Privacy policy
What this website collects, what it does not, and how to ask us about it. No accounts, no advertising trackers, no cookies that follow you around.
This is a short policy because the site does very little with your data.
There are no customer accounts, no shopping cart and no advertising trackers on this website. We count visits, and that is all — no cookie, no profile, nothing that follows you anywhere. We have nothing to sell to anyone who would want one.
How we count visits
We use Cloudflare Web Analytics, and we picked it because of what it does not do. It sets no cookie, it does not store anything on your device, and it does not build a profile or follow you to other sites. What it records is that a page was loaded, roughly where in the world from, and how quickly it appeared — so we can tell whether the site is working and which pages people actually read.
It cannot tell us who you are, and neither can we.
Cloudflare’s privacy policy governs that data: cloudflare.com/privacypolicy.
What is stored on your device
Your hold list. If you ask us to hold something, the list is kept in your
own browser under nf_holds until you send it or clear it. It never leaves
your device until you press the button that sends it, and it is not a cart —
nothing is bought, reserved or paid for here.
The age check. When you confirm you are 19 or older, we store a single
value called nf_age_ok in your browser for 30 days so you are not asked on
every page. It records nothing about who you are — only that the question was
answered — and it never leaves your device.
That is the only thing this site stores on your device.
What our hosting sees
The site is served through Cloudflare, which sits in front of it. Like any web host, Cloudflare records standard request information — IP address, the page requested, the time, and your browser’s user-agent string — and uses it to serve the site and to block attacks and abusive traffic. This is infrastructure logging, not analytics, and we do not use it to track individuals.
Cloudflare’s own privacy policy governs that data: cloudflare.com/privacypolicy.
Fonts and images
The fonts on this site are downloaded when the site is built and served from our own domain. Your browser does not contact Google Fonts or any other font service, and no request for a font tells a third party that you visited us. The same is true of every image — everything is served from here.
There are exactly two exceptions on the whole site, and both are named on this page: the visit counter described above, which runs on every page, and the Turnstile check, which runs only on the hold form. Both are Cloudflare, who already serve the site.
What we do not do
- We do not take payment on this site
- We do not run advertising tags, and the visit counting described above sets no cookie and builds no profile
- We do not embed videos, maps or social widgets that would load third-party code into the page
- We do not sell, rent or share personal information with anybody
The address on our contact page links out to Google Maps rather than embedding it. Following that link takes you to Google, where Google’s terms apply.
When you contact us
If you call us, email us or place an order at the counter, we hold what you give us for as long as we need it to serve you — a phone order, for example, is written down and then discarded once you have collected it.
When you ask us to hold something
If you send us a hold request, we store what you gave us so the shop can act on it and so we know how many requests we get:
- your name and phone number
- your email address, only if you choose to give one — it is optional, and we will call rather than email you if something has gone
- the items, sizes and quantities you asked for, and what they come to at in-store prices
- your note, if you wrote one
- the date and time
- a scrambled, one-way version of your network address, which we keep to stop the form being abused. It cannot be turned back into an address, and it does not identify you
We do not ask for and do not store a postal address, your date of birth, or any payment details — there is no payment on this site.
We delete hold requests after 60 days. That is automatic, not something somebody remembers to do.
The request is emailed to the shop so staff can set your items aside.
We hold items for 48 hours at most. After that they may go back on the shelf without notice.
The form uses Cloudflare Turnstile, which checks that the request is coming from a real browser rather than a script. It is the one place on this site where your browser contacts a company other than us, it runs only on the hold page, and it does not track you across websites. Cloudflare’s privacy policy applies to that check: cloudflare.com/privacypolicy.
The wholesale portal
The wholesale portal at /ws/ is a separate system with its own accounts and
its own login. If you have a wholesale account, that system holds your business
details. It is not connected to this website.
Asking us about your data
Email info@nativeflower.ca or call 1.800.771.1851 and ask for the manager. We will tell you what we hold and delete it if you ask us to.
Native Flower operates on Tyendinaga Mohawk Territory. Canadian federal privacy law — the Personal Information Protection and Electronic Documents Act — is the framework we take as our reference point for handling personal information.
Changes to this policy
We revise this page when what the site does changes. The date at the top is when it was last updated.