Privacy policy
Privacy Policy — Blossomdale
Effective date: September 15, 2026
Last updated: September 4, 2026
1. Who we are
Healthy Harvesters Inc., doing business as Blossomdale operates blossomdale.com, an online plant nursery selling landscape plants, houseplants, fruit trees and seeds. In this policy "we", "us" and "our" mean Healthy Harvesters Inc., doing business as Blossomdale.
This policy explains what personal information we collect when you visit or buy from the site, why we collect it, who receives it, how long we keep it, and what rights you have. It covers this website and our email and SMS marketing. It does not cover other websites we link to.
Contact for privacy matters: hello@blossomdale.com
2. How consent works on this site
We do not treat everyone the same way, because the law does not.
- If you are in California or Quebec, we ask before we switch on analytics, advertising or session recording. Nothing in those categories runs until you choose. You can change your choice at any time using the Cookie preferences link in the footer.
- Everywhere else in the United States and Canada, analytics and advertising technologies run by default, and you can switch them off at any time using the Do Not Sell or Share My Personal Information link in the footer.
- In all locations, we honour the Global Privacy Control (GPC) signal automatically. If your browser sends GPC, we treat it as an instruction to stop selling and sharing your personal information, and you do not need to do anything else.
Strictly necessary technologies — the ones that make the cart and checkout work — always run, in every location. They do not track you across other websites.
3. What we collect (notice at collection)
| Category | Examples | Why | Sold or shared? | Kept for |
|---|---|---|---|---|
| Identifiers | Name, email, postal address, phone, IP address, device and cookie IDs, account ID | Orders, support, accounts, marketing, fraud prevention | Shared for cross-context behavioural advertising | Orders: 7 years. Account: until you ask us to delete it. |
| Customer records | Billing and shipping address, order history, payment method type and last four digits | Processing, delivering and refunding orders; accounting | No | 7 years from the order |
| Commercial information | Products viewed, added to cart, purchased, returned | Fulfilment, personalisation, analytics | Shared for cross-context behavioural advertising | 24 months |
| Internet or network activity | Pages viewed, referrer, on-site searches, clicks, time on page, device and browser, approximate location from IP | Site performance, analytics, ad measurement | Shared for cross-context behavioural advertising | 14 months |
| Session recordings | A replay of mouse movement, scrolling, clicks and typing during your visit | Finding usability problems and errors | No | 90 days |
| Geolocation | Approximate city, region and country from your IP address. We do not collect precise GPS location. | Tax, shipping, fraud prevention, applying the right privacy settings for your region | No | 14 months |
| Inferences | Product preferences and audience segments drawn from the above | Personalising marketing and merchandising | Shared for cross-context behavioural advertising | 24 months |
Where it comes from. Directly from you when you order, subscribe, create an account or contact us; automatically from your device through the technologies in Section 4; and sometimes from our advertising and analytics partners.
Sensitive personal information. We do not collect sensitive personal information to infer characteristics about you. Payment card details and login credentials are handled by our payment processor and platform only to complete your purchase and secure your account — permitted business purposes under California law. Because we do not use sensitive personal information beyond those purposes, we are not required to offer a "Limit the Use of My Sensitive Personal Information" option, and we do not.
Age. We do not knowingly collect personal information from anyone under 16. See Section 8.
4. Cookies, pixels and other technologies
The tables below name every third party that receives data from your visit. We update them whenever we add or remove a vendor.
Always on — strictly necessary
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Shopify (platform) | Runs the store: cart, checkout, sessions, fraud prevention, load balancing. | IP address, device and browser data, pages viewed, cart and order contents. | Strictly necessary | Cannot be disabled — the store does not function without it. |
Session recording — Microsoft Clarity
We use Microsoft Clarity to record how visitors use the site — mouse movement, scrolling, clicks and typing in form fields. This produces a replay of your visit that we use to find usability problems and errors. Microsoft acts as an independent controller of this data; its practices are described at https://privacy.microsoft.com/privacystatement.
We ask permission before this starts in California and Quebec, and it does not run there unless you agree. Elsewhere it runs by default and you can switch it off through Cookie preferences or the Do Not Sell or Share link.
In every location: all text you type is masked before it leaves your browser, and checkout and account pages are excluded from recording entirely.
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Microsoft Clarity | Records a replay of your visit — movement, scrolling, clicks, typing (text masked). | Pages viewed, interaction events, masked form input, IP address, device and browser. | Session recording | Cookie preferences, or the Do Not Sell or Share link. |
Analytics
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Google Analytics (via Google Tag Manager) | Measures traffic and how people move through the site. | Pages viewed, referrer, approximate location from IP, device and browser, a random analytics ID. | Analytics | Cookie preferences, or Google's own opt-out add-on. |
Advertising and marketing
These involve sharing personal information for cross-context behavioural advertising. Section 2 explains how to switch them off.
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Meta (Facebook & Instagram) Pixel | Measures ad performance and builds advertising audiences. | Pages and products viewed, add-to-cart and purchase events, IP address, a Meta browser ID. | Advertising — sharing | Do Not Sell or Share link, or Meta's ad settings. |
| Google Ads (via Google Tag Manager) | Conversion measurement and shopping ads. | Products viewed and purchased, conversion values, device and browser data. | Advertising — sharing | Do Not Sell or Share link, or Google's ad settings. |
| Klaviyo | Email marketing and on-site personalisation. | Email address if you give one, browsing and purchase history, an on-site tracking ID. | Advertising | Unsubscribe from emails, or the Do Not Sell or Share link. |
| RecoverMyCart | Abandoned-cart recovery messaging. | Cart contents, and your email address if you have given one. | Advertising | Unsubscribe from recovery emails, or the Do Not Sell or Share link. |
Functional and merchandising
These power specific features. They are not used to build advertising profiles.
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Loox | Customer photo reviews. | Order and product data. | Functional | — |
Live chat
We do not currently run a live chat widget on this site. If we add one, we will update this policy and show a recording notice before any conversation begins.
Shopify's own cookies. The platform sets cookies including _ab, _secure_session_id, cart, checkout_token, _shopify_s and _shopify_y to keep your session and cart working and to produce aggregate store statistics. Shopify's practices are described at https://www.shopify.com/legal/privacy.
5. Selling and sharing
We would rather be blunt here than vague.
We share personal information for cross-context behavioural advertising. The advertising technologies in Section 4 receive identifiers and information about what you viewed and bought, and use it to show you our ads elsewhere and to measure whether those ads worked. Under California and several other state privacy laws this counts as "sharing", and some of it may count as a "sale" — even though no money changes hands for your data.
We do not sell personal information for money. We do not hand your name, email address, postal address or phone number to third parties for their own marketing.
We have not sold or shared the personal information of anyone we know to be under 16.
To stop this: Do Not Sell or Share My Personal Information, or send a GPC signal from your browser, or — in California and Quebec — decline advertising when we ask.
6. Your rights
Anyone, anywhere
- Switch off advertising and data sharing — the Do Not Sell or Share link, or the Cookie preferences link, both in the footer.
- Stop marketing email — the unsubscribe link in any email.
- Stop marketing SMS — reply STOP to any message.
- Access, correct, or delete what we hold about you — email hello@blossomdale.com.
United States
Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have some or all of these rights:
- Know / access what we hold, where we got it, why, and who we disclosed it to
- Delete personal information we hold about you
- Correct anything inaccurate
- Portability — a copy in a portable, machine-readable format
- Opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects
- Non-discrimination — exercising these rights will never cost you a worse price or service
- Appeal — if we say no, you can appeal; we will respond within the period your state allows and tell you how to complain to your Attorney General
Rights vary somewhat between states. We apply the broadest set we reasonably can to everyone.
California. You also have the right to know the categories of personal information collected, the sources, the business purposes and the categories of third parties involved — Sections 3, 4 and 5 set all of that out. You may use an authorised agent; we will ask for proof of their authority and may ask you to verify your identity directly.
Canada
You may ask for access to your personal information and ask us to correct it, and you may withdraw consent to marketing at any time.
Quebec. Technologies that identify, locate or profile you are off by default on this site. We ask before enabling them, and you can change your answer at any time through Cookie preferences. You also have the right to request that we stop disseminating your personal information, and the right to data portability.
Making a request
Email hello@blossomdale.com with "Privacy Request" in the subject line, or use the contact form at blossomdale.com/pages/contact. We acknowledge requests within 10 business days and respond within 45 days, extending once by a further 45 days if the request is complex — we will tell you if that happens. We verify identity by matching the email address or order details you give us against our records.
7. Who else receives information
Beyond the vendors in Section 4:
- Service providers working for us under contract — our platform, payment processors, shipping carriers, email and SMS providers, support tools and hosting. They may only use the information to provide their service to us.
- Professional advisers — accountants, auditors, lawyers, where needed.
- Authorities — where legally required, or to establish or defend legal claims, or to protect people or property.
- A buyer or successor — if the business is sold, merged or reorganised, personal information may transfer with it.
8. Children and teenagers
This site is for adults. We do not knowingly collect personal information from children under 13, we do not knowingly sell or share the personal information of anyone under 16, and we do not target advertising at anyone we know or reasonably should know is under 18.
If you believe a child has given us personal information, email hello@blossomdale.com and we will delete it.
9. How long we keep things
| Information | Kept for |
|---|---|
| Order and transaction records | 7 years from the order, for tax and accounting |
| Customer account details | Until you close the account or ask us to delete it, then 30 days |
| Marketing email and SMS lists | Until you unsubscribe, then 12 months, so we can honour the opt-out |
| Session recordings | 90 days |
| Customer support conversations | 3 years from the last message |
| Analytics and advertising identifiers | 14 months |
| Server and security logs | 90 days |
| Records of privacy requests | 2 years, as the law requires |
Where a legal obligation or an open dispute requires us to keep something longer, we keep only what that purpose needs.
10. Security
The site runs on Shopify, which holds PCI DSS Level 1 certification for payment handling. Traffic is encrypted in transit using TLS. Access to personal information is limited to people who need it for their work. No system is perfectly secure and we cannot promise otherwise, but if a breach affects your personal information we will notify you and the relevant regulators as the law requires.
11. Changes
We update this policy when our practices change, including whenever we add or remove a vendor from the tables in Section 4. The "last updated" date at the top shows when it last changed. If we make a material change to how we use personal information, we will give notice on the site before it takes effect.
12. Contact
Healthy Harvesters Inc., doing business as Blossomdale Email: hello@blossomdale.com Contact form: blossomdale.com/pages/contact Website: blossomdale.com
Unhappy with our response? You may complain to your state Attorney General. In Canada, to the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec if you are in Quebec.
Configuration this policy assumes
This section is for the Bower/client team — delete it before pasting the policy into Shopify.
- Clarity is consent-gated via its consent API or the Customer Privacy API — not left as a raw theme script, which is how it runs today.
- Clarity masking is set to Level 1 (strict) and the tag is removed from checkout and account pages.
-
The old cookie table is deleted, not merged. The current policy carries a Shopify template table listing only
_ab,_secure_session_id,cart,checkout_token,_shopify_gaand_shopify_s— it presents itself as complete while omitting Clarity, Meta, Klaviyo and Google. Replace it wholesale with Section 4. -
The broken footer link reading "Privacy Policy." and pointing at
href="#"is fixed or removed. - Cookie banner enabled for California and Quebec only.
- Data sale/sharing opt-out page live for the full US state list, link in the footer, plus a Cookie preferences link.
- The community forum at community.blossomdale.com is not covered by this policy. If it holds accounts or posts, it needs either its own policy or a section added here — confirm which with the client.
Optional additions
- Postal address. No mailing address is published anywhere on blossomdale.com, so this policy uses email plus the contact form as its two designated request methods — which is acceptable for an online-only retailer. If the client has a business address they are willing to publish, add it to Section 12.
- Arbitration clause and class-action waiver in the Terms of Service. Not part of this policy, but the single cheapest mitigation against the volume demand-letter model.
