maps Platform — address lookup and validation when an address is entered.
• Shopify, Square, Squarespace and WooCommerce — the source of order data for shops that connect one of those stores.
• Google Analytics — visit and sign-up statistics for this marketing website only.

AI assistants you connect

A shop’s user can connect an AI assistant — for example Meta Muse, Claude or ChatGPT — to their own BouquetOS workspace through our AI connector, by signing in and approving the connection (OAuth).

• At that user’s direction, the assistant receives the workspace data its tools return — orders, including customer and recipient details, purchase orders, and reports — to answer the user’s requests. The assistant’s provider then processes that data under its own terms. We do not otherwise share data with the assistant’s provider.
• The assistant can reach only what that user can see in the console, and can be connected read-only. Access ends when the user disconnects the assistant, when their BouquetOS account is disabled, or when its tokens expire: access tokens last one hour, and an unused connection lapses after 30 days.
• Each action the assistant takes is recorded in the workspace’s audit log, with personal data redacted.
• For the connection itself we store the link between the assistant’s grant and the user and workspace, the assistant’s OAuth client registration, and its tokens (refresh tokens are stored hashed), for as long as the connection exists.

Where it is processed

Our application servers and database run in the United States. If you are in the UK or EEA, this means your data is transferred outside your region; we rely on the standard contractual clauses offered by our hosting providers for those transfers. We can discuss regional hosting with shops that require it.

How long we keep it

Personal details attached to a completed or cancelled order — customer and recipient names, phone numbers, email address, delivery address, note-card text and order notes — are automatically erased three years after the order’s fulfillment date. What remains is the anonymous business record: what was made, when, and for how much.

Three years is deliberate rather than arbitrary. Flower shops are seasonal and occasion-driven: customers return for the same anniversary, birthday or memorial year after year, and often ask for “the same as last time”. Three years covers that recurrence while still putting a firm limit on how long personal details are held.

The rest of the order record is the shop’s own business record, kept while the shop’s workspace is active. When a shop closes its account, its workspace and the data in it are deleted.

Bank transactions are part of that business record too. Disconnecting a bank account stops new transactions arriving straight away; the ones already imported stay until the workspace is deleted.

If a shop uninstalls the BouquetOS app from Shopify, the connection is marked uninstalled straight away and stops being used. Shopify then sends us a store redaction request — usually around 48 hours later — and we erase the stored access credentials at that point. We keep a minimal record linking the store to its workspace so that reinstalling reconnects to the same data instead of stranding it. Order records already imported remain the shop’s own records until the workspace itself is deleted.

Individual customer records are erased sooner on request — see below.

Requests from shoppers

If you bought flowers from a shop that uses BouquetOS and want to see or delete your data, contact the shop directly: they are the controller and can act immediately. Shopify also forwards deletion and access requests to us automatically.

When we receive a deletion request, we erase that person’s name, email address, phone number, recipient details, delivery address, order notes, and the original order payload from the affected orders. Access requests are answered within 30 days. If a shop closes its Shopify store, we delete its stored credentials.

How we protect it

• All traffic is encrypted in transit with HTTPS/TLS.
• Databases and backups are encrypted at rest by our hosting provider. Shopify access tokens are additionally encrypted with AES-256-GCM before being stored, using a key held outside the database.
• Each shop’s data is isolated from every other shop’s at the database level, so one workspace cannot read another’s.
• The console is invite-only. Every request is authenticated and checked against the user’s role.
• Actions that change or expose personal data are recorded in an audit log, with secrets and personal data redacted from what is stored.
• We request the narrowest Shopify permissions the product needs, and development uses separate stores and databases from production.

Changes

If we make a material change to how we handle personal data, we will update this page and notify shops with active workspaces before it takes effect.

Contact

Questions about this policy, or a data request: privacy@bouquetos.com.