Privacy policy and cookie notice

1. Who we are

Sugar Spindle Confectionery (“we”, “us”) is a small confectionery studio that makes and sells artisanal lollipops and hard candy. Our studio and mailing address is:

We are the controller responsible for the personal data described on this page.

2. What we collect

We collect only what we need to answer you, take and send an order, and keep the site working.

We do not intentionally collect sensitive categories of data such as health information, biometric data, precise geolocation, or government identifiers. Please do not send us a child's information or an allergy history beyond what you choose to share in an order note.

3. How we use it

• To answer an order request. Name, email, box choice and notes are used to prepare a confirmation and a payment link.
• To fulfill and ship an order. Contact details are shared with the carrier for delivery and problems with delivery.
• To answer questions. Including allergen and ingredient questions, so we keep the reply in our inbox.
• To send the newsletter. Only if you asked for it; every message has a one-click unsubscribe link.
• To understand the site. Aggregated analytics help us see which articles and flavors are useful.
• To keep the site secure. Detecting abuse, spam and fraudulent order requests.
• To meet legal duties. Tax, accounting and consumer-protection records.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use your details to build advertising profiles. We do not send order reminders, upsells or marketing messages you did not ask for.

4. Cookies and similar technology

A cookie is a small file a site stores in your browser. We also use local storage, which works the same way for this purpose. Cookies here fall into two groups.

Essential cookies

These are required for the site to remember your cookie choice and basic preferences. They are set only in your browser, not on a server, and they expire after 180 days or when you clear your browser data.

Analytics cookies

If you choose “Accept all”, we may set analytics cookies that count visits and show which pages are read. They are aggregated, they are not used to identify you personally, and they are never combined with order data. Examples include a first-party analytics identifier and a session flag. If you choose “Essential only”, these are not set at all and no vendor script is loaded.

Your choice

You can change or withdraw your choice at any time. Withdrawing consent stops future analytics collection but does not affect processing that already happened.

Most browsers also let you block or delete cookies in their settings. Blocking essential storage may mean the cookie banner appears again on every visit.

5. Who we share with

We share the minimum needed, and only with the following kinds of providers:

• Email and hosting providers that deliver our mail and serve this website.
• Payment processor that handles the card transaction after you confirm an order.
• Shipping carriers that receive a name, address and phone number where required for delivery.
• Analytics provider, only if you accept analytics cookies.
• Professional advisers and authorities, where the law requires it or where we must establish or defend a legal claim.

We do not sell data, and we do not allow providers to use your data for their own marketing.

6. How long we keep it

When a retention period ends we delete the record or, where deletion is not immediately possible, de-identify it.

7. Security

Order requests from this site open in your own email application, so nothing is stored in a database by the page itself. Mail we receive sits in an account protected by a unique password and two-factor authentication, and order records are kept in an access-controlled folder. Absent encryption is not used for card payments: the payment processor handles the transaction on its own secure page.

No method of transmission or storage is completely secure. If we ever become aware of a breach affecting your personal data, we will notify affected people and any required authority without undue delay.

8. Your rights

Depending on where you live, you may have some or all of the following rights. We honor these requests regardless of where you are, as a matter of policy.

• Access — ask for a copy of the personal data we hold about you.
• Correction — ask us to fix inaccurate or incomplete details.
• Deletion — ask us to delete your data, subject to records we must keep by law.
• Restriction and objection — ask us to pause or stop certain processing.
• Portability — receive your data in a common, machine-readable format.
• Withdraw consent — change your cookie or newsletter choice at any time.
• Non-discrimination — we will not degrade service or price because you exercised a privacy right.

Write to sugarspindle.orders@gmail.com with “Privacy request” in the subject line. We reply within 30 days and may ask one clarifying question to confirm we are speaking with the right person. If you are in the EEA or UK you may also complain to your local supervisory authority; in the United States you may contact your state attorney general.

9. Children

This site is intended for adults arranging candy purchases. It is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has sent us personal information, email us and we will delete it. Hard candy on a stick is a choking hazard and is not suitable for children under three.

10. Shipping and returns

Orders are prepared in Portland, Oregon and ship to addresses in the United States. Shipping is a flat $6.50 and free on orders over $60. Orders confirmed before 12:00 noon Pacific time on a business day are usually dispatched within two business days. Prices are displayed in US dollars and applicable tax is shown before payment.

Because candy is a food product, we cannot accept returns or exchanges. If a box arrives damaged, incomplete or below our standard, send a photo to sugarspindle.orders@gmail.com within 14 days of delivery and we will replace the item or refund it in full. Refunds are returned to the original payment method; the processor's own timeline applies.

We may decline or cancel an order if an item is out of season, if payment cannot be verified, or if the request appears fraudulent. In that case any amount already paid is refunded.

11. International visitors

This site is operated from the United States. If you visit from elsewhere, your data will be transferred to and processed in the United States, where privacy laws may differ from those where you live. Where required, we rely on standard contractual clauses or your explicit consent for that transfer.

12. Changes to this policy

When we change how we handle data, we update this page and change the date at the top. Substantial changes will be announced on the homepage for at least 30 days. Previous versions are available on request.

13. Contact and data requests

For any question about this policy, or to make a privacy request, use the details below. We answer within one business day for general questions and within 30 days for formal rights requests.