cake conciergeEffective [date]. [Entity name] ("Cake Concierge", "we") runs cakeconcierge.com and delivers birthday cakes to offices and homes in San Diego County. This policy says what we collect, why, who sees it, and what you can ask us to do. Questions: [email protected], [phone], [mailing address].
Who this covers
- Company admins who set up an office account.
- Employees whose birthdays an admin adds, or who add their own through a team link.
- Customers who order a single custom cake.
- Bakers at our partner bakeries.
The service is for adults at work and for adult customers. It is not directed to children under 13, and we do not knowingly collect their information.
What we collect
From company admins: company name, office address, front desk hours, delivery notes, your name, work email, mobile number, company logo, cake preferences, and billing contact. Card and bank details go straight to Stripe; we never see or store the full number.
About employees, from the admin or the employee: first and last name, birth month and day (birth year only if someone provides it; we do not ask), work email, floor or desk, allergies, dietary needs (gluten-free or vegan), cake and frosting preferences, work anniversary date if the company turns that on, whether the person works remotely, and whether they would rather not have a cake.
From custom cake customers: name, email, phone, delivery address, the message and design for the cake, any photo or logo you upload, and payment through Stripe.
When we deliver: a photo of the cake at the drop-off point and the name of the person who received it. We photograph the cake, not people.
Automatically: basic logs from our hosting providers (IP address, browser, pages, time) used for security and to keep the site running. We do not use advertising cookies or sell ads. Our site does not respond to browser "Do Not Track" signals because we do not track you across other sites.
Why we use it
- To schedule, order, label and deliver each cake on the right day.
- To pass the bakery what it needs to make the cake: first name or preferred name, message, flavor,
- To send the admin the order list, skip links, delivery photo and monthly invoice.
- To bill the company or the customer.
- To answer questions, fix problems, keep records the law requires, and protect the service.
dietary needs and allergies.
We do not sell personal information, share it for advertising, or use it to build profiles.
Information we handle for employers
When a company adds its employees, the company decides what to send us and we act for the company. We use employee information only to provide cakes to that company. We do not contact employees for marketing. If you are an employee and want your information changed or removed, ask your office admin or email us and we will tell the admin.
The team link. If your admin sends you a link, anything you enter is seen by your admin, by us, and in part by the bakery making your cake (your first name, dietary needs and allergies). If your company connects Slack or Teams, a post with your first name and a cake photo goes to that channel on delivery. You can choose "No cake for me" and we will not order one. You can open the same link again to change your answer.
Allergies. We pass allergy notes to the bakery and print them on the box sticker so the office sees them. Our cakes are made in kitchens that may also handle wheat, milk, eggs, soy, tree nuts, peanuts and sesame, and we cannot promise any cake is free of an allergen.
Who receives it
Only these, and only what each needs:
- Bakeries we buy from: the details needed to make and label the cake.
- Service providers: Supabase (database and sign-in, United States), Stripe (payments), Twilio
- Your company's Slack or Teams, if the admin connects it.
- Authorities, if the law requires it, or to protect someone's safety.
- A buyer of the business, if it is ever sold, under this same policy.
(text messages), Resend (email), Cloudflare (website hosting), and later a delivery company if we use one for a home delivery. Each processes data for us under its own terms.
Text messages
We text only people who gave us their own mobile number and agreed to receive texts: company admins, custom cake customers who opt in, and bakers. Messages are about orders: the cakes coming up with skip links, delivery photos, and problems with a delivery. Message frequency varies, usually a few a month. Message and data rates may apply. Reply STOP to stop and HELP for help. We never share or sell mobile numbers or text opt-in information with third parties or affiliates for marketing or promotional purposes. We share your number only with Twilio to deliver our own messages.
Order and account emails go to the addresses you give us. If we ever send a promotional email, it will have an unsubscribe link and our mailing address, and we will honor an unsubscribe within 10 business days. We never email employees on a company roster for marketing.
How long we keep it
- Employee details: while the company account is active, then deleted within 30 days after the account
- Delivery photos: 90 days.
- Custom cake orders: 12 months after delivery, then deleted except billing records.
- Billing and tax records: as long as tax law requires.
ends, or sooner if the admin removes the person.
Security
Data is stored in the United States. Access is limited by account: an admin sees only their company, a baker sees only the orders assigned to their bakery, and only the owner sees billing. Connections are encrypted. No system is perfectly secure; if a breach affects your information, we will notify you and your company as California law requires.
Your choices and rights
You can ask us to show you, correct, or delete the information we hold about you, and admins can do most of this themselves in the app. Employees can ask through their admin or email us; we will act for the company. We will reply within 30 days. We will not treat you differently for asking.
California's Consumer Privacy Act applies to businesses above certain size thresholds, and today we are below them. We follow the practices in this policy anyway, and we sign the service provider terms that our business customers need under that law.
Changes
If we change this policy in a way that matters, we will update the date above and email company admins at least 14 days before the change takes effect.
Contact
[Entity name], [mailing address], San Diego, CA. [email protected]. [Phone].