Privacy Policy

1. Who we are

This website is operated by Sugarloom Artisan Confections ("Sugarloom," "we," "us" or "our"), a small-batch candy kitchen located at 418 Orchard Bloom Avenue, Suite 2, Asheville, NC 28801, United States. We are responsible for the personal information collected through this website. You can contact us at any time at sugarloom.candyatelier@gmail.com.

This Privacy Policy applies to information collected through our website, including the contact form and the Flavor Finder, and through email correspondence with us. It does not apply to third-party websites that we link to.

2. Information we collect

Information you provide to us

• Contact and request details: your name, email address, the topic of your inquiry, the flavors you're interested in and the content of your message when you use our contact form or email us.
• Order and event details: if you request a tasting box or custom favors, we may ask for details such as event dates, quantities, and delivery or pickup preferences.
• Allergy information: if you tell us about food allergies so we can advise you, we use that information only to answer your request.

Our contact form does not transmit data to our servers. When you press "Send Message," your device's email app opens with your message pre-filled, and the message is delivered only if you choose to send it from your own email account.

Information collected automatically

• Device and log data: like most websites, our hosting provider automatically records technical information such as your IP address, browser type, device type, operating system, referring page, pages visited and the date and time of your visit. This information is used to deliver and secure the website.
• Cookies and local storage: we use an essential cookie to remember your cookie choices. With your consent, we may also use preference, analytics and advertising cookies, as described in Section 5.
• On-device interactions: your Flavor Finder answers are processed in your browser to show a recommendation and are not sent to us. If you allow preference cookies, your latest match and flavor filter are saved on your device only.

Information from third parties

If you reach our website through an online advertisement, such as a Google Ads campaign, and you have consented to marketing cookies, our advertising partners may provide us with aggregated reports about ad performance (for example, how many people clicked an ad). These reports do not identify you personally.

We do not ask for sensitive personal information such as financial or government ID details through this website. If you choose to share allergy details, we treat them as sensitive and use them only to respond to you.

3. How we use your information

• To respond to your questions and requests, including tasting box requests, custom favor quotes and allergen questions;
• To arrange, confirm and fulfill orders that you choose to place with us by email;
• To operate, maintain and secure the website, including preventing spam and abuse;
• To understand how visitors use our pages and improve our content (only with analytics consent);
• To measure the effectiveness of our advertising, such as Google Ads campaigns (only with marketing consent);
• To comply with legal obligations and enforce our Terms of Use.

We will not send you marketing emails unless you have asked to receive them, and every marketing email will include a simple way to unsubscribe.

4. Legal bases for processing (EEA and UK visitors)

If you are located in the European Economic Area or the United Kingdom, we process personal information only when we have a legal basis to do so:

• Consent – for optional cookies, for allergy details you choose to share and for marketing communications. You can withdraw your consent at any time.
• Contract – to take steps at your request before you place an order and to fulfill that order.
• Legitimate interests – to respond to general inquiries, keep the website secure and improve our services, where these interests are not overridden by your rights.
• Legal obligation – to keep business and tax records and to respond to lawful requests from authorities.

5. Cookies and similar technologies

Cookies are small text files that your browser stores on your device. We also use your browser's local storage, which works in a similar way. We group these technologies into four categories:

Analytics and marketing tools are switched off by default and run only after you give consent through our cookie banner. If you withdraw consent, we stop using these cookies and the site attempts to delete the ones it set.

Managing your choices

You have not made a cookie choice on this device yet.

Change cookie settings

You can also block or delete cookies in your browser settings, although blocking essential cookies may affect how the site works. To opt out of Google Analytics on all websites, you can install the Google Analytics opt-out browser add-on. We honor Global Privacy Control signals as a request to opt out of marketing cookies. Because there is no common industry standard for "Do Not Track" signals, we do not currently respond to them.

6. Advertising and Google Ads

We may use Google Ads to show advertisements for our candy on Google Search and partner websites. If you consent to marketing cookies, Google may use cookies to measure whether people who click our ads go on to contact us, which helps us understand campaign performance.

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. On this website, these cookies are used only if you have given consent.

You can opt out of personalized advertising by visiting Google Ads Settings, and you can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You may also opt out of some third-party vendors' use of cookies for personalized advertising at optout.aboutads.info or, in Europe, at youronlinechoices.eu.

7. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising without your consent. We share information only in these situations:

• Service providers that help us run our business, such as our website hosting provider and our email provider (Google, which provides Gmail). They may process information only on our behalf and under appropriate confidentiality and security obligations.
• Analytics and advertising partners, such as Google, only if you have consented to the relevant cookies.
• Delivery partners, if you order products for delivery, so they can deliver your package.
• Legal and safety reasons, when required by law or to protect the rights, property or safety of Sugarloom, our customers or others.
• Business transfers, if our business is sold or merged, in which case your information would remain protected by the commitments in this policy.

8. Data retention

We keep personal information only for as long as we need it for the purposes described in this policy:

• Inquiries and email correspondence: up to 24 months after our last contact, unless you ask us to delete them sooner.
• Order records: up to 7 years, to meet tax and accounting requirements.
• Server log data: typically up to 90 days, unless needed longer to investigate a security issue.
• Cookie consent record: 6 months, after which we ask for your choice again.

9. Data security

We use reasonable administrative, technical and physical safeguards to protect personal information, including encrypted (HTTPS) connections, strong passwords and two-factor authentication on our accounts, and access limited to the people who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy;
• Correct inaccurate or incomplete information;
• Delete your personal information;
• Restrict or object to certain processing, including direct marketing;
• Receive your information in a portable format;
• Withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To exercise any of these rights, email us at sugarloom.candyatelier@gmail.com with the subject line "Privacy request." We may need to verify your identity before responding, and we aim to respond within 30 days. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data protection authority.

11. U.S. state privacy rights

Residents of California and other U.S. states with comprehensive privacy laws, such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, may have additional rights. These can include the right to know what personal information we collect, use and disclose; to request deletion or correction; to opt out of the sale or sharing of personal information and of targeted advertising; and not to be discriminated against for exercising these rights.

We collect the categories of personal information described in Section 2 – identifiers such as your name and email address, internet activity information and preferences such as flavors you're interested in – for the purposes described in Section 3. We do not sell personal information, and we do not knowingly sell or share the personal information of consumers under 16. You can opt out of marketing cookies at any time through Cookie Settings or by enabling Global Privacy Control in your browser. You may use an authorized agent to submit a request on your behalf, and you may appeal our decision by replying to our response email.

12. Children's privacy

Our website is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If you believe a child has provided us with personal information, please contact us and we will delete it.

13. International data transfers

We are based in the United States, and our service providers may process information in the United States and other countries. If you are located outside the United States, your information may be transferred to countries with different data protection laws. Where required, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or our providers' certification under the EU-U.S. Data Privacy Framework.

14. Third-party links

Our website may link to third-party websites and services, such as Google Maps or government resources. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page and, if the changes are significant, provide a more prominent notice on our website.

16. Contact us

If you have questions about this Privacy Policy or how we handle your information, please get in touch: