Privacy Policy

Who I am and what this covers

I run Sploffin, a small-batch bakery, and this site (sploffin.com) is where you can browse the menu, make an enquiry, join the mailing list and, when ordering is open, place an order. This policy explains exactly what information the site collects and what I do with it. There is nothing clever or hidden going on: I collect what I need to answer you and get your order to you, and that is it.

If you have any questions about anything here, email me at sploffin@gmail.com.

Cake enquiries

When you send an enquiry from one of the cake pages, I ask for your name, email address, phone number (optional), event date, roughly how many servings you need, and your message. The enquiry is stored in the site's database and also emailed to me, so I can read it and reply. I use it only to answer your enquiry and, if you go ahead, to make your cake. Legally speaking, this is me taking the steps you asked for before entering a contract.

The contact form

The general contact form asks for your name, email address, and message, plus a few optional extras: phone number, company, location, how you heard about me, and what your message is about. As with enquiries, it is stored in the site's database and emailed to me so I can reply. I do not use it for anything else. The legal basis is my legitimate interest in answering the people who write to me.

The mailing list

If you join the mailing list, I keep your email address, when you joined, and a note of which page you signed up from (so I know which menu you were interested in, and so I can prove what you agreed to). You get one email confirming you have joined, one email when a pop-up menu goes live, and one what's-baking email a month with new bakes and the coming seasonal menu. If you joined a waiting list instead (the letterbox or Christmas lists), you get exactly what that form promised: one email when ordering opens, and nothing else unless you separately opt in. Every marketing email carries an unsubscribe link that works in one tap. The legal basis is your consent, which you can withdraw with that one tap.

To come off the list, use the link in any email, or just reply and say so, and I will remove you.

Orders

When you place an order I collect your name, phone number, email address, your collection slot or delivery address and postcode, any notes you add, and of course the items you ordered. I store this to prepare and fulfil your order, and I email you a confirmation. I also keep order records for basic business record-keeping (see the retention section below). The legal basis is the contract between us: I cannot bake and deliver your order without these details.

The morning after a paid shop order I send one email suggesting bakes that go with it, with an unsubscribe link. You can decline it with a tick at the checkout, and one tap on the link stops anything further. This relies on the rules that let a business you have just bought from suggest similar things, and it is the only marketing an order by itself ever triggers.

Payments

When online payment is enabled, payments are processed by Stripe on Stripe's own checkout pages. Your card details go straight to Stripe and never touch this site's servers. I never see or store your card number. So that your order can be matched to your payment, Stripe also receives your name, contact details, delivery or collection details and any order notes as part of the checkout. Stripe's own privacy policy applies to what happens on their pages.

Cookies

Your yes-or-no analytics choice is kept in your own browser's storage, on your device, and never leaves it. If, and only if, you accept analytics, Google Analytics cookies are set so I can see how the site is used; if you decline, they are never set. There is also an admin login cookie, but that only ever ends up on my own browser when I log in to run the site, not yours.

What gets stored, and why, is listed plainly on the cookies page at /cookie-policy.

Who helps me run the site

I am a one-person bakery, so a few services handle the plumbing on my behalf: Vercel hosts the website, Supabase stores the database (enquiries, orders, the mailing list), Resend sends the emails, Stripe processes payments when online payment is enabled, and Google Analytics measures site usage only if you consent to it. When an order is posted, the delivery name and address go to the carrier who delivers it: Royal Mail for letterbox parcels, DPD for courier boxes.

These services handle data on my instructions to run the site and deliver your orders, and for no other purpose. I do not sell your data to anyone, and I do not share it beyond these services.

How long I keep things

Order and enquiry records are kept for up to six years, because that is how long UK business and tax record-keeping requires, and then deleted. Mailing list addresses are kept until you unsubscribe; after that I keep only the minimal note that you unsubscribed, so a later import can never accidentally add you back. Records of what was sent to whom are kept as my proof that consent and unsubscribes were honoured.

Your rights

Under UK GDPR you have the right to ask for a copy of the information I hold about you, to have it corrected if it is wrong, and to have it deleted. Just email sploffin@gmail.com and I will sort it out, including the copies that sit in my own inbox. If you ask to be deleted, I keep only what the law requires me to keep (order records within the six-year window) and the do-not-email note.

If you are unhappy with how I have handled your data and I have not put it right, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

If the way the site handles data changes, I will update this page to match. This policy describes what the site actually does today, and I intend to keep it that way.