Privacy Policy

What We Collect

Order information

Your name, shipping address, billing details, and email. We collect only what is needed to fulfill your order and contact you about it.

Payment information

Payments are processed by Stripe. Your full card number is encrypted in transit, handled directly by Stripe, and never stored on our servers.

Site analytics

We use privacy-respecting analytics to understand which pages are most useful. This includes page views, country, referring site, and device type. No cross-site tracking and no advertising profiles are built from this data.

How We Use It

• To process, pack, and ship your order.
• To email you a tracking number and shipping confirmation.
• To respond if you contact us with a question.
• To improve the site and understand which content is most helpful to growers.

What we do not do

• We do not sell customer data.
• We do not share customer data with third parties beyond what is needed to process and ship your order (payment processor, shipping carrier).
• We do not run retargeting ads or build advertising profiles.

Third-Party Services

We use a small number of trusted third-party services to operate the site. Each handles only the data needed to do its job.

Stripe (payments)

Stripe processes all payments. Card details are entered directly into Stripe's secure form and never pass through our servers. Stripe's privacy policy is available at stripe.com/privacy.

Cloudflare (hosting and DDoS protection)

The site is hosted on Cloudflare Pages. Cloudflare logs basic request information (IP address, timestamp, request path) for security and abuse prevention. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.

Google Analytics

We may use Google Analytics 4 to measure site usage. IP addresses are anonymized. No personally identifiable information is sent to Google. You can opt out using the Google Analytics opt-out browser add-on.

Cloudflare Web Analytics

We use Cloudflare's privacy-first analytics, which does not use cookies and does not track individuals across sites.

Lonesmith Dashboard

An anonymous, cookie-free visit beacon used by the site's builder (Lonesmith) to monitor uptime and basic traffic patterns across its sites. No personally identifiable information is collected.

USPS, UPS, and FedEx

Carriers receive the shipping name and address needed to deliver your order.

Cookies and Tracking

We use a minimal set of cookies and storage. They fall into three categories:

• Essential cookies set by Stripe during checkout so payment and fraud detection work correctly. These cannot be disabled and the site cannot complete an order without them.
• Analytics cookies set by Google Analytics, if enabled. These help us understand which pages are most useful. IP anonymization is on.
• Local storage used only to remember your accepted cookie preferences and any in-progress site state.

Visitors in the EU, UK, and Switzerland are shown a Google-certified consent management banner that lets them accept or reject non-essential cookies before they load.

Your Rights

GDPR (European Union and United Kingdom)

If you live in the EU or UK, you have the right to access the personal information we hold about you, correct it, request that we delete it, restrict how we process it, object to processing, and request that we transfer it to another service. To exercise any of these rights, email [email protected]. We will respond within 30 days.

CCPA (California)

California residents have the right to know what personal information we collect, request that we delete it, and opt out of any sale of personal information. We do not sell personal information. To exercise your rights, email [email protected] with the subject line "CCPA Request."

Everyone else

Regardless of where you live, you can request a copy of any personal information we hold about you, ask us to correct it, or ask us to delete it by emailing [email protected].

Children's Privacy (COPPA)

WingedSumac.com is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact [email protected] and we will delete it.

Changes to This Policy

We may update this policy periodically. Material changes will be reflected on this page and dated. Continued use of the site after a change means you accept the updated policy.

Privacy Contact

Questions about this policy or about how we handle your data? Email [email protected] with the subject line "Privacy Question."

Last updated: May 2026