Privacy Policy

Last updated: July 2026.

What we collect

• Sender information: your name, email, phone, and order details — used for receipts, delivery confirmations, and support.
• Recipient information: name, address, phone, and your gift message — used only to prepare and deliver the gift.
• Corporate program data: employee names, birthdays, and delivery locations provided by your company — used only to schedule deliveries, limited to what’s operationally necessary, and deleted when the program ends or on request.
• Analytics: we run our own lightweight, first-party analytics. We use an anonymous session cookie to understand which pages, products, and checkout steps are used, which ZIP codes are requested, and where visitors come from (referrer and campaign tags). We do not use third-party advertising trackers, and we do not put personal or recipient information in analytics URLs.

Payment

Payments are handled by Paddle on their hosted checkout. Card details go directly to Paddle and never touch our servers. Paddle’s privacy policy applies to the payment step.

Who we share data with

Only the parties needed to fulfill an order: the bakery preparing your box (first name and dietary notes), the courier delivering it (name, address, phone), our email/SMS provider for order updates, and Paddle for payments. We never sell personal data.

Cookies

Two first-party cookies: an anonymous session identifier and a first-visit attribution record (referrer and campaign tags). No third-party cookies.

Marketing

We send marketing email or SMS only if you opt in with the separate, unchecked boxes at checkout. Unsubscribe anytime.

Retention and deletion

Order records are kept for accounting; analytics are kept in aggregate. Email hello@birthdaydonuts.com to request a copy or deletion of your data and we’ll respond within 30 days.