Privacy Policy

1. Privacy summary

• The Service uses guest checkout. It does not offer customer accounts, passwords, profiles, saved addresses, or account-based order history.
• Card orders retain minimal contact data in our database and send a card-free administrative receipt to Risee LLC’s private receipt archive. Cash receipts are stored privately in our database for administrators.
• Resend processes card-free order and contact details to email paid card confirmations to the purchaser and Risee Studio and to email cash-order notifications only to Risee Studio.
• Additional order and fulfillment information is processed only when needed to check eligibility, calculate fees and tax, create Stripe Checkout or a cash receipt, maintain a receipt, and fulfill the order.
• Card-payment and billing details are entered on Stripe’s hosted page. For a cash order, we record cash as the payment method and the amount due. Risee LLC does not receive or store full card numbers or security codes.
• The Service does not use advertising SDKs, sell personal information, share it for cross-context behavioral advertising, or track customers across unrelated apps or websites.
• The Service does not request precise GPS location.
• Staff may take order-condition and handoff photos. An authorized administrator may attach one photo to an order in private file storage; customer ordering does not request camera or photo-library access.

2. Information you provide

Guest checkout contact information

When you arrange delivery or pickup, you provide your name, email address, and phone number. Risee LLC stores those three contact fields with the order number to identify the order, provide communications, address payment or fulfillment issues, and provide customer support.

Basket and fulfillment information

Depending on your selections, the Service may process:

• Basket, flower, gift, quantity, and personalization selections
• An optional card message
• Delivery or pickup selection
• Requested fulfillment date and one-hour window
• Delivery street address, apartment or unit, city, state, and postal code
• Optional delivery instructions and pickup-location selection

This information is used to validate the order, calculate the delivery fee and tax, reserve limited inventory and capacity, create Stripe Checkout or a cash receipt, send transactional order emails, and fulfill the purchase. Cash order and fulfillment details are stored in a private administrator-only database receipt. A paid card receipt is sent to Risee LLC’s private receipt archive. Relevant card-order information is sent to Stripe and delivery address fields are sent to OpenRouteService/HeiGIT or, when it does not return a usable address match, the U.S. Census Bureau Geocoder.

If you provide information about a recipient or another person, you are responsible for having permission to provide it and for ensuring it is accurate. Do not place government identifiers, health or financial information, passwords, or other sensitive information in a card message or delivery instructions.

Support communications

If you contact Risee Studio, we may process your contact details, order number, message, attachments, and other information you choose to include. Do not send payment-card details or unnecessary sensitive information.

Order-condition and handoff photos

Staff may photograph a completed order before delivery or pickup and at delivery, pickup, or handoff. Photos document the order’s condition and completion and help review order issues. A photo may show the order, packaging, placement, and incidental surroundings. Staff should focus on the order and avoid faces, identification documents, private communications, and unrelated personal details when reasonably possible.

These photos are taken by staff outside the customer ordering flow. An authorized administrator may select one photo for an order receipt through the private administrator area. The image is re-encoded and stored under the order number in private file storage, accessible only to authorized administrators. It is not stored in the guest_orders table or publicly displayed. Customer ordering does not request camera or photo-library access.

3. Payment information

When card payment is selected, payment is made to Risee LLC, doing business as Risee Studio, through Stripe-hosted Checkout. Stripe may collect payment methods, billing information, email, transaction information, device or browser information, and fraud-prevention signals under its own privacy practices.

Risee LLC does not receive or store your full card number or card security code. We receive limited transaction results, such as a Checkout Session identifier and payment status, to confirm the order and update inventory and fulfillment availability.

Information sent to Stripe may include the purchased basket configuration, requested fulfillment information, delivery address, order contact name and phone number, delivery instructions, and optional card message. Stripe may retain it according to its agreements, legal obligations, and privacy policy.

When cash is selected, Stripe is not used and no card or billing details are collected in the app. The private cash receipt records cash as the payment method and the full amount due at delivery or pickup.

4. Information processed automatically

The app does not currently use third-party advertising, behavioral analytics, or crash-reporting SDKs. The customer app does not request device contacts, photos, camera, microphone, health data, or precise GPS location for ordering. Authorized administrators may select fulfillment photos in the private administrator area.

Hosting, payment, routing, app-store, and device-platform providers may automatically process IP addresses, device or browser type, operating system, request timestamps, service logs, and security or fraud-prevention information needed to operate and protect their services.

To limit automated abuse of guest services, the server temporarily converts the request network address into a one-way HMAC identifier before checking a request counter. Risee LLC does not store the raw network address in this counter, and the identifier is not used for advertising or cross-app tracking.

Administrator access and photos

Authorized administrators sign in through an approved identity provider and our protected administrator authentication service. The app keeps the resulting administrator session in secure device storage. This is not a customer-account feature.

Authorized administrators may sign in through GitLab. GitLab and our authentication provider process the verified email, account identifier and profile information needed for sign-in. This does not create customer accounts or grant access to GitLab repositories. GitLab handles its own login information under its Privacy Statement.

Authorized administrators may choose product photos through the device photo picker and upload them to public catalog image storage. Catalog photographs are publicly viewable and must not include customer or private fulfillment information. Separately, administrators may attach one order-condition or handoff photo to an order in private file storage. Only authorized administrators can view that image. Only selected photos are uploaded; customer shopping does not request photo-library access. The app does not offer camera or microphone capture. Catalog changes are recorded with the administrator user ID and time for security and business accountability.

5. How we use personal information

We use personal information only as reasonably necessary to:

• Provide, operate, maintain, and secure the Service
• Validate selections, prices, inventory, and availability
• Verify addresses and calculate delivery fees
• Process card payment through Stripe or document cash due at handoff
• Prepare, deliver, or make an order available for pickup
• Document order condition and delivery, pickup, or handoff
• Review damage, missing-item, incorrect-item, or fulfillment concerns
• Communicate about orders and respond to support requests
• Send transactional confirmations for paid card orders and business notifications for card and cash orders
• Prevent fraud, abuse, security incidents, and illegal activity
• Maintain required business, tax, accounting, and transaction records
• Comply with law and protect legal rights

Where applicable, processing is based on performing a transaction requested by you, complying with law, protecting legitimate business and security interests, or consent when legally required. We do not use Service information for targeted advertising.

6. No customer accounts

Customers cannot create an account, password, profile, saved-address collection, or account-based order history, so there is no account-deletion feature. You may still request access, correction, or deletion of personal information associated with a guest order. Deleting the app does not delete information already submitted.

7. Third parties and disclosures

• Database and hosting providers operate our protected database and server functions. For card orders, the guest-order table stores only the order number, purchaser name, email, and phone. For cash orders, a separate administrator-only table stores those contact fields and the receipt, including order and fulfillment details. A separate private file storage area may hold one administrator-selected order-condition photo per order, linked by order number and accessible only to allowlisted administrators. Operational records hold limited checkout, inventory, date/time, status, card-cancellation, refund-reference, approved-reason, and timestamp information. Private abuse-prevention counters contain only an endpoint category, a one-way HMAC network identifier, a request count, and timestamps; they do not contain the raw network address. These records contain no customer contact or card data. Our database does not store card numbers or security codes for Risee Studio.
• Stripe hosts card Checkout, processes card payment, helps prevent fraud, and returns payment status. See Stripe’s Privacy Policy.
• Risee LLC’s private receipt archive receives the purchaser name, email, phone, and a paid card-order receipt. It is restricted to administrators and does not receive card numbers, security codes, or Stripe payment-method details.
• Resend processes the purchaser’s name, email, phone, card-free order details, and message-delivery information to send transactional order emails. After a successful card payment, it sends separate confirmations to the purchaser and Risee Studio. For a cash order, it sends the order notification only to Risee Studio. It does not receive card numbers, security codes, or Stripe payment-method details. See Resend’s Privacy Policy.
• OpenRouteService/HeiGIT receives only partial or complete address fields needed for address suggestions, geocoding, and route calculation. It does not receive apartment or unit details, purchaser contact, payment details, recipient contact, card messages, delivery instructions, or basket contents for that calculation. See HeiGIT’s Privacy Policy.
• U.S. Census Bureau Geocoder receives only partial or complete street, city, state, and postal-code fields when OpenRouteService does not return a usable address match. It may return a standardized address, approximate coordinates, and county. It does not receive apartment or unit details, purchaser or recipient contact, payment details, card messages, delivery instructions, or basket contents. See the U.S. Census Bureau Privacy Policy.
• Microsoft Outlook processes email addresses, message content, attachments, and technical information when you contact us by email. See Microsoft’s Privacy Statement.
• Meta/Instagram may process account information, messages, attachments, and technical information when you contact us through Instagram. See Meta’s Privacy Policy.
• Telephone providers may process phone numbers, call time and duration, device or network information, and information needed to connect and protect an order-related call.
• Apple and Google may independently process download, device, diagnostic, or store-account information under their own policies.

Information may also be disclosed when legally required, to protect safety or rights, investigate fraud or security incidents, establish legal claims, complete a protected business transfer, or at your direction. Providers may process information for their own legally permitted compliance, fraud-prevention, and security purposes.

8. No sale or advertising sharing

Risee LLC does not sell personal information, share it for cross-context behavioral advertising, use it for targeted ads, or use automated profiling to make decisions with legal or similarly significant effects.

9. Retention and deletion

Personal information is retained only as long as reasonably necessary to complete and support orders, maintain required records, prevent fraud, resolve disputes, enforce agreements, and meet tax, accounting, or legal obligations.

Cash receipts in our database and card receipts in Risee LLC’s private receipt archive are retained as business and tax records with administrator-only access. They contain order and contact details but no payment-card numbers or security codes. We do not currently apply an automatic expiration date to these receipts. Unless an eligible deletion request is completed, they may be kept indefinitely, subject to business needs and legal obligations.

Abuse-prevention counters reset after their short request window. Inactive counter records become eligible for deletion after 24 hours and are removed when the protected service next processes a request.

Order-condition and handoff photos and related support communications are kept only as long as reasonably necessary to document fulfillment, review or resolve an issue, prevent fraud, establish or defend legal claims, and meet applicable recordkeeping obligations. No automatic photo-deletion schedule is configured. An original saved on an administrator’s device or photo-sync account is a separate copy.

When you request deletion, we verify your identity and review the request against active-order needs, retention obligations, disputes, and the Risee-controlled information involved. We take appropriate action on eligible personal information and confirm the outcome, including any information we must retain and why. Some transaction records and fulfillment photos may remain where necessary for the purposes and obligations described in this policy. Processing a request does not mean that every record associated with an order has been removed. Copies already sent by email, downloaded copies, and information held by independent providers may require separate handling.

Stripe, our database and hosting providers, Resend, OpenRouteService/HeiGIT, the U.S. Census Bureau, Microsoft, Meta, telephone providers, Apple, and Google may retain information under their own agreements, legal obligations, and privacy policies.

10. Your privacy choices and rights

Depending on where you live and subject to applicable exceptions, you may have the right to request that Risee LLC:

• Confirm whether we process personal information about you
• Provide access to or a copy of personal information
• Correct inaccurate personal information
• Delete personal information
• Restrict or object to certain processing
• Provide portable information where applicable
• Withdraw consent for future processing when consent applies
• Appeal a privacy-request decision where applicable

Email riseestudio@outlook.com and include the order number when the request concerns an order. Do not send card information. We may verify identity and authority and may retain information when legally permitted or required.

Because we do not sell personal information or share it for targeted advertising, no sale or targeted-advertising opt-out is currently needed for the Service.

11. Security

We use reasonable administrative, technical, and organizational safeguards, including limited database access, encrypted network connections where supported, server-side secrets, and Stripe-hosted payment. No transmission or storage system can be guaranteed completely secure. You are responsible for protecting access to your email, phone, device, and order number.

12. Children’s privacy

The Service is intended for a general adult audience and is not directed to children under 13. If we learn that we collected personal information directly from a child under 13 without legally sufficient authorization, we will take reasonable steps to delete it.

13. United States processing and international users

Risee LLC operates in Florida, United States, and the Service is intended for orders fulfilled in Risee Studio’s approved local service area. Information may be processed in the United States and other places where providers operate, where privacy protections may differ. Where required, legally recognized safeguards are used for international transfers.

14. Changes to this policy

We may update this policy when the Service, data practices, providers, or law changes. We will revise the “Last updated” date and provide additional notice when required. Material changes apply prospectively unless law permits otherwise.

15. Contact us

• Email riseestudio@outlook.com
• Instagram @risestudious

Do not send payment-card information or unnecessary sensitive information with a privacy request.