Contents
1. Who we are
Sugar & Spindle Confectionery ("we", "us") is a small confectionery studio at 1427 Juniper Lane, Suite 6, Asheville, NC 28801, United States. We are the controller of the personal data described on this page. Our contact address for all privacy matters is sugarandspindle.candy@gmail.com, or by telephone on +1 (828) 555-0147 during business hours (Tuesday to Saturday, 10:00–17:00 ET).
2. The short version
- This website has no account system, no checkout and no sign-up form. Nothing you type into it is transmitted to us automatically.
- The box builder and the contact form run entirely in your browser. When you submit, your own email application opens with the text pre-filled; you choose whether to send it.
- We store one item in your browser — your cookie choice — so the banner does not reappear on every visit.
- We do not run advertising, analytics, tracking pixels or third-party embeds, and we do not sell or share personal information for cross-context behavioral advertising.
3. Information we collect
3.1 Information you give us by email
If you write to us, we receive whatever you include: your name, email address, postal address (for an order or a custom batch), telephone number if you add one, the content of your message, and any photographs or documents you attach. If you place an order, we also keep the order details needed to make and ship it, such as flavor selection, shipping address and delivery notes.
3.2 Information handled in your browser only
The box builder keeps your flavor selection in the page itself and does not save it anywhere. If you close or reload the page, the selection is cleared. Contact form values are read by your browser to compose an email and are not stored on this website.
3.3 Technical information
Our hosting provider records standard server log data — IP address, request time, requested page, referring page and browser type — for security and to keep the site running. We do not combine these logs with any other information to build a profile of you, and we do not use them for advertising.
4. Cookies and local storage
When you first visit, a banner asks how you would like this site to handle cookies. Accept and Essential only both record your choice; there are no optional advertising or analytics cookies to consent to, because we do not set any.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| ss_cookie_choice | Local storage, first-party | Remembers whether you chose "Accept" or "Essential only" so the banner is not shown again. | Until you clear browser data |
You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of any page, which reopens the banner. Clearing site data in your browser also removes the stored choice.
4.1 Third-party services
This site loads no third-party fonts, analytics, advertising or social plugins. The only external service involved is your own email provider, which handles messages you choose to send us — for example Gmail, whose handling of your mailbox is governed by Google's own privacy policy. If an order is shipped, we share the delivery name, address and telephone number with the carrier that delivers it.
5. Why we use information
- To answer your question and, if you order, to make, pack and ship your candy.
- To comply with food labelling, sales-record and tax obligations.
- To handle a complaint, replacement or refund.
- To keep the website secure and diagnose technical faults.
We do not send marketing email unless you have separately asked to be included in a dispatch, and every one of those messages includes a one-click way to stop receiving them.
6. Legal bases
Where the GDPR or UK GDPR applies, we rely on: contract (making and delivering an order you placed), legitimate interests (answering enquiries, keeping the site secure, keeping ordinary business records), legal obligation (tax and food-safety records) and consent (non-essential storage, and marketing email if you opt in). You may withdraw consent at any time.
7. When information is shared
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share only what is necessary with:
- Delivery carriers, to ship an order you placed.
- Email and hosting providers, which process messages and serve this website on our behalf.
- Professional advisers and authorities, where the law requires it or where we must establish or defend a legal claim.
8. How long we keep it
- General enquiries: up to 24 months after the last exchange.
- Order records, including allergen and shipping details: up to 7 years, because tax and food-safety rules require it.
- Server logs: typically 30 days, then deleted or anonymised.
- Your cookie choice: until you clear it.
9. Your privacy rights
Depending on where you live, you may have the right to:
- ask what personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have data deleted, where we are not required to keep it;
- restrict or object to certain processing, including direct marketing;
- receive your data in a portable format;
- withdraw consent to non-essential storage;
- not be discriminated against for exercising any of these rights.
California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not knowingly process the personal information of consumers under 16 for advertising. To make a request, email sugarandspindle.candy@gmail.com with the subject line "privacy request". We reply within 30 days and may ask for a detail that only you would know, to avoid disclosing someone else's data. You may also complain to your local data protection authority.
10. Children
This site is directed at adults buying candy as a gift or for themselves. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us and we will delete it. Note that hard candy is a choking hazard for children under four.
11. Security
We keep personal data to a minimum, which is the strongest protection available to a small studio. Order details live in an access-controlled mailbox and, where required, in accounting records. No method of transmission over the internet is perfectly secure, so please do not send payment card numbers by email; we will send a separate payment link if a card payment is needed.
12. Changes to this policy
If our practices change — for example if we add a newsletter sign-up that stores addresses — we will update this page and change the effective date above. Material changes affecting existing customers are also announced by email. This policy does not create rights for third parties.
13. How to contact us
Questions about this policy, or a request about your data, can go to:
- Email: sugarandspindle.candy@gmail.com
- Phone: +1 (828) 555-0147, Tuesday to Saturday, 10:00–17:00 ET
- Post: Sugar & Spindle Confectionery, 1427 Juniper Lane, Suite 6, Asheville, NC 28801, United States