Privacy Policy
1. What we collect
When you buy a plant, join the waitlist, or contact chromebloom, we collect:
| What | When | Why |
|---|---|---|
| Name | At checkout | So the delivery label is addressed correctly and the courier can hand it to a person |
| Email address | At checkout or waitlist signup | To send the receipt, the shipment tracking, and any care notes |
| Shipping address | At checkout | To ship the plant to you |
| Recipient phone | If you provide it at checkout | Carrier may need to reach you for delivery |
| Payment confirmation | At checkout | To fulfill the order. Card numbers go to Stripe, not to us |
| Waitlist email | When you submit the form | To notify you when a sold-out color story restocks |
| Customer-support emails | When you email us | To help you with your order |
2. What we never see
chromebloom is a small shipping business. We do not collect:
- Your full credit-card number (Stripe holds it; we only see the last four digits).
- Your browsing history outside chromebloom.com.
- Any location data beyond the delivery address you give us.
- Any biometric, health, or sensitive-category data.
We have no advertising pixel on this site. There is no Facebook, Google, TikTok, or other advertising tracker watching what you do here.
3. How we use what we collect
We use the data listed in section 1 to:
- Ship your order and notify you when it ships.
- Send transactional emails: receipts, tracking, care instructions, and delivery issues.
- Notify waitlist subscribers when a sold-out color story restocks.
- Comply with US tax and business law (we keep payment records for 7 years, as required by the IRS).
We do not use your data for advertising. We do not use your data to train any AI model. We do not sell or "rent" your data to anyone, ever.
4. Who we share it with
We share your data only with vendors we use to operate the business, and only the minimum they need to do their job:
| Vendor | What they get | Why |
|---|---|---|
| Stripe | Payment info at checkout, basic profile | To process your payment. See Stripe's privacy policy. |
| Cloudflare | Site traffic logs | To run the website (DNS, CDN, security). Logs auto-delete after 30 days. |
| Shipping carriers (USPS, UPS, FedEx, regional) | Name, shipping address, recipient phone | To deliver the package. Their own privacy policies apply. |
| Email service (Google Workspace) | Your email correspondence | To reply to you. |
We will also share data if a US court orders us to, but we will challenge overly broad requests and notify you if legally permitted.
5. Cookies and analytics
The chromebloom site uses only strictly necessary cookies and local storage (e.g., remembering your cart across page loads on the shop page). We do not use Google Analytics, Meta Pixel, or any third-party advertising trackers.
If we add analytics in the future, we will update this policy and ask for consent where required by your state's law.
6. Your rights under US state privacy laws
If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, or another state with a comprehensive privacy law, you have the right to:
- Know what personal data we have about you.
- Delete it, subject to the exceptions in section 7.
- Correct inaccurate data.
- Port your data in a machine-readable format.
- Opt out of sale or sharing — we don't sell or share, so this is automatic.
- Non-discrimination for exercising your rights.
To exercise these rights, email team@chromebloom.com from the address you have on file with us (so we can verify it's you). We will respond within 45 days.
California "Shine the Light" (Civil Code § 1798.83): we do not share your data with third parties for their direct marketing purposes.
7. How long we keep it
| Category | How long | Why |
|---|---|---|
| Payment records (receipts, Stripe transaction IDs) | 7 years | US tax law (IRS) |
| Shipping records (carrier tracking, delivery confirmation) | 2 years | Resolve lost-package or damage claims |
| Customer-support emails | 3 years after last contact | Reasonable lookback for follow-ups |
| Waitlist signup (no purchase) | Until you unsubscribe or 24 months, whichever is first | Notify restocks; one-click unsubscribe in every email |
When the retention period ends, we delete the data within 30 days. If you ask us to delete sooner, we will — except for records we are legally required to keep (tax records), which we isolate from anything that can be used to contact you.
8. How we protect it
We use industry-standard safeguards: TLS for all data in transit, encrypted storage at rest, and access limited to the project owner (Pete). Stripe is PCI-DSS Level 1 certified, which means the card data they hold meets the highest security standard in the industry.
No system is 100% secure. If we ever discover a breach affecting your data, we will notify you within 72 hours by email and post a notice on this page.
9. Children's privacy
chromebloom is intended for adults. We do not knowingly collect data from anyone under 16. If we learn we have, we will delete it within 30 days.
10. Changes to this policy
If we change this policy in a material way, we will update the "Effective" date at the top, post a banner on the home page, and email anyone with a recent order or active waitlist subscription. Non-material changes (typos, clarifications) will be made silently.
11. Contact
chromebloom is a project of Peter Bjork. You can reach the data controller at:
- Email: team@chromebloom.com
- Subject line starting with "Privacy" so it gets routed quickly.
For complaints, you also have the right to contact your state attorney general or the US Federal Trade Commission.
This is a plain-language privacy policy. It is not legal advice. If you have specific legal questions, consult a lawyer licensed in your state.