Privacy Policy

1. Who we are

Beth Bakes Cakes is a sole trader run by Beth Wardley, trading from Unit 17 Rose Centre, Rose Avenue, Nether Poppleton, York, YO26 6RX. We are the data controller for personal information collected through this website. If you have any questions about this policy or your data, contact us at beth@bethbakescakes.co.uk.

2. What we collect

• Orders and enquiries — your name, email address, phone number if you give one, billing address, and the details of your order, including any messages, images or design references you upload for a custom cake.
• Your account — your name, email address, order history, marketing preference and password. Passwords are stored in encrypted (hashed) form; we never see or store the actual password.
• Payments — all card payments are handled by Stripe. Your card details go directly to Stripe and never touch our systems; we only receive confirmation of payment and basic details such as the last four digits of the card.
• Technical data — standard server logs (such as IP address and browser type) used to keep the site secure and working. Vercel Web Analytics counts page visits without cookies and without identifying you. Google Analytics runs without cookies unless you accept optional cookies. If you accept them, Google Analytics and PostHog show us which pages you look at and what you tap or click, including recordings of how a page was used with anything you type hidden, so we can make the site easier to use.

3. How we use it, and our legal grounds

• To take, make and hand over your order, take payment, and email you about it — necessary to perform our contract with you.
• To run your account and let you view your order history — necessary to perform our contract with you.
• To reply when you contact us or make an enquiry — our legitimate interest in responding to you.
• To send you marketing emails — only with your consent, given at checkout or in your account settings. You can withdraw it at any time via the unsubscribe link or your account.
• To prevent fraud and keep the site secure — our legitimate interest in protecting the business and our customers.
• To see how the site is used so we can make it better: our legitimate interest for counting visits without cookies, and your consent, given through the cookie banner, for the optional analytics.
• To keep order and payment records — our legal obligations, for example for tax and accounting.

4. Who we share it with

We never sell your personal information. We share it only with the services that run this shop for us: Stripe (payment processing), Resend (sending order and account emails), Vercel and DigitalOcean (hosting the website and its data, and counting visits without cookies), and Google Analytics and PostHog (measuring how the site is used, as described above; PostHog keeps its data in the EU). Some of these providers are based in the United States; where data leaves the UK it is protected by UK-approved safeguards such as the UK extension to the EU–US Data Privacy Framework or standard contractual clauses. We may also share information where the law requires it.

5. How long we keep it

Order and payment records are kept for six years to meet tax and accounting rules. Your account, including any uploaded design images, is kept until you delete it or ask us to. Enquiries and messages are kept for as long as we need them to help you. When we no longer need information, we delete it.

6. Cookies

By default this site sets only the cookies and browser storage it needs to work: keeping you signed in, remembering your basket through checkout and remembering your cookie choice. Optional cookies (Google Analytics and PostHog) are only set if you choose "Accept all" on the cookie banner. If you choose "Essential only" they are never set, and you can change your mind at any time by clearing your browser cookies.

7. Your rights

Under UK data protection law you have the right to access a copy of your personal information, correct it, delete it, restrict or object to how we use it, take it with you in a portable format, and withdraw consent at any time where consent is the basis we rely on. To exercise any of these rights, contact us at beth@bethbakescakes.co.uk and we will respond within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

8. Changes to this policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "last updated" date.