Privacy Policy

Posy ("Posy", "we", "us") is a Canadian consumer flower gifting service operated from Vancouver, British Columbia. Our service is available at giftposy.com and through SMS at the phone numbers we publish on our website.

We collect only the information needed to run the service:

• Your phone number, used to sign you in and to send reminders, order confirmations, and other messages described in our SMS Terms.
• Your name (optional), used to personalize messages and orders.
• Names, relationships, addresses, and important dates of the people you add to your account, used to schedule reminders and route deliveries.
• Order history, including arrangement selection, gift messages, delivery dates, and payment status.
• Payment information, processed by Stripe. Posy does not store full card numbers; Stripe holds card data and we hold only a token reference to it.
• Operational metadata like IP address (hashed), user agent, and timestamps, used to keep your session secure and to detect abuse.

We use the information you give us only to:

• Send the SMS messages described in our SMS Terms.
• Schedule and dispatch your flower orders.
• Process payments and handle refunds.
• Improve the service (in aggregate, not by identifying you).
• Respond to your support requests.

We share information only with the third parties strictly necessary to deliver your order:

• The partner florist fulfilling your order receives the recipient's name, delivery address, the gift card message you wrote, and the arrangement details.
• The courier (Uber Direct) when an order is delivered: name, address, contact phone of the recipient.
• Stripe for payment processing.
• Twilio for SMS delivery (your phone number and the message body).
• Cloudflare, our infrastructure provider, which stores data on our behalf.

We do not sell, rent, trade, or otherwise transfer your information to third parties for their own marketing purposes.

We retain account data for as long as your account is active. If you ask us to delete your account, we remove your personal data within 30 days, except where law requires us to retain it (e.g., tax records for completed orders).

• Opt out of SMS: reply STOP to any Posy message. See our SMS Terms.
• Edit or delete people, occasions, or your account: through the app at app.giftposy.com, or by emailing support@giftposy.com.
• Request a copy of your data: email us and we'll provide an export within 30 days.

We transmit data over TLS, store sensitive credentials in Cloudflare's encrypted secrets store, and hash IP addresses associated with your session. Payment data never touches our servers. Stripe handles it directly.

Posy is not intended for use by anyone under 18. We do not knowingly collect personal information from children.

If we make a material change to this policy, we'll notify active users by SMS or email at least 14 days before the change takes effect.

Questions, requests, or complaints?
Email: privacy@giftposy.com