Privacy Policy
Effective September 17, 2026
Sydney's Sweets ("we," "us," or "our") operates the website at sydneyssweets.com. This policy explains what information we collect, how we use it, who we share it with, your rights, and the security measures we maintain to protect your data.
1. Information We Collect
| Category | Examples | When Collected |
|---|---|---|
| Contact information | Name, email address, phone number, delivery address | When you place an order, submit an inquiry, purchase a gift card, or sign up for our loyalty program |
| Order information | Products ordered, quantities, sizes, flavors, fillings, add-ons, customizations, event details, pickup/delivery preferences | During checkout or cake builder inquiry |
| Cake personalization details | Free-text notes such as a name on the cake, an event date, an age, or other custom requests you choose to include | When you fill in optional Cake Personalization Notes or product custom fields during ordering |
| Reference photo uploads | Inspiration images you upload through the cake builder or online store (stored on Cloudflare R2) | When you choose to attach reference photos to a custom order or inquiry |
| Payment information | Credit/debit card details | During checkout (processed by Stripe; we never see or store your full card number) |
| Gift card data | Recipient name and email, sender name and email, gift card balance, redemption history | When you purchase, send, or redeem a gift card |
| Loyalty program data | Points earned, points redeemed, current balance linked to your customer profile | When you make a purchase or redeem points |
| Promo code activity | Codes used, order totals at redemption, usage limits | When you apply a promo code at checkout |
| Order tracking tokens | A random, per-order token included in your order confirmation link | Generated automatically when an order is placed; required to view your order status |
| Communication preferences | Email opt-in/opt-out status | When you subscribe to or unsubscribe from marketing emails |
2. How We Use Your Information
- Process and fulfill your orders, quotes, and gift card purchases
- Send order confirmations, status updates, and delivery notifications
- Send SMS alerts to the business owner for order management (your phone number is not used for marketing SMS)
- Send marketing emails if you have opted in (you can unsubscribe at any time)
- Manage our loyalty program, gift card balances, and promo code redemptions
- Allow you to look up your order using your order ID and tracking token
- Detect and prevent fraudulent transactions (handled primarily by Stripe)
- Respond to your inquiries and provide customer support
- Improve our products and services
3. Third-Party Services
We use the following services to operate our website. Each has its own privacy policy:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Stripe | Payment processing and fraud prevention | stripe.com/privacy |
| Supabase | Database and authentication | supabase.com/privacy |
| Resend | Transactional and marketing emails | resend.com/legal/privacy-policy |
| Twilio | SMS notifications to business owner | twilio.com/legal/privacy |
| Cloudflare (Pages, R2, Network) | Website hosting, image storage for reference photos, and security | cloudflare.com/privacypolicy |
4. Data Retention
We retain order, customer, gift card, and loyalty data for as long as necessary to fulfill our obligations to you, provide ongoing customer support, manage outstanding gift card balances, and comply with legal, tax, and accounting requirements. You may request deletion of your personal data at any time by contacting us — see Section 12.
5. Your Rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention requirements, such as transaction records)
- Opt out of marketing emails at any time using the unsubscribe link in any email
- Request a copy of your data in a portable format
California Residents (CCPA / CPRA)
California residents have specific rights under the California Consumer Privacy Act, as amended:
- Right to Know — request the categories and specific pieces of personal information we have collected about you
- Right to Delete — request deletion of personal information we have collected from you
- Right to Correct — request correction of inaccurate personal information
- Right to Opt Out of Sale or Sharing — we do not sell or share personal information for cross-context behavioral advertising (see Section 6)
- Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights
To exercise any of these rights, contact us using the details in Section 12. We will verify your identity before fulfilling the request.
New York Residents (SHIELD Act)
The New York Stop Hacks and Improve Electronic Data Security Act ("SHIELD Act") applies to our handling of New York residents' private information. The safeguards we maintain in compliance with the Act are described in Section 9, and our breach-notification commitment is described in Section 10.
6. Sale of Personal Information
We do not sell or rent your personal information to third parties. We do not share personal information with third parties for cross-context behavioral advertising purposes. The third-party services listed in Section 3 process data only on our behalf to operate our website and fulfill your orders.
7. Cookies and Tracking
This website does not use tracking cookies. Cloudflare, which hosts the site, counts page visits with its Web Analytics service. When you use our online store, we also keep a record of the steps of your visit (for example, adding an item to your cart, or a message the page showed you) so we can find and fix problems. That record contains no name, email address, phone number or payment details, it is tied only to a random code your browser keeps for that tab, and we never sell or share it. Session data (such as your shopping cart contents, cake builder progress, and loyalty session) is stored in your browser's memory and is cleared when you close the tab.
8. Children's Privacy
Our website is not directed at children under 13, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). If you believe we have inadvertently collected information from a child under 13, please contact us immediately and we will delete it.
9. Security and Safeguards (NY SHIELD Compliance)
We maintain reasonable administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of personal information, in accordance with the New York SHIELD Act (General Business Law § 899-bb) and applicable industry standards.
Administrative safeguards
- Access to personal information is limited to authorized personnel with a legitimate business need
- We periodically review the data we collect and delete information no longer required for business or legal purposes
- Third-party service providers (listed in Section 3) are selected for their published security practices and contractual data-handling commitments
Technical safeguards
- All traffic between your browser and our website is encrypted using HTTPS / TLS
- Database access is gated by row-level security policies; data is accessible only through authenticated, audited endpoints
- Payment card data is captured directly by Stripe — we never receive, transmit, or store full card numbers, CVVs, or expiration dates
- Cloudflare's web application firewall protects against common web-based attacks
- Sensitive operations between our internal services use signed, time-bounded requests to prevent tampering
Physical safeguards
- All customer data is stored on infrastructure operated by Supabase, Cloudflare, and Stripe — providers that maintain SOC 2 (or equivalent) physical-security controls at their facilities
- We do not maintain on-premise servers containing customer personal information
10. Data Breach Notification
If we discover a security breach affecting your private information, we will notify you and the appropriate authorities (including the New York Attorney General, the New York Department of State, and the New York Division of State Police, where required) in accordance with the New York SHIELD Act (General Business Law § 899-aa) and other applicable breach-notification laws. Notice will be provided as quickly as reasonably possible and will describe the categories of information affected, the steps we have taken, and the steps you can take to protect yourself.
11. Changes to This Policy
We may update this policy from time to time. The effective date at the top of this page will reflect the most recent revision. Material changes will be communicated through a prominent notice on the website or by email where appropriate. Continued use of the website after changes constitutes acceptance.
12. Contact Us
For privacy-related inquiries, data access requests, deletion requests, or to exercise any of the rights described above:
Sydney's Sweets
465 Hempstead Ave, West Hempstead, NY 11552
Phone: (516) 456-3283
Email: [email protected]