Privacy Policy

2.1 Information You Provide Directly

When you create an account, use our Service, or contact us, we may collect the following categories of personal information:

• Account information: email address and password (stored as a secure hash; we never store plain-text passwords).
• Event details: event type, theme preferences, color choices, budget estimates, and guest count that you enter into our intake form to generate AI design concepts.
• Canvas design data: design elements, layouts, and configurations you create in our Canvas Studio editor.
• Uploaded images: photos or graphics you upload to the Canvas Studio for use in your designs (stored in private cloud storage linked to your account).
• Payment information: billing details processed by Stripe, Inc. We do not store credit card numbers, CVVs, or full payment card data on our servers. All payment data is handled exclusively by Stripe.
• Communications: any messages, support requests, or feedback you send to us.

2.2 Information Collected Automatically

When you visit or use our Service, we automatically collect certain technical information:

• Log data: IP address, browser type and version, operating system, referring URLs, pages visited, time and date of access, and time spent on pages.
• Device information: device type, screen resolution, and unique device identifiers.
• Usage data: features you use, buttons you click, AI generations you initiate, and how you interact with the Canvas Studio.
• Session data: session duration and navigation paths within the application.
• Account generation usage: when you are signed in, we track AI concept generation usage server-side on your account (for example, credits used against your subscription tier). This metering applies only after you create an account, since AI concept generation requires registration.

2.3 Browser Storage (localStorage and sessionStorage)

In addition to cookies, we use your browser's local storage and session storage for product functionality. AI concept generation requires a registered account; we do not use browser storage to meter anonymous AI generations.

2.4 Information From Third Parties

We may receive limited information from the following third-party services you connect or that we use to operate the Service:

• Supabase (authentication provider): if you sign in via a third-party OAuth provider (e.g., Google), we receive only the information that provider shares with us, such as your name and email address.
• Stripe (payment processor): we receive transaction confirmation data, subscription status, and non-sensitive billing information (such as last-4 card digits) to manage your account credits.

4.1 How We Use Artificial Intelligence

Poppy Blum uses artificial intelligence to power its core features. Below is a full and transparent description of which AI systems process your data, what data they receive, and how that data is handled.

4.2 Zero Training Data Policy

Specifically:

• Third-party AI providers: Concept text, hero imagery, and canvas AI features are generated through third-party AI providers under their standard commercial API terms. Under those terms, these providers do not use API inputs or outputs to train their models by default. Your prompts exclude email, payment data, and account identifiers.
• Retail & tutorial search: Search queries sent to our search provider contain only product or tutorial keyword strings. No user identity or account data is included in these queries.

4.3 No Automated Decision-Making With Legal Effect

Poppy Blum does not use automated processing (including AI) to make decisions about you that produce legal or similarly significant effects. AI is used solely to generate creative design output based on preferences you provide. You retain full control over whether to use, modify, or discard any AI-generated content.

5.1 Service Providers

We share personal data with a limited set of third-party service providers who help us operate the Service. All service providers are contractually required to use your data only as directed by us and in accordance with this Privacy Policy.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (such as a court order or government agency), or when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation;
• Protect and defend our rights or property;
• Prevent or investigate possible wrongdoing in connection with the Service;
• Protect the personal safety of users or the public.

5.3 Business Transfers

If Poppy Blum is involved in a merger, acquisition, asset sale, or similar transaction, your personal data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different Privacy Policy.

5.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

8.1 What We Use

Poppy Blum uses the following tracking technologies:

8.2 Advertising and Marketing

We advertise Poppy Blum on other platforms. With your consent, we load Google Tag Manager, which delivers conversion tags for Meta (Facebook / Instagram), Google Ads, and Pinterest. These tags let us measure whether a signup followed one of our ads, and the providers may use them to attribute conversions and personalize ads to you on their own platforms and partner sites.

Two things must both be true before any advertising cookie is set: advertising must be switched on for the Service, and you must choose Accept all in our cookie banner. If either is not true, including any period when we are not running ads, nothing is loaded and no advertising cookie is set. Choosing Reject all keeps them off entirely, and you can change your choice anytime via Cookie settings in the site footer. We disclose these providers in advance so this policy is accurate before, not after, we begin advertising.

What we send them: a sign-up conversion event after you confirm your email address. We do not send your event designs, canvas boards, shopping lists, or payment details to any advertising provider, and we do not sell your personal data. For a provider-by-provider list and opt-out links, see our Cookie Policy.

8.3 Managing Your Preferences

You can control cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when cookies are set. Note that disabling authentication cookies will prevent you from logging in to the Service. For a cookie-by-cookie list and opt-out instructions, see our Cookie Policy.

We honor the Global Privacy Control (GPC) signal. If your browser or extension sends GPC, we treat it as a rejection of all optional cookies: analytics and advertising tags stay off, and we do not show you the cookie banner, because you have already told us your answer. GPC also overrides an earlier acceptance made in our banner, since the newer signal is the more recent instruction. See globalprivacycontrol.org.

9.1 Rights Available to All Users

• Right to Access: request a copy of the personal data we hold about you.
• Right to Correction: request that we correct inaccurate or incomplete data.
• Right to Deletion: request that we delete your personal data. Note that we may retain certain data where required by law (e.g., payment records).
• Right to Data Portability: request your data in a structured, machine-readable format.
• Right to Withdraw Consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

9.2 EU / UK Users: GDPR Rights

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right to Object: object to processing of your data based on legitimate interests or for direct marketing purposes.
• Right to Restrict Processing: request that we limit how we use your data in certain circumstances.
• Right to Lodge a Complaint:you have the right to lodge a complaint with your local supervisory authority (e.g., the Information Commissioner's Office in the UK, or your national Data Protection Authority in the EU).

Our lawful bases for processing under GDPR are: (a) Contract, processing necessary to provide the Service you requested; (b) Legitimate Interests, analytics and security; (c) Legal Obligation, financial record retention; (d) Consent, marketing communications.

9.3 California Users: CCPA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: the right to know what personal information we collect, use, disclose, and sell.
• Right to Delete: the right to request deletion of your personal information.
• Right to Opt-Out of Sale: we do not sell your personal information. If that changes, we will notify you and provide an opt-out mechanism. We honor the Global Privacy Control signal as an opt-out request (see Section 8.3), and you can opt out anytime via Cookie settings in the site footer.
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.
• Right to Correct: the right to correct inaccurate personal information.

To exercise CCPA rights, contact us at hello@poppyblum.comwith the subject line “CCPA Request.” We will respond within 45 days as required by law.

9.4 Canadian Users: PIPEDA Rights

If you are located in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA):

• Right to Access: request access to your personal information held by us.
• Right to Correction: challenge the accuracy and completeness of your information.
• Right to Complaint: file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

Poppy Blum is the organization accountable for personal information under its control. Our designated privacy contact is reachable at hello@poppyblum.com.

9.5 How to Exercise Your Rights

To submit any privacy rights request, email us at hello@poppyblum.comwith the subject line “Privacy Rights Request” and specify the right you wish to exercise. We will verify your identity before processing the request and respond within 30 days (or the timeline required by applicable law).