Privacy Policy

Effective September 22, 2026.

This policy describes what LocalFlowerShop collects, why, how long it is kept, and what you can ask us to do with it. It is written to be read rather than skimmed, because the honest summary is short: we collect very little, we sell none of it, and most visitors give us nothing at all.

Who we are

LocalFlowerShop is a directory of real local flower shops in the United States. It is operated by the same small team that runs its sister site, RateAFlorist, and the two sites share one database of shop listings and one set of florist accounts. Where this policy says "we", it means that team. Questions about this policy go through the contact page.

What we collect from shoppers

Browsing the directory requires no account and no personal information. When you load a page, our server records the standard details every web server records: the IP address the request came from, the page requested, the time, and the browser's description of itself. These logs are used to keep the site running, to detect abuse, and to understand which pages are used, and they are rotated automatically.

If you use the "use my location" link on the home page, your browser asks your permission and then sends coordinates to a single address on our server, which replies with the nearest town page. The coordinates are not stored, not logged beyond the ordinary request line, and not passed to anyone; the redirect is the whole feature. If you decline the permission, nothing is sent.

If you use the contact form, we receive the name, email address and message you type, and the IP address the form was sent from, which is kept only to limit abuse of the form. If you subscribe to the monthly email, we keep the email address you give, the date, and the IP address at the time of subscribing, again to limit abuse; every email carries an unsubscribe link that works with one click.

If you use the site's chat assistant, your messages in that conversation are sent to an AI model provider to generate the reply. We keep a count of chat requests per IP address for an hour to limit abuse, and we do not keep the conversation.

What we collect from florists

A florist who claims a listing creates an account with a name, a business email address and a password, which is stored only as a one-way hash. A quick claim without an account gives us a name, a business email, an optional phone number and an optional message. These are used to verify that the person represents the shop and to run the account. Florist accounts are shared between LocalFlowerShop and RateAFlorist because the listings are shared; one login works on both.

Premium listings and delivery-town placements are paid through Stripe. Card details are entered on Stripe's own pages and never touch our servers; we receive a customer identifier, the subscription status and the amount, which is what we need to switch features on and off and to answer billing questions. Stripe's handling of card data is governed by Stripe's privacy policy.

Portal activity that is recorded: the listing edits you make (so the public page reflects them), the photos you upload (so they can be shown), and the delivery towns you choose. We also record page views, calls and website clicks on each listing as daily counts; these are aggregate numbers with no visitor identity attached.

Business listing data

The facts on a listing (shop name, address, phone, hours, categories, delivery towns) are business information, compiled from public business records and from the shops themselves. They are not personal data about a visitor, and they are published deliberately: a directory is a publication of business facts. A shop owner can correct or remove their listing at any time by claiming it or by writing to us.

We store one identifier from Google for shops that have one, the place identifier, which lets a Premium listing show the shop's own photo from Google when the page is viewed. We do not copy photos, hours, ratings or any other Google content into our database; photos are fetched by your browser at the time you view the page and credited to the photographer as Google requires.

What we never do

We do not sell personal information, and we do not share it with anyone for their marketing. We run no third-party advertising and no advertising trackers. We do not build profiles of visitors, do not follow you across other websites, and do not buy data about you from anyone. If a site setting is ever turned on to use a web analytics service, this policy will name it here and the analytics will be configured without advertising features.

Cookies

Shoppers get no cookies from us. Florists and administrators who log in get a session cookie, which is necessary to stay logged in and expires when the session ends; it is not used for anything else. The site uses browser storage for small conveniences such as remembering a collapsed panel, and never for tracking.

Where data goes

The site is hosted on servers in the United States. Email is sent through a transactional email provider (Resend). Payments run through Stripe. The chat assistant and some content generation use Anthropic's and OpenAI's models. Each of these providers processes only the data needed for its job, under its own privacy terms, and none of them receives your data for advertising.

How long we keep things

Server logs rotate on a short cycle. Contact messages are kept until resolved, then archived. Newsletter subscriptions are kept until you unsubscribe, after which the address is marked unsubscribed and no longer emailed. Florist accounts are kept while the account exists; ask and we will delete it, along with the claim records and photos attached to it, though the shop's business listing itself stays in the directory as public business information unless the owner asks for its removal.

Your choices and rights

You can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, and object to any use of it, by writing to us from the contact page. We answer these requests for everyone regardless of where they live; California and other state-law requests are honored on the same basis, and we will not treat you differently for making one. To stop the monthly email, use the link in any issue. To remove a shop listing you own, claim it or write to us.

What we do not collect

To be explicit, because absence is hard to prove: no account is needed to browse, so no shopper profile exists. We do not collect payment card numbers, government identifiers, precise location beyond the single optional redirect described above, contact lists, or anything from your device's sensors. We do not use fingerprinting techniques. We do not embed social media buttons that report your visit to those networks. The maps on town and listing pages are drawn from OpenStreetMap tiles and a small mapping library we host ourselves; no map provider script runs on the page.

Security

Connections to the site are encrypted. Passwords are hashed with a modern algorithm and cannot be recovered by us. Administrative access requires a login and, for administrators, a second factor. Database backups are encrypted and kept off the web server. Access to production systems is limited to the people who run the sites. If we ever discover a breach that affects personal information, we will notify the people affected and any regulator the law requires, as quickly as we can establish what happened.

Email specifics

Transactional email (claim confirmations, password resets, order receipts) is sent because you asked for the thing it confirms; you cannot opt out of a receipt for a purchase, but you will receive nothing else unless you subscribe. The monthly newsletter is sent only to addresses that subscribed on this site, once a month, from an address you can reply to, with an unsubscribe link in every issue that takes effect immediately. We do not track whether you opened an email.

How to make a request

Write to us from the contact page and say what you want: a copy of your data, a correction, deletion, or an objection. Say which email address the request concerns, because that is how we find the records. We may ask you to confirm from that address so that we do not hand one person's data to another. Requests are answered within thirty days, and usually within a few.

Automated decisions

No decision about you is made automatically. Claims are approved by a person. Listings flagged by the monthly status sweep are reviewed by a person before anything is retired. The chat assistant answers questions and points to pages; it cannot change a listing, an account or a subscription.

Children

The site is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has given us personal information, tell us and it will be deleted.

Florist photos and Google photos, in plain terms

A photo a florist uploads from the portal is stored on our server and shown on the listing; it is the shop's own property and is deleted when the shop removes it or closes the account. A photo drawn from Google for a Premium listing is never stored by us at all: the page asks Google for the current image each time it is viewed and shows it with the photographer's name and a link, as Google's terms require. If that photo is wrong or objectionable, the place to change it is the shop's Google Business Profile, and we will happily tell an owner how.

Contacting us about privacy

Use the contact page and choose the general topic. If you would rather write by post, ask for the address by email and we will send it. We do not appoint a separate data protection officer because the team is small enough that the people who run the site are the people who answer.

Changes

If this policy changes in a way that matters, the effective date at the top will change and the change will be described here. The current version is always at this address.