Privacy & Cookies

Petalby is a small, independent brand based in the United Kingdom. For the purposes of data protection law, Petalby is the "data controller" of the personal information described below. Petalby is a trading name of Laura Warmoth, a sole trader, at 29 Hadrian Way, Caistor, Market Rasen LN7 6GJ; write to info@petalby.com about anything on this page.

Information you give us directly:

• Name, email address, delivery address, and phone number when you place an order or contact us
• Payment details, handled securely by our payment processor (Stripe) — we do not store your full card details ourselves
• Any information you include in messages sent through our contact form or newsletter sign-up

If you choose to create an account — you never have to, and you can always order as a guest:

• Your name and email address
• A scrambled version of your password. We store a one-way scramble, never the password itself, so nobody at Petalby can read it or tell you what it is. If you forget it we can only help you set a new one
• Addresses you save. Because most of what we sell is a present, your address book will often hold other people's names and addresses. Please only save details you have a good reason to keep — and if someone asks to be taken off your list, tell us and we will delete them straight away
• The things you save as favourites, and any basket you have not checked out yet
• A record of when and how you gave or withdrew permission for marketing emails. We keep this as the evidence that we did what you asked

If you ask to be told when something is back in stock, we keep your email address and which item, for that one message. No account is needed.

When you are not signed in, the things you heart and the items in your basket are kept in your own browser and never reach us at all.

Information collected automatically:

• Basic browsing data (pages visited, time on site, general location by region) via standard analytics
• Cookie data, as detailed below

UK GDPR requires us to have a lawful basis for each way we use your data. Here is each purpose alongside the basis it rests on:

• To process and deliver your order — performance of a contract with you
• To respond to enquiries and provide customer care — performance of a contract, or our legitimate interest in answering you if no order exists yet
• To send you our newsletter, if you've opted in — and only until you opt out — your consent
• To understand, in general terms, how our website is used, so we can improve it — your consent for the tools that use cookies (Google Analytics 4, Microsoft Clarity), or our legitimate interest in the cookieless Cloudflare counter, which does not identify you
• To run your account, if you have one: showing you your past orders, keeping your saved addresses and favourites, and letting you sign in — performance of a contract
• To tell you once when something you asked about is back in stock — your consent, given by asking
• To remind you, once, about a basket you started at checkout — under the soft opt-in rules for our own customers; every such email carries an unsubscribe link, and you can tell us not to at checkout
• To ask, once, how the opening went — a single review request about ten days after dispatch; our legitimate interest in learning whether a gift landed, and you can ignore it or tell us not to
• To remind you of a gifting date you saved in your account — only for dates you entered yourself, as part of the account service; performance of a contract with you
• To meet our legal obligations (for example, accounting and tax records) — legal obligation
• To run the monthly Curated Collection draw among Circle subscribers, as set out in our terms — our legitimate interest in running the promotion we advertise; unsubscribing withdraws you from it

We do not sell your data. We do not share it with third parties for their own marketing purposes.

Our website uses a small number of cookies and similar tools:

Essential cookies — required for the site and checkout to function (for example, remembering what is in your basket). These cannot be switched off.

Your sign-in cookie — if you sign in, we set one cookie (petalby_session) so the site knows it is still you as you move between pages. It holds a random reference and nothing about you; it lasts 30 days, or until you sign out, whichever comes first. It is essential to being signed in, so it is not something you can decline and stay signed in — signing out removes it. We also use your browser's own storage to hold favourites and a basket while you are signed out; that stays on your device.

Cloudflare Web Analytics — a privacy-friendly, cookieless traffic counter. It does not set cookies or track you individually; it only tells us in aggregate how many people visited and which pages were popular.

Microsoft Clarity — in use on this site. It shows us anonymised heatmaps and session recordings so we can see where people get stuck. It sets cookies and browser storage, so it loads only if you click Accept on the cookie banner. You can decline it and continue using the site as normal, including checkout.

Google Analytics 4 — in use on this site. It helps us understand how many people visit, which pages they view and how they found the site, so we can improve it. It sets cookies and loads only if you click Accept on the cookie banner. You can decline it and continue using the site as normal, including checkout.

Cloudflare Turnstile — the quiet check on our forms (contact, newsletter, business and composed-to-order enquiries, account registration) that stops automated spam using them to send email. It verifies the request, not you; it is part of the forms working rather than an analytics tool.

You can control or delete cookies at any time through your browser settings. Blocking essential cookies may affect your ability to use the checkout.

A small brand does not run its own card network or mail servers, so a short list of providers processes data on our instructions. Naming them plainly is part of the policy:

• Stripe — payments. Your card details go to Stripe directly and never touch us
• Resend — sends our email: order confirmations, replies to enquiries, and the newsletter if you have opted in
• Supabase — hosts our database: orders, accounts, favourites, back-in-stock alerts and the messages you send us
• Cloudflare — hosts and secures the website, runs the Turnstile form check, and provides the cookieless traffic counter described above
• Google — Google Analytics 4, only with your consent, as described above
• Microsoft — Clarity, only with your consent, as described above

Some of the providers above operate global infrastructure, so your data can be processed outside the UK — for example by Stripe, Google or Microsoft, on servers that may sit in the United States or elsewhere. Where that happens, we rely on a provider's UK adequacy status or on standard contractual clauses (the UK's International Data Transfer Agreement, or the equivalent EU clauses with the UK addendum) to keep your data protected to UK GDPR standard wherever it is processed. You can ask us for details of the specific safeguard that applies to any provider by emailing info@petalby.com.

We keep order and account information for as long as necessary to fulfil legal, accounting, and tax obligations — typically up to seven years for financial records. Newsletter contact details are kept until you unsubscribe. Enquiry correspondence is retained only as long as reasonably needed to resolve and follow up on your query.

An account is kept until you close it. When you close it, we remove your sign-in details and your saved addresses and favourites straight away. We cannot delete the orders you have placed, because those are financial records the law requires us to keep — but once the account is closed they are no longer attached to a person, and we will not use them to contact you.

A back-in-stock alert holds your email address and the item until the item returns and we have emailed you; after that it stays only as the record that we did, and we remove it when you ask. The alert form also stores a hashed form of your IP address so that one person cannot flood it; the address itself is not kept. Gift-recipient details (a name and address you give us for someone else) are kept with the order, for delivery and for the financial record, and used for nothing else.

If you ask us to stop emailing you, we keep a note of the address so that we do not email it again by mistake. That note exists only to honour your request.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data, where we're not legally required to keep it
• Object to or restrict certain uses of your data
• Withdraw consent for marketing communications at any time

If you have an account, you do not have to ask us for some of these — they are buttons. On your account details page you can download everything we hold about you, change your name, and close your account. You can turn marketing emails on or off on your email preferences page, and every marketing email we send carries a one-click unsubscribe link that works without signing in.

For anything else, or if you do not have an account, contact us at info@petalby.com. We'll respond within one month, as required by law.

If you are unhappy with how we have handled your data, we would like the chance to put it right first — email us and we will. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time: ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.

If this policy changes materially, we'll update this page and note the date below. We won't quietly change how we handle your data without telling you.

Last updated: 23 August 2026