Privacy Policy

posy (operated by posy; "we", "us") is a way to send flowers: you arrange a pot, write a few lines, and send it to someone you miss. This policy explains what we collect, why, how we protect it, and what you can do.

What we collect

• Your account: your email, the name you enter, interface language, time zone and region. You sign in with an email code or link; there's no password.
• If you sign in with Google or LINE: the email and name they provide. We store their user ID only as an irreversible hash, and we don't store their access tokens.
• Flowers you send: the recipient's email and name, your message, signature and delivery time, and what the pot looks like (flowers, pot, preview image).
• Flowers you receive: plants kept in your garden, where you placed them, and any note you leave for the sender.
• Payments: order amount, currency, payment method and Taiwan e-invoice details (mobile barcode, tax ID and company name, donation code). Card numbers are handled by our payment providers (PAYUNi, PayPal); we never see or store them.
• To prevent abuse: how often you send and sign in, and your IP address (for rate limits; reports store only a hash of the IP).
• Cookies: sign-in state, "remember me" and language. We don't use advertising or tracking cookies.
• Usage statistics: counted by account number only (for example, conversion rates), without names or emails.

An email address is required to sign in and deliver flowers; without one you can't sign in, send flowers or buy points.

Recipients

Recipients are third parties. A sender only provides the recipient's email and, optionally, a name and message. Recipients can view flowers without an account and can report flowers they don't want. For gifts nobody keeps, we erase the recipient's email one year after delivery.

How we use it

• To deliver the flowers you send, sign you in and keep flowers in your garden.
• To send the notifications you turn on (buds, blooms, reminders); every email has a one-click opt-out.
• To process payments, issue e-invoices and keep the transaction records the law requires.
• To prevent spam and abuse, handle reports and answer your emails.

We don't sell your data or use it for advertising. Delivery emails are transactional and contain no marketing.

How we protect it

• Personal data such as emails, names, messages, signatures and invoice details are encrypted in our database (AES-256-GCM), with keys kept separately from the data.
• Gift links and sign-in links are stored only as hashes; sign-in codes expire after 15 minutes and work once.
• The whole site uses HTTPS.
• Staff sign-in requires two-step verification, and viewing a full email or a reported message is logged.

Service providers

Site protection and bot checks (Cloudflare), payments (PAYUNi, PayPal), sign-in (Google, LINE), and our hosting provider, which also sends our emails. They process data only as needed to provide their service and may be located outside your country. Otherwise, we disclose data to authorities only when the law requires it.

How long we keep it

• Account data: until you delete your account.
• Orders and invoices: for as long as tax and accounting laws require.
• Staff activity logs: two years.
• After you delete your account, we keep a hash of your email (which can't be turned back into the email) so free allowances can't be claimed twice.

Your rights

You can ask to access, get a copy of, correct or delete your personal data, or ask us to stop processing it. In Settings you can download your data, change your name and notifications, choose whether senders can see the flowers in your garden, and delete your account. After deletion, flowers you sent stay in the recipient's garden, but your name is removed. For anything else, email hello@posy.darden and we'll respond within 30 days. If you're in the EU or UK, you can also complain to your local data protection authority.

Age

Please don't sign up or buy if you're under 13 (under 16 in the EU).

Changes to this policy

If we make significant changes, we'll post a notice on the site and update the date above.

Contact us

hello@posy.darden

Operator

Business name

posy

Email

hello@posy.darden