Privacy Policy

Who we are

FloristGrow is a brand of Pinwheel Media Ltd(“Pinwheel”, “we”, “us”, “our”), a company incorporated in England and Wales (company number 16851462) and trading as FloristGrow. Our registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. Pinwheel is the data controller for personal data collected through this website, and for the personal data we hold about you as a FloristGrow customer.

When you use FloristGrow to run your own shop, the position is the other way round: your customers’ details belong to you, you are the controller for them, and we only handle them on your instructions as your processor.

Contact us: support@floristgrow.co.uk

What we collect

When you join the FloristGrow early-access list we collect:

• Email address — required. Used to contact you when early access opens.
• Shop name — optional. Helps us personalise our communications to you.

We do not use tracking cookies on this website, and we do not collect any other personal data from you here.

If you go on to start a FloristGrow free trial or subscription, we will also collect the details needed to run your account — your name, your shop’s name and address, your contact details, and your billing details. Your card details are entered directly with our payment provider, Stripe: we never see or store your full card number. Stripe tells us only what we need to bill you, such as the card type, the last four digits, and whether a payment succeeded.

Why we collect it and our lawful basis

We collect your email address and shop name solely to keep you informed about FloristGrow — specifically, to notify you when early access opens and to share relevant product updates leading up to launch.

Our lawful basis is consent (Article 6(1)(a) UK GDPR). By submitting the early-access form you are giving us your explicit consent to contact you for the purposes described above. You may withdraw that consent at any time (see Your rights below).

Where your data is stored and processed

We are a UK company, but the companies we rely on to run FloristGrow are not all based in the UK. We think you should know exactly who handles your data and where, so here is the full list.

For the early-access list on this website

• Supabase (Supabase Inc.) — our database provider for the early-access list. Your email and shop name are stored in a Supabase PostgreSQL database hosted on AWS infrastructure in the EU (Frankfurt, eu-central-1). Supabase Inc. is a US company.
• Brevo (Sendinblue SAS) — our email and contact-list provider, used to send your confirmation email and to manage the early-access list. Brevo is headquartered in France and stores data within the EU.

For the FloristGrow platform and your shop’s account

This section describes where our own infrastructure sits. If you run a shop on FloristGrow, how we handle your customers’ data is a separate matter, covered by the processor obligations in section 12 of the platform agreement and by your own shop’s privacy policy to your customers.

• Vercel Inc.— hosting for this website and for the FloristGrow application, including the functions that handle your requests. Vercel processes request data such as IP addresses. Vercel’s default region is the United States (Virginia), and some requests are handled at edge locations in other regions around the world.
• Railway (Railway Corp.) — the database and application hosting behind the FloristGrow platform, where your account, shop, order and delivery data live. This is hosted in the United States.
• Anthropic PBC — where a shop has the AI concierge enabled, messages sent to it, whether by you trying it out or by your shoppers using it, are processed by Anthropic’s Claude API in the United States. Section 12.3 of the platform agreement covers Anthropic as a sub-processor for your shoppers’ messages; for what that means for them, see that section and your own shop’s privacy policy to your shoppers.
• Stripe (Stripe, Inc. and Stripe Payments Europe, Ltd.) — our payment provider. Stripe handles your card details and your subscription billing, and also processes the payments your own customers make through your shop. Stripe is a global payments company and processes data in the United States and elsewhere.
• 20i Ltd — our domain, DNS and email provider, which runs the mailbox behind support@floristgrow.co.uk. 20i is a UK company and hosts primarily in the United Kingdom, though its data processing agreement allows it to use other jurisdictions.
• Chatwoot (planned) — the support-desk software we intend to use for customer support conversations. We will run this on our own servers, so those conversations stay with Pinwheel rather than going to a third-party support provider. This is not live yet; we will update this policy when it is.

We do not sell, rent, or share your personal data with any other third parties.

Sending your data outside the UK

As you can see above, some of your personal data is transferred to and processed in the United States — in particular by Vercel, which hosts the site and application, by Railway, which hosts the platform database, by Stripe, which handles payments, and, if your shop has the AI concierge enabled, by Anthropic, which processes concierge messages. Some requests are also handled at edge locations in other countries.

UK data protection law requires that a transfer like this only happens where a recognised safeguard is in place, so that your data keeps essentially the same protection it would have under UK law wherever it is held. We rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as incorporated in each provider’s own data processing terms, to meet that requirement.

If you would like to know which safeguard a particular provider relies on, email us at support@floristgrow.co.uk and we will tell you.

Retention

We will retain your early-access data for as long as the FloristGrow early-access programme is active, or until you withdraw your consent — whichever comes first. Once FloristGrow launches, if you have not become a customer we will delete your early-access data within 12 months of the product launch date.

If you become a FloristGrow customer, we keep your account and billing data for as long as your subscription runs, and for six years after it ends, to meet our UK accounting and tax record-keeping obligations. After that, we delete or anonymise it.

You may request erasure at any time before then (see below).

Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Erasure— request that we delete your personal data (“right to be forgotten”).
• Withdraw consent — withdraw your consent to receive emails from us at any time by clicking the unsubscribe link in any email we send, or by emailing us directly.
• Rectification — ask us to correct any inaccurate personal data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to our processing of your data at any time.

To exercise any of these rights, email us at support@floristgrow.co.uk. We will respond within 30 days.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For significant changes, we will notify early-access subscribers by email.