Privacy Policy

1. Information we collect

• When you order: your name, e-mail address, phone number, delivery address and city, the items you order, your delivery and payment method, any notes you add and, if you tell us, which of our accounts you paid into.
• When you create an account: your name, e-mail address, phone number, a delivery address and your password. Your password is held by our sign-in provider in a form we can't read. We e-mail you one-time codes to verify your address and to reset your password.
• When you start checkout but don't finish: when you continue from the first step, we save the e-mail address, name, phone number, city and basket you entered (the checkout tells you this next to the button). If you don't complete the order, we may send you one reminder e-mail and may message you on WhatsApp to help.
• Newsletter, alerts and wishlist: your e-mail address if you join the newsletter (we e-mail you a link to confirm first, and only send newsletters once you do); your e-mail address, and optionally your WhatsApp number, if you ask to be told when a plant is back in stock; and the plants you save to your wishlist when signed in.
• Referrals: if you refer a friend by e-mail, we store their address so we can reward you when they order. We don't e-mail your friend because of the referral. Please only refer people who are happy for you to share their address with us.
• Reviews: your rating, your review, the name you choose to show (if any) and any photo you add. Reviews are published on our website.
• Service enquiries and event bookings: your name, WhatsApp number, e-mail address (optional), area, a description and any photos of your space; for events, your name, phone number, e-mail address and the number of places you book.
• Messages: what you send us on WhatsApp or by e-mail, including payment receipts.
• Technical information: like most websites, we receive your IP address, browser and device type, and the pages you visit. We use IP addresses to protect our forms from abuse, and our hosting and error-monitoring providers log requests to keep the site running. See "Analytics" below.

We never ask for or store card numbers, bank log-ins or wallet PINs. You pay by transferring money to our bank or wallet accounts.

2. How we use it

• To take, deliver and support your orders, pickups, service visits and event bookings.
• To send service e-mails: order and payment confirmations, payment reminders, shipping updates, cancellations and sign-in codes.
• To ask how your plants are doing and invite a review after an order arrives.
• To send newsletters and offers, only if you signed up, and stock or price alerts for plants you asked about or saved.
• To run welcome coupons and referral rewards.
• To keep the site secure and prevent fraud and abuse.
• To understand how the site is used so we can improve it.
• To keep business and accounting records and meet our legal obligations.

3. Who we share it with

We don't sell your personal information. We share it only with the companies that help us run the shop, and only what each one needs:

• Supabase hosts our database and customer sign-in.
• Vercel hosts the website.
• Cloudflare stores photos uploaded to the site, including review and enquiry photos.
• Resend and Mailtrap send our e-mails.
• Google Analytics measures how the website is used (see below).
• Sentry records technical errors so we can fix them.
• WhatsApp (Meta) carries the messages you exchange with us there.
• Courier companies we book for your delivery (for example Leopards Courier, TCS or Trax) receive your name, phone number and delivery address.
• Your bank or wallet provider handles the payments you make to us, under its own terms.
• Authorities, when the law requires it.

These providers store and process data outside Pakistan, including in Singapore and the United States. Data travels between your browser, our website and these providers over encrypted (HTTPS) connections.

4. Analytics

We use Google Analytics to see which pages are visited, how people find us and where checkouts stop. It records the pages you view, your approximate location (worked out from your IP address), your device and browser, the site you came from, and shopping events such as items added to the basket and order values. We don't send Google your name, e-mail address or phone number, and we remove order and unsubscribe links from page addresses before they're sent. You choose whether Google Analytics may set cookies: our Cookie Policy explains them and lets you change your choice.

5. How long we keep it

• Order records: kept as business and accounting records. If you delete your account, they're kept without your personal details.
• Account details: for as long as you have an account.
• Newsletter address: until you unsubscribe.
• IP addresses used to protect our forms: deleted after about a day.
• One-time codes: they expire after 10 minutes and are deleted once used.

We keep everything else only as long as we need it for the reason we collected it. You can ask us to delete your information at any time.

6. Your choices

• See, correct or download your details: signed-in customers can see and edit their details in their account, and download everything we hold about them with “Download my data”. For anything else, contact us.
• Delete your information: use “Delete my account” in your account, or ask us. Your name, contact details, addresses, wishlist, newsletter sign-up and enquiries are erased. Past orders are kept for accounting without your details, and your reviews stay without your name.
• Newsletters, reminders and alerts: each of these e-mails has an unsubscribe link, which stops all of them. E-mails about your orders and your account still arrive.
• Analytics: accept or decline analytics cookies in the banner or on the Cookie Policy page.

7. Keeping it safe

The site runs over HTTPS, access to customer information is limited to our staff, and we don't store payment card details. No system is completely secure, but we work to protect your information and to fix problems quickly.

8. Children

Our shop is for adults. You must be 18 or over to place an order (see our Terms & Conditions).

9. Changes to this policy

When our practices change we'll update this page and the date at the top.

10. Contact us

• E-mail: support@muffinplants.com
• WhatsApp: +92 309 5360009