Menu
Last updated: July 15, 2026
Nuflorist, LLC ("NuFlorist," "we," "us") is responsible for the personal information described in this notice. Where the EU or UK General Data Protection Regulation (GDPR) applies, we are the "controller" of that information, except where this notice says we process data on a merchant's behalf.
This notice covers two things:
If you buy flowers from a shop that uses our app, that shop — not NuFlorist — decides how your order information is used. We process it on the shop's behalf to make the app work, as described below. Questions about a florist's own privacy practices should go to that florist.
Our website has no user accounts, no login, no forms, and no online store. We collect very little:
If you are a florist using our Shopify app — not just visiting our website — this section is about you.
To do its job, the app is granted read access to the merchant's Shopify data, including customer records and orders, plus products, shipping settings, and store locations. Those customer records and orders contain shoppers' names, emails, phone numbers, and billing and delivery addresses. Shopify classifies name, email, phone, and address as protected customer fields; we access them only to provide app functionality.
We do not save shoppers' names, emails, phone numbers, or addresses in our own database. When an order is created, the app reads the order at that moment to:
Order details may also appear in our technical logs and in error reports captured by our error-monitoring service (Sentry) when something goes wrong.
Marketing. We may send marketing emails and text messages to business contacts who engage with us — for example, merchants who use our app, people who book a call with us, or contacts we meet directly. Every marketing email includes an unsubscribe link. Reply STOP to any marketing text message and we will stop sending them. We honor opt-outs promptly. Opting out of marketing does not affect service messages about an app you use.
Advertising. We do not run advertising or remarketing technology today — not on the website and not in the app. If we adopt advertising tools in the future (for example, ad measurement or remarketing), they will run only with your consent through our cookie banner, whose advertising signals are set to "denied" unless you accept.
The website uses Google Analytics 4 behind a consent banner built on Google Consent Mode v2. All four consent signals — ad_storage, ad_user_data, ad_personalization, and analytics_storage — default to denied. No analytics cookies are set and no analytics data is collected unless you choose Accept.
If you consent, Google Analytics uses cookies and similar identifiers to collect information about how you use the site — pages viewed, session length, device and browser type, and approximate location. Google processes that information on its servers to give us aggregated usage statistics. Google explains its handling of this data at policies.google.com/technologies/partner-sites. We use Google Analytics for measurement only; no Google Analytics advertising or remarketing features are enabled.
Your choice works like this:
For the full list of cookies and storage keys we use, see the Cookie Notice.
Where the GDPR or UK GDPR applies, we rely on:
Shoppers' order information that passes through the app is processed on the merchant's behalf and on the merchant's instructions. The merchant is responsible for the legal basis covering its customers' data.
We do not sell personal information, and we do not share it for advertising. We never have, and we will not. We share information only with the service providers below, in a business transfer, or when the law requires it.
| Provider | What it does for us | Information involved |
|---|---|---|
| Shopify | App platform and billing: the source of merchant and order data, and the biller of all app charges. | Merchant and shop data; app subscription records. |
| Google Analytics (only with your consent); Google Fonts and Hosted Libraries; Google Cloud hosts our staging environment. | Usage data (with consent); IP address for font/script requests. | |
| Vercel | Website hosting (United States). | Standard web-request data for the pages you visit. |
| Render | Cloud hosting for the app. | The app data described above, processed on Render's infrastructure. |
| MAS Direct Network | Florist wire-order fulfillment network. Used only for shops that opt into the integration (a Pro-plan feature); when such a shop receives an order, we send it to MAS to place the fulfillment order. | Order details, including buyer and recipient names, addresses, emails, and phone numbers. |
| Amazon Web Services (SES) | Delivers order-notification emails to a shop's own staff, for shops with that feature enabled. | Order details in the email, including the customer's name, contact information, and billing/delivery addresses. |
| Cloudflare (cdnjs) | Serves script libraries used by the website. | IP address as part of the file request. |
| Sentry | Error monitoring for the app. | Technical error reports, which can include request details. |
| Termly | Hosts our data-request (DSAR) intake form. | The information you enter when you submit a request. |
Business transfers. If NuFlorist is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this policy or to tell you about any changes.
Legal requirements. We may disclose information when legally required to — for example, in response to a valid court order.
Calendly is a separate company, not our processor: what you enter on its booking page is governed by Calendly's own privacy policy.
We are a US company. Our website is hosted in the United States, and our service providers process data in the United States and in other countries where they operate. If you visit from the EEA, the UK, or Canada, your information will be transferred to the US.
Where the GDPR or UK GDPR applies to a transfer, we rely on the safeguards those laws recognize: our providers' certifications under the EU-U.S. Data Privacy Framework (and its UK extension) where they hold them, and the Standard Contractual Clauses included in our providers' data-processing terms. For Canadian residents, we remain accountable for your information under Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), even when it is processed by a service provider outside Canada. You can ask us for more detail about a specific transfer using the contact details below.
No US state comprehensive privacy law (such as the California Consumer Privacy Act) currently applies to NuFlorist — each of those laws sets revenue or data-volume thresholds far above our size. We honor the core rights they describe anyway, voluntarily, for all US residents:
We do not use personal information for targeted advertising, and we do not disclose personal information to third parties for those parties' own direct-marketing purposes. Except for the MAS Direct Network credential described above (stored only if a shop opts into that integration), we do not process "sensitive" personal information as those laws define it. We will not discriminate against you for exercising any of these rights.
What we collect, using the category labels these laws use:
| Category | Collected? | Details |
|---|---|---|
| Identifiers (name, email, phone, IP address) | YES | When you email us or book a call; merchant contact details through the app; device identifiers and IP via analytics, only with consent. |
| Commercial information | YES | Records of app subscriptions billed through Shopify; order statistics that do not identify shoppers. |
| Internet or other network activity | YES | Website usage data via Google Analytics, only with consent. |
| Geolocation data | Approximate only | City-level location inferred from IP address by Google Analytics, only with consent. We do not collect precise geolocation. |
| Protected classification characteristics | NO | — |
| Biometric information | NO | — |
| Audio, video, or other sensory data | NO | — |
| Professional or employment information | NO | — |
| Education information | NO | — |
| Inferences or profiles drawn about you | NO | — |
| Sensitive personal information | YES | MAS Direct Network account username and hashed password — stored only for shops that opt into that integration. |
To exercise any of these rights, use the data-request form or email address in "Contact" below. We verify requests by corresponding with the email address you used or provided. If we decline a request, you may appeal by replying to our response, and we will review the appeal and answer within the same timeframes.
If the GDPR or UK GDPR applies to you, you have the right to:
You are never legally required to give us personal data. For merchants, some data — such as a Shopify sign-in session — is necessary to provide the app; without it, the app cannot run. We do not make automated decisions about you that have legal or similarly significant effects.
You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office (ICO).
We follow the fair-information principles of Canada's PIPEDA. In practice, that means:
The person accountable for privacy at Nuflorist, LLC can be reached at info@nuflorist.com. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.
Quebec. Quebec's Law 25 sets stricter rules, including opt-in consent. Our practices already work that way — nothing is collected on our website for analytics or marketing without your affirmative consent — and Quebec residents can exercise all of the rights above through the contact details below.
Some browsers send "Do Not Track" (DNT) or Global Privacy Control (GPC) signals. Our website does not read or respond to these signals. This costs you nothing, for two reasons. First, we do not sell or share personal information or use it for targeted advertising, so there is no sale or sharing for these signals to opt you out of. Second, analytics runs only if you affirmatively click Accept in our banner — if you do nothing, nothing is tracked, with or without a browser signal.
Our website and app are business tools. They are not directed to anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has given us personal information, email info@nuflorist.com and we will delete it.
When we change this policy, we will update the "Last updated" date at the top and post the revised version on this page. If a change is material, we will flag it prominently here. The current version always governs.
To exercise any privacy right described in this notice, submit a request through our data-request form at app.termly.io/notify/81c8d300-c742-4874-856a-9e78f1582cb5, or email info@nuflorist.com.
We respond to data requests without undue delay and within one month. If a request is complex, we may take up to two additional months; if so, we will tell you within the first month and explain why. Responding to your request is free of charge.
© 2026 Nuflorist. All rights reserved.