Privacy
Sourdoe is one person baking bread in Ramsey. There is no marketing list and nothing is sold on to anybody. You can buy bread without making an account.
This page goes through every place your details come up, and says what happens to them.
Ordering
An order records what was in it, what it cost and a reference. Your name and email come from Stripe when the payment goes through, and they are held against the order so the shop can find it again if you write in, and so there is a receipt. The shop never asks you for a name itself, and an order without one is still a complete order. Orders are kept as the shop's own accounts.
Paying
Payment happens on Stripe's own checkout page, not on this site. No card number is typed here and none is stored here. Stripe is the data controller for what you give them; their privacy notice covers it.
Accounts
You can buy bread without an account. If you make one it holds your name, your email, your orders and whether you asked to hear when the shed opens. The card itself is not stored — it is counted from the orders you have paid for. You can take a copy of the lot, or close the account, from your account page.
Signing up
The sign-up and password reset forms carry Cloudflare Turnstile, which tells a person from a bot. It runs on those two pages and nowhere else. It looks at your browser and connection to decide, and Cloudflare is the data controller for that; their privacy notice covers it. The shop sends Cloudflare only the check's answer and your connection's address, never what you typed.
Messages
What you write is sent to the bakery's inbox with your address as the reply-to, and that is the whole of it. Nothing from the form is written to a database. It lives as long as the email does.
Your basket is kept in your own browser, not on the server. Clearing your site data empties it, and nobody here can see it.
Signing in sets a cookie, so the site remembers it is you from one page to the next. It goes when you sign out.
Scanning the code in the shed sets a cookie holding that day's code, so the site lets you buy. It holds nothing about you, and it expires after half an hour, or when the shed shuts if that is sooner.
The one optional cookie is Google Analytics, which counts visits and which pages get read. It is off until you allow it, and it stays off if you do not. It records pages, rough location by country and what sort of device you are on. It is never given your name, your email or what you ordered.
To change your mind, clear this site's data in your browser and the question comes back on your next visit.
You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted. Where an order has to be kept for the shop's accounts that will be said plainly rather than quietly done. Ask by email and it will be answered by a person.
With an account you do not have to ask. Your data gives you a file with everything in it, and closes the account on the spot. Closing takes your name, your email and your baker's dozen with it; past sales stay on the books with nobody's name against them, because the shop has to keep its takings.
If you are not happy with the answer, the Information Commissioner's Office takes complaints at ico.org.uk.
