Citron Cadeau Privacy Policy

Effective date: October 28, 2026

This Privacy Policy explains how Citron Cadeau LLC, a Florida limited liability company ("Citron Cadeau," "we," "us," or "our") collects, uses, and shares personal information when you visit citroncadeau.com (the "Site"), place an order, sign in to your account, or send us a corporate inquiry. It also explains the choices and rights you have.

1. Information we collect

Information you give us when you order

• Your contact details: your email address and name.
• Your billing address. This is entered with our payment processor, Stripe, at checkout.
• Payment details. Card and wallet details are entered directly with Stripe. We do not receive or store your full card number.
• Recipient details: the name and delivery address of the person you are sending a gift to, or your own if you are ordering for yourself.
• Your gift note: the message, up to 100 words, that we print and place inside the box.
• Order details: the boxes you ordered, quantities, prices, any promotional code used, order number, order status, refunds, and shipment tracking details.

Information you give us when you sign in

• Your email address. When you ask for a sign-in link, we record your email address and a secured (hashed) copy of the single-use link we send you, and we create an account record linked to that email address.

Information you give us in a corporate inquiry

• Your name, work email, and company.
• Your phone number, if you choose to give it.
• How many gifts you have in mind, the date they should arrive, the occasion, the boxes you like, how they should be delivered, and whether your company is tax exempt.
• The note you write describing what you have in mind.
• Any file you attach, such as your company logo or a list of recipients. A recipient list will contain the names and addresses of the people you would like us to send gifts to.

Information collected automatically

• Essential cookies. When you sign in, we set two cookies: a secure session cookie (cc_session) that keeps you signed in, and a companion cookie (cc_signed) that tells the Site you are signed in. Both last up to 30 days unless you sign out. We do not use advertising or third-party analytics cookies.
• Storage in your browser. We keep the contents of your bag and your draft gift note in your browser's local storage, so they are still there when you return. During checkout and sign-in we use session storage, which clears when you close the tab, to hold your checkout session and the email address you entered.
• Site activity. We record a small number of events on our own servers: which pages are viewed, which boxes are added to the bag, when a checkout begins, and when a purchase completes. Page views and additions to the bag are recorded without your name, email address, or IP address. Checkout and purchase events are linked to an order number.
• Device and connection information. Our servers receive your IP address and browser information when you use the Site. We use your IP address briefly to limit repeated requests and to protect our forms from spam. We do not store it with your account or order.
• Information collected by our providers. On the checkout pages, Stripe's payment form collects device and payment information to process your payment and help prevent fraud. On the corporate inquiry form, Cloudflare Turnstile collects device and browser signals to tell people from automated traffic. These providers handle that information under their own privacy policies.

We do not knowingly collect sensitive personal information, such as government identification numbers or health information. Please do not include such information in a gift note or inquiry.

2. How we use information

We use personal information to:

• process, prepare, and deliver your order, including sending your gift and gift note to the recipient;
• take payment, issue refunds, and prevent fraud;
• send you service messages about your order, such as a confirmation, a shipping notice with tracking, and a delivery notice, and send you sign-in links when you ask for them;
• let you view your gifts and orders when you are signed in, and prepare a repeat order when you ask;
• respond to corporate inquiries, prepare proposals, and fulfil corporate orders;
• answer your questions and handle reports of items that arrive damaged, wrong, or missing;
• understand, in aggregate, how the Site is used, so that we can improve it;
• keep the Site secure and protect it from spam and abuse; and
• meet our legal, tax, and accounting obligations, and enforce our Terms of Sale.

3. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows:

• Payment processing: Stripe, Inc., which processes payments, refunds, and fraud checks.
• Shipping carriers: the carrier that delivers your box receives the recipient's name and delivery address.
• Hosting and infrastructure: Cloudflare, Inc., which hosts the Site, sends our email (Cloudflare Email Service), stores files attached to corporate inquiries (Cloudflare R2), provides spam protection on our forms (Cloudflare Turnstile), and measures site visits through Cloudflare Web Analytics, without cookies and without identifying you.
• Database hosting: Neon, which hosts the database that holds orders, accounts, and inquiries.
• Professional advisers, such as accountants and lawyers, where needed.
• Legal and safety reasons, where required by law or legal process, or to protect the rights, property, or safety of our customers, recipients, us, or others.
• Business transfers, in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this Policy.

Our providers may use personal information only to provide their services to us, except where their own privacy policies apply to information they collect directly, as described in section 1.

4. A note for gift recipients

If someone has sent you a Citron Cadeau gift, we received your name and delivery address, and any note they wrote to you, from the person who placed the order. We use your information only to deliver the gift and handle any issue with its delivery. We share it only with the carrier and the providers described above. We do not send you marketing, and we do not create an account for you. To ask about or request deletion of your information, write to us at privacy@citroncadeau.com.

If you are sending a gift or a recipient list, please share only the details needed for delivery, and only where you are entitled to do so.

5. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this Policy, including to fulfil and support your order, to meet legal, tax, and accounting requirements, to resolve disputes, and to enforce our agreements. When we no longer need it, we delete it or keep it in a form that no longer identifies you. In general:

• order and payment records: for as long as needed for the purpose described, and then deleted or anonymized;
• gift notes and recipient names and addresses: for as long as needed for the purpose described, and then deleted or anonymized, after which they are removed or minimized;
• account records: until you ask us to delete them, or for as long as needed for the purpose described, and then deleted or anonymized;
• sign-in links expire after 15 minutes and signed-in sessions after 30 days, and the related records are deleted after for as long as needed for the purpose described, and then deleted or anonymized;
• corporate inquiries and attached files, including recipient lists: for as long as needed for the purpose described, and then deleted or anonymized;
• site activity events: for as long as needed for the purpose described, and then deleted or anonymized.

6. Security

We take reasonable measures to protect personal information. Payment details are handled by Stripe. Sign-in links and session identifiers are stored only in hashed form, session cookies are secure and not readable by page scripts, and files attached to corporate inquiries are available only through time-limited, signed links. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Children

The Site is intended for adults 18 and over. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, please contact us and we will delete it.

8. Your choices

• You can sign out at any time, which removes your session and clears the sign-in cookies.
• You can clear your bag and gift note by clearing your browser's storage for the Site.
• You can ask us to access, correct, or delete your information by contacting us as described below.

Do Not Track. The Site does not use tracking technologies across other websites, and it does not respond differently to Do Not Track browser signals.

9. Your US state privacy rights

Depending on where you live, you may have the right to:

• know what personal information we have collected about you and how we use and share it, and receive a copy;
• correct inaccurate personal information;
• delete personal information we hold about you;
• opt out of the sale of personal information, targeted advertising, or certain profiling (we do not do these things); and
• not be treated differently for exercising these rights.

To make a request, write to privacy@citroncadeau.com. We will need to confirm your identity, usually by asking you to confirm control of the email address associated with your order or account. You may use an authorized agent, who must show us your signed permission. If we decline your request, you may appeal by replying to our decision, and we will respond within the time required by law. If your appeal is denied, you may contact your state attorney general.

Notice for California residents

This section supplements the Policy for California residents, as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Notice at collection. In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described in sections 1 and 2:

We do not collect sensitive personal information as defined by California law for the purpose of inferring characteristics about you. Payment card details are entered with Stripe and are not received by us.

Sale and sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.

Retention. We keep each category for the periods described in section 5.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

10. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy on the Site with a new effective date, and where changes are significant, we will take reasonable steps to let you know.

11. Contact us

Citron Cadeau LLC

Privacy requests: privacy@citroncadeau.com

Orders and other questions: concierge@citroncadeau.com