Who we are
Treatsome provides software that home bakers use to take preorders. This policy covers treatsome.com (its shop pages, checkout, order pages and the baker panel) and the emails we send. “Treatsome”, “we” and “us” mean the operator of Treatsome.
When you order, two businesses handle your information: Treatsome, which runs the platform, and the baker, who sells you the food. This policy explains what Treatsome does. The baker is an independent business and is responsible for what they do with your details outside Treatsome.
Our Terms of Service explain the rules for using Treatsome.
What we collect
When you order (buyers)
- Contact details: your name and email address, and your phone number if you choose to give it.
- How you get your order: pickup, porch pickup or delivery, the time you choose and, only if you choose delivery, your delivery address.
- Your order: what you ordered, the prices, the Service fee, any delivery fee, tip and sales tax, your order number and status, and any refunds.
- Payment status from Stripe: whether your payment succeeded, the kind of payment method (for example, card or Apple Pay) and Stripe’s reference numbers. Not your card number: that goes straight to Stripe.
- Checkout security: your IP address and a random device code, stored with your checkout to prevent abuse and keep one checkout per browser.
- Emails we send you: a record of each one (which email, to which address, and whether it was sent).
We don’t ask for sensitive information such as health information. If you order for someone else, make sure they’re happy for you to give us their name and address.
When you run a shop (bakers)
- Your account: name, email address and password (stored only as a secure hash), and whether you’ve confirmed your email.
- Your shop: its name, web address and time zone; your products, photos, prices, preorders, pickup times and locations, delivery zones and shop design.
- Your cottage food details: your operation name and address, any state registration and its ID, your food handler training date, your label settings, and when you acknowledged our compliance notes. Some of this appears to buyers where the law requires it, for example your operation name on your shop and the details on your labels.
- Your payments setup: your Stripe account ID, whether card payments and payouts are on, what Stripe still needs from you, and your fee and tip settings. Stripe collects your identity and bank details itself; we don’t store them.
- Activity records: a log of significant actions in the baker and admin panels (for example, changing your shop’s name or web address), with the IP address and browser used.
When you join the waitlist
- Your waitlist details: your name and email address; your bakery or business name, your city or town and what you bake, if you choose to tell us; and when you joined. If we invite you, we also keep when we did and the sign-up invitation we sent.
Automatically, from everyone
- Server logs: when your browser asks for a page, our hosting provider records your IP address, the page, your browser type, the time and our response. We use them to keep Treatsome running and secure.
- Sessions: while you have a session (during checkout, or while signed in to the baker panel), our database stores it with your IP address and browser type.
How we use it
- To take and fulfill your order: holding your items while you pay, taking payment through Stripe, giving your order to the baker and showing you your order page.
- To send emails about your order or account: order confirmations, sold-out and cancelled-preorder notices, refund receipts, new-order alerts to bakers, and account emails (email confirmation, password reset and invitations).
- To tell you when a spot opens: if you join the waitlist, we use your details to decide who to invite next and to email you your invitation.
- To keep Treatsome safe and working: preventing fraud and abuse, keeping activity records, and finding and fixing problems.
- To meet legal obligations: keeping records, responding to lawful requests and enforcing our terms.
We don’t sell your personal information, show ads, use third-party analytics or tracking, or build profiles about you. We don’t make automated decisions about you that have legal or similarly significant effects.
Marketing: Treatsome doesn’t send marketing emails or text messages. Text messages: Treatsome doesn’t send texts today; if you give your phone number, it goes to the baker so they can reach you about your order. If we add order updates by text, we’ll ask for your separate consent at checkout (it will never be a condition of buying), and you’ll be able to reply STOP at any time.
How long we keep it
- Orders and the details that go with them are kept for 7 years after the order, so bakers can meet their tax and record-keeping obligations, and then deleted or de-identified. Details from checkouts that didn’t become orders are kept no longer.
- Baker accounts and shops are kept while the account is open. After an account is closed, we delete or de-identify its information within a reasonable time, apart from order records (kept as above) and anything the law requires us to keep.
- Waitlist details are kept while you wait and, once you sign up, for as long as your account is open. You can ask us to delete them at any time (see Your choices and rights below).
- Server logs are kept for about 30 days.
- Backups of our database are kept for 7 days, so deleted information can remain in a backup for up to that long.
How we protect it
- Every page is served over an encrypted connection (HTTPS).
- Card details go straight to Stripe and never reach our servers.
- Passwords are stored only as secure hashes.
- Each shop’s data is kept separate from every other shop’s, and automated tests check that it stays that way.
- An order page opens only in the browser that placed the order, or through the private link in its confirmation email.
- Access to our systems is limited to the people who run Treatsome, and significant admin actions are logged.
No system is perfectly secure. If a security breach affects your personal information, we’ll tell you as the law requires.
Children
Treatsome isn’t directed at children under 13, and we don’t knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email support@treatsome.com and we’ll delete it.
Your choices and rights
You can ask us to:
- tell you what personal information we have about you, and give you a copy;
- correct information that is wrong;
- delete your information.
Email support@treatsome.com, ideally from the address you used for your order or account. We may ask for details to confirm it’s you. We’ll respond within 45 days. Sometimes we need to keep some information, for example order records a baker needs for taxes or to resolve a dispute; if so, we’ll tell you.
For information a baker keeps outside Treatsome, contact the baker directly. We’re happy to pass your request on.
The emails we send are about your order or account, so there is nothing to unsubscribe from. Bakers can close their account by emailing us.
Texas residents
Where the Texas Data Privacy and Security Act applies to our handling of your information, you have the right to:
- confirm whether we process your personal data, and access it;
- correct inaccuracies in it;
- delete personal data you gave us or that we obtained about you;
- get a copy of it in a portable, readily usable format;
- opt out of the sale of your personal data, targeted advertising and profiling that has significant effects (we don’t do any of these).
To use these rights, email support@treatsome.com. We’ll respond within 45 days; if we need more time, we’ll tell you why, and we may extend that once by up to 45 more days. If we decline your request, you can appeal by replying to our answer with “Appeal” in the subject line. We’ll respond to an appeal within 60 days, and if we deny it, you can contact the Texas Attorney General.
We won’t treat you differently for using any of these rights. We don’t process sensitive data as the Act defines it.
Where your information is stored
We store and process information in the United States. If you use Treatsome from outside the US, your information is transferred to and handled in the US.
Changes to this policy
We may update this policy. We’ll post the new version here with a new “Last updated” date and, for significant changes, tell bakers by email before they take effect.
Contact us
Questions or requests about your information? Email support@treatsome.com.