Privacy Policy

Information Customers Provide

You voluntarily provide information when you build a standard order, submit a custom-order inquiry, respond to a quote, or submit a customer review. Depending on the form and the details you choose to share, Sugar Spell may receive:

• Your name, email address, and optional phone number.
• Menu items, pack sizes, quantities, flavors, desired date, and pickup or delivery choice.
• A delivery address when you request an available local-delivery option.
• Event date, event type, estimated guest count, and requested quantity.
• Treat selections, flavors, colors, theme, design description, and other order notes.
• Budget range and pickup or delivery-inquiry preference.
• An optional inspiration image or PDF.
• For reviews: your chosen display name, optional email, star rating, review text, and order type.

The Contact page uses an email link rather than a website contact form. If you email Sugar Spell directly, the contents of that message are handled through your email provider and Sugar Spell's email service, not submitted to the website database by the Contact page.

Customer Reviews

Customers may voluntarily submit reviews. New submissions are stored privately with a pending status and may be approved, rejected, returned to pending, featured, or removed from public display through Sugar Spell's owner-only moderation workflow.

If a review is approved, the submitted review text, star rating, order type, and the public-facing name you chose may appear on the website. The optional email address is available to the owner for moderation and follow-up but is not included in the public review feed. Please do not put private contact information in the review text unless you intentionally want it included in what you submit. Sugar Spell may decline to publish or may later remove a submission from public view.

Uploaded Files

The custom-order form accepts an optional JPG, PNG, WebP, HEIC, or PDF reference file, up to 8 MB. An uploaded file is used to evaluate or discuss the requested custom order. The website stores accepted files in a private Supabase Storage bucket and records a private file path with the related inquiry.

A customer upload is not automatically published and does not become gallery content merely because it was submitted with an inquiry. Private storage reduces public access, but no online system can promise permanent confidentiality or perfect security.

How Information Is Used

Sugar Spell may use submitted information to:

• Respond to inquiries and determine availability.
• Calculate standard-order totals and create a secure Square-hosted checkout.
• Evaluate order requests, discuss designs, and provide pricing.
• Prepare and send custom-order quotes and Square Invoices with a deposit and remaining balance.
• Match Square payment updates to the correct Sugar Spell order and update its pipeline status.
• Communicate about orders and maintain customer-service or business records.
• Receive, moderate, and publish approved customer reviews.
• Send submission confirmations and owner notifications.
• Prevent spam, fraud, automated abuse, and excessive submissions.
• Maintain website security and comply with legitimate legal obligations.

A custom-order inquiry is only a lead and does not reserve a date. A standard order is booked after Square confirms full payment. A custom order is booked after Sugar Spell accepts it and Square confirms the required 50% deposit.

Technical and Security Information

When a form is submitted, the website may use the request's IP address to create a temporary one-way rate-limit key and, when available, send the IP address to Cloudflare Turnstile for security verification. Sugar Spell's inquiry record stores limited source metadata: the browser user-agent string and the referring page. The raw IP address is not written to the inquiry or review database by the application code.

Hosting, database, security, and email providers may also process request, device, diagnostic, or network information needed to operate and protect their services.

Square sends signed webhook notices to the website when payment, order, or invoice status changes. These notices may include Square transaction identifiers, amounts, currency, status, invoice details, and limited payment-method information. The website validates the signature before using a notice to update an order.

Service Providers

Sugar Spell uses a limited group of providers to operate the current website. They may process information necessary to perform their respective services and operate under their own terms and privacy practices.

Sugar Spell does not control these providers' independent privacy practices.

Cookies and Similar Technologies

Sugar Spell does not use Google Analytics, Meta Pixel, behavioral advertising, or cross-site advertising tracking. The website uses its own limited, first-party analytics to count public-page views, anonymous visits, broad traffic sources, device categories, and selected actions such as quote-request clicks, gallery opens, email clicks, and successful form submissions. Analytics never includes submitted names, email addresses, phone numbers, uploaded files, form text, raw IP addresses, or activity inside the admin area.

A randomly generated identifier is kept in session storage for the current browser tab so repeat page views can be counted as one anonymous visit for that day. An analytics opt-out preference may be kept in local storage. The standard-order shop also uses local storage to keep the cart and a random checkout-session identifier on the device so the cart can survive a return from Square or an incomplete checkout. Cart storage includes selected products, options, quantities, and flavors, but not the checkout contact or card fields. Sugar Spell respects Global Privacy Control and Do Not Track browser signals and does not collect these analytics when either signal is enabled. Necessary security and infrastructure services may still process technical signals to deliver and protect the site. The owner-only admin area uses Supabase authentication and may store a secure sign-in session in the owner's browser.

Payment Information

Shopsugarspell.com uses Square in two ways. Standard menu orders are sent to a Square-hosted checkout for full payment. Accepted custom quotes are sent to a Square-hosted Invoice that requests a 50% deposit and shows the remaining balance and due date. Sugar Spell's website does not collect or store full payment-card numbers; card and other supported payment credentials are entered on and processed by Square.

To create checkout or an invoice, Sugar Spell may share with Square the customer's name, email address, phone number, order descriptions, quantities, prices, total, fulfillment information, and relevant due dates. Square may separately collect billing, shipping, device, fraud-prevention, and payment information under Square's own privacy terms.

Returning from Square does not by itself mark an order paid. Shopsugarspell.com records a paid standard-order conversion or a booked custom-order deposit only after it validates a signed Square payment update. If an unpaid custom quote reaches its displayed expiration, its Square Invoice may be canceled and Sugar Spell may need to issue an updated quote.

Data Retention

Sugar Spell may retain inquiry, cart-to-order, quote, invoice, payment-reference, review, and related communication records for as long as reasonably necessary for customer service, order administration, business records, dispute resolution, fraud prevention, security, and legitimate legal obligations. This policy does not promise a fixed deletion schedule.

Anonymous website analytics are aggregated for business trend reporting and are automatically removed after 180 days.

Square webhook audit records are minimized to the event and processing details needed to prevent duplicates, reconcile an order, and investigate delivery errors. Sugar Spell does not retain the full Square card or payment payload in that audit log. These minimized webhook audit records are automatically removed after 180 days; related order, invoice, and payment business records follow the business and legal retention approach described above.

Data Security

The website uses HTTPS in production, server-side form processing and validation, anti-spam checks, rate limiting, private database tables protected by access controls, a non-public upload bucket, server-only credentials, and a limited database function that returns approved reviews without customer email addresses. Square webhook signatures are validated before payment events change an order, and duplicate event identifiers are recorded to reduce repeat processing. Security headers also limit certain browser capabilities and common content-handling risks.

These safeguards are intended to reduce risk. No method of internet transmission or electronic storage can be guaranteed to be completely secure.

Children's Privacy

Sugar Spell's products may be enjoyed at family and children's events, but the website's inquiry and review functions are intended for people capable of submitting a business inquiry or review. They are not designed to intentionally collect personal information from children under 18.

If Sugar Spell becomes aware that a child under 18 submitted personal information without appropriate authorization, a parent or guardian may email shopsugarspell@gmail.com to request review and deletion of reasonably identifiable information.

External Links and Social Media

The website links to external services, including Square-hosted checkout and invoice pages, Sugar Spell's Facebook and TikTok profiles, and the Mythos Web Studio website. Those third-party sites are outside Sugar Spell's control and operate under their own privacy and accessibility practices.

Privacy Choices and Requests

You may ask Sugar Spell to help you access, correct, or delete information associated with a reasonably identifiable inquiry or review. Email shopsugarspell@gmail.com with enough context to locate the relevant submission. Sugar Spell accepts and evaluates privacy-related requests, but this statement does not promise that every request is a statutory right in every jurisdiction or that information subject to a legitimate retention need can always be deleted immediately.

You can turn anonymous site analytics off or back on at any time with the control in the Cookies and Similar Technologies section above. Because analytics records do not contain a name, email address, or other direct identifier, Sugar Spell may not be able to connect an aggregate analytics record to a particular visitor.

Policy Updates

This Privacy Policy may change when the website, business operations, or service providers change. The latest revision date will appear at the top of this page.