Privacy

Your email, your name, the address a box went to, and what was in it. If you make an account we also keep the windows you describe and the plants you put in them, because that is what the reminders are calculated from.

Card numbers never reach us. The payment processor keeps those and hands back a brand and four digits, which is all that is stored here.

To deliver the order and honour the guarantee — that is a contract, not consent. Marketing email is separate and off unless you switch it on; you can switch it back off in settings and it applies to the next send.

The courier gets the name, address, phone and any buzzer note, on the day, and nothing else. The payment processor gets what it needs to take the payment. Supabase hosts the database inside the EU. Nobody buys this data from us because we do not sell it.

Orders stay seven years — Lithuanian tax law, not our preference. Account data goes when you ask us to delete it. A guest bag that is never checked out expires on its own.

Ask for a copy, a correction, or a deletion and we do it within a month. Email privacy@venoplants.test. If we handle it badly you can complain to the Autoriteit Persoonsgegevens.

Two, both necessary: one holds your bag so it survives a refresh, one holds your session when you are signed in. No analytics, no ad networks, so there is no banner to dismiss.