Privacy notice.

Breadssing is a small home bakery in Guildford, Surrey. We run the website, take the orders, and bake the bread. We are the data controller for any personal information you give us through this site.

Reach us at breadssing@gmail.com for anything related to your data.

When you place an order:

• Your name
• Your phone number
• Your email (only if you give it — it's optional)
• What you've ordered, the total, your chosen pickup Saturday
• Anything you write in the notes field

When you visit any page:

• Your IP address and browser user-agent (used to spot spam and abusive submissions, never for tracking)
• A cookie if our anti-spam check (Cloudflare Turnstile) runs on the order form

We need your name, phone, and order details to bake the right thing for the right person and let you know when to come collect. The legal basis is performance of a contract — we can't deliver the order without them.

Email is optional. If you give it, we use it to send you a Stripe receipt (when you pay online) and confirmation of your order. We do not add you to a marketing list.

IP and user-agent are used only to deter spam — not for analytics, not for advertising.

We don't sell or share your data with anyone for marketing. We do use four service providers to actually run the site, each acting as a processor on our behalf:

• Stripe — to take card payments. They receive your name, email, and amount when you choose to pay online. Their privacy policy is at stripe.com/privacy.
• Vercel — hosts the website.
• Neon — hosts the database where your order is stored.
• Cloudflare — runs the anti-spam check on the order form (Turnstile).

We keep order records for six years after the order. UK tax law (HMRC) requires us to retain financial records that long. After six years, the personal fields on an order are removed; the order itself becomes an anonymous accounting line.

If you've never placed an order, we don't hold anything about you.

The site only uses cookies that are strictly necessary for it to work:

• A session cookie for the admin login (only if you log in to the admin area)
• A short-lived Cloudflare Turnstile cookie to confirm you're a person, not a bot
• A small marker that remembers you've seen this cookie notice (so we don't show it again)

We do not use analytics or advertising cookies. If that changes, this page will be updated and we'll ask before setting them.

You can ask us to:

• See the personal data we hold about you
• Correct anything that's wrong
• Delete it (we'll do so unless we still need it for a tax record we're legally required to keep)
• Stop using it for a particular purpose
• Send you a copy of it

To do any of these, email breadssing@gmail.com. We aim to respond within a month.

If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.