Privacy Policy

This policy explains how Sweet Oaks Bakery (“Sweet Oaks,” “we,” “us,” or “our”) handles personal information through sweetoaksbakery.com and related online ordering, memberships, events, parties, careers, gift cards, and fundraising services.

Sweet Oaks Bakery is the business responsible for this information. Our principal contact location is 383 North Mayo Trail, Paintsville, Kentucky 41240.

Depending on the service used, we may collect:

• Account and contact information: name, email, telephone number, authentication identifiers, and account preferences.
• Order and transaction information: products, amounts, discounts, pickup or delivery details, order status, Square transaction identifiers, and refund history. Square processes full payment-card details; Sweet Oaks does not receive or store the full card number.
• Membership, party, and safety information: child name, age group or birth date when needed, parent or guardian details, emergency contacts, signed waivers, signature name, signature date, and signature IP address.
• Fundraising information: organization and applicant details, campaign details, participant name, a privacy-limited public display name, guardian contact information and consent, purchaser details, and order attribution.
• Career information: application answers, contact information, résumé, cover note, and hiring communications.
• Communications: messages sent to us and transactional email delivery records.
• Limited technical and security information: request IP address when needed for fraud prevention, rate limiting, or electronic-signature records; error type; page URL; browser or device type; and security logs.
• Information stored only on your device: cart contents, a saved delivery address, and temporary order-access tokens may be stored in browser storage for convenience and checkout continuity.

We receive information from you, an authorized parent or guardian, an organization coordinator, or service providers that help complete a requested transaction. Please do not provide sensitive information we do not request.

• Provide accounts, orders, delivery, memberships, parties, events, gift cards, and fundraiser services.
• Process payments, issue receipts, prevent duplicate or fraudulent transactions, and maintain accounting records.
• Administer waivers, check-in, emergency and safety procedures, and guardian-authorized participation.
• Review fundraising and employment applications and communicate about them.
• Send transactional messages requested by, or necessary for, a purchase, account, booking, campaign, or application.
• Secure, debug, and maintain the service; enforce our terms; and comply with tax, accounting, safety, and other legal obligations.

We do not use child or guardian information for targeted advertising. We do not make decisions producing legal or similarly significant effects through automated profiling.

Because Sweet Oaks serves families, an adult parent, legal guardian, or authorized organizer may provide limited information about a child for a Play Pass, waiver, party, check-in, or fundraiser. We use that information only for the requested service, safety, private administration, and privacy-limited fundraiser attribution.

• Fundraiser participants are publicly shown by first name and last initial by default—not full surname, email, phone number, birth date, or address.
• We require the organizer to confirm parent or guardian authorization before adding a participant.
• We do not contact a child directly or ask a child for an email address or telephone number.
• We do not knowingly use analytics, behavioral advertising, or session replay to track children.

A verified parent or guardian may ask to review, correct, delete, or stop further use of a child’s information by emailing melissa@sweetoaksbakery.com with the subject “Child Privacy Request.” We will verify the requester’s authority before disclosing or deleting information. Some records may be retained when legally required or necessary to resolve a transaction, safety matter, or dispute.

We use essential authentication and security technologies needed to sign users in, prevent abuse, maintain a checkout, and process payments. Browser storage used for carts or saved addresses remains on the device until it expires or the user clears it.

Optional product analytics and session replay are disabled. We do not currently use cross-site behavioral advertising cookies. Limited error reports may be sent to our error-monitoring provider, but session replay, performance tracing, logs, cookies, request bodies, and default personal identifiers are disabled or removed before transmission.

If we later introduce nonessential analytics, targeted advertising, or materially different tracking, we will update this policy and provide any notice or choice required before enabling it.

We disclose only what is reasonably necessary to service providers working for us, or when required for safety or law. Current provider categories include:

• Square: payment processing, transaction records, subscriptions, and gift cards.
• Clerk: authentication and account security.
• Resend: transactional email delivery.
• Cloudinary: authorized document and image storage.
• Database and hosting providers: secure application hosting and record storage.
• Sentry: minimized error reports without session replay or default PII.
• Professional advisers, insurers, authorities, or a business successor: only when reasonably necessary and permitted by law.

Fundraiser organizers may receive purchaser and fulfillment information needed to distribute orders. They do not receive full payment-card data. We do not sell personal information or share it for cross-context behavioral advertising.

We retain information only for as long as reasonably necessary for the purpose collected, including active accounts and services, order fulfillment, safety administration, fraud prevention, tax and accounting requirements, legal claims, and required audit records. Retention varies by record type.

Child and participant details are reviewed after the related membership, waiver, party, or campaign is complete and are deleted or de-identified when no longer needed for that purpose or a legal obligation. Payment and transaction records may be kept longer for accounting, tax, chargeback, and fraud-prevention requirements. Backup copies may remain for a limited period until overwritten through normal backup cycles.

Subject to applicable law and appropriate identity verification, you may request confirmation of processing, access, correction, deletion, or a portable copy of personal information. You may also withdraw consent where processing relies on consent.

Sweet Oaks does not sell personal information, use it for targeted advertising, or profile consumers for significant decisions, so there is no such processing to opt out of today. We will honor applicable browser-based opt-out signals if those practices change.

Email melissa@sweetoaksbakery.com with the subject “Privacy Request.” Describe the right you wish to exercise and the service involved. We may request information reasonably necessary to authenticate the request. If we deny a request, you may appeal by replying with the subject “Privacy Appeal.” We will respond within the period required by applicable law and will not discriminate against you for exercising a privacy right.

We use administrative, technical, and organizational safeguards designed for the nature of the information, including access controls, hashed access tokens, rate limiting, authenticated administration, encrypted transport, and third-party payment tokenization. No online system can be guaranteed completely secure, so please use a unique password and contact us if you suspect unauthorized activity.

We may update this policy to reflect changes in our services or legal requirements. We will change the date above and provide additional notice when required for a material change.