What we keep

Last updated [DATE]

Draft for review. Highlighted text needs filling in or confirming. This was written as a plain-language starting point, not legal advice. Have it checked before you launch.

Long Distance Cakes is run by [YOUR NAME OR BUSINESS NAME], [ABN, if you have one], based in [CITY, STATE], Australia. This policy explains what personal information we collect when you send or receive a cake, why we collect it, and who we share it with.

What we collect

When you send a cake

Your name and email address.
The birthday person’s name, and their email address if you choose email delivery.
Your message, the cake design and the number of candles.
Whether your payment succeeded. Your card details go straight to our payment provider, Stripe. We never see or store them.

When you open a cake

Whether and when the candles were blown out, so we can let the sender know.
Our hosting provider automatically handles technical information such as your IP address and browser type in order to deliver the page and protect the site from abuse.

The microphone

Blowing out the candles uses your device’s microphone, and only if you choose to turn it on. The sound is analysed on your own device, moment by moment, to detect a breath. It is never recorded, stored or sent to us or anyone else. You can always press and hold a button instead.

Why we use it

To create the cake and deliver it to the birthday person.
To send the sender a receipt with the cake’s link.
To tell the sender when the candles have been blown out.
To help if something goes wrong with an order, and to keep business records.

We don’t sell personal information, and we don’t send marketing emails. The only emails we send are the ones that are part of an order.

Information about the birthday person

When you send a cake, you give us someone else’s name and possibly their email address. Please only do this for someone who would expect a birthday message from you. We use their details only to deliver your cake.

Who we share it with

We use a small number of services to run the site. Each only gets what it needs:

Cloudflare hosts the website and stores orders.
Stripe processes payments.
Resend sends our emails.
Google Fonts supplies a typeface used in our emails, so your email app may request it from Google when you open one.

These providers may store or process information outside Australia, including in the United States and Japan. We may also disclose information if the law requires it.

Cookies

We don’t use advertising or analytics cookies. Our hosting provider may set cookies that are strictly needed for security. Stripe’s payment page is run by Stripe and follows its own privacy policy.

Who can see a cake

Each cake has a private, hard-to-guess link. Anyone who has the link can open that cake and read its message, so share it only with the person it’s for. Cake pages are hidden from search engines.

How long we keep it

We keep each order so its link keeps working for [at least 12 months], and as long as we need to for tax and accounting records. You can ask us to delete an order sooner. The cake link will then stop working.

Your choices

You can ask to see, correct or delete the personal information we hold about you. Email us at [[email protected]] and we’ll respond within [30 days]. If you’re unhappy with how we’ve handled your information, tell us first. You can also contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy, we’ll update the date at the top of this page.