Privacy Policy

Introduction

At Cascade Botanicals, we respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, process, and share your information when you use our website or purchase our products.

Information We Collect

We collect personal information that you provide directly to us when you place an order or contact our customer service. This may include your name, email address, postal address, and payment information.

We also automatically collect certain information when you visit our website, including your IP address, browser type, referring/exit pages, and operating system.

How We Use Your Information

We use your information to process and fulfill your orders, send you order confirmations and shipping updates, provide customer support, and request product reviews after purchase.

We may also use your information to improve our website and protect against fraudulent transactions.

Third-Party Service Providers

We share your information with the following third-party service providers who assist in operating our business:

- Stripe: Processes payment transactions. Stripe receives your payment card details, billing address, and email address. Stripe's privacy policy is available at stripe.com/privacy.

- EasyPost: Handles shipping label generation and package tracking. EasyPost receives your shipping address and order details.

- Mailgun: Sends transactional emails on our behalf (order confirmations, shipping notifications, review requests). Mailgun receives your email address.

- DigitalOcean: Hosts our website and database infrastructure. All data stored on our servers resides on DigitalOcean infrastructure within the United States.

We may also disclose your information if required by law or to protect our rights or the rights of others.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Order records are retained indefinitely for accounting and customer service purposes.

Session data is automatically deleted after 2 hours of inactivity. Webhook event logs are automatically purged after 30 days.

Your Rights

You have the right to access, correct, update, or request deletion of your personal information. You can also object to processing of your personal information or ask us to restrict processing in certain circumstances.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell your personal information to third parties.