Privacy Policy

Effective August 12, 2026.

What we collect

RateAFlorist collects the minimum information needed to run a reviews directory: reviews you submit (rating, text, the name you choose to display, and an optional email), listing claims (name, business email, phone), and standard server logs (IP address, pages requested) used for security and spam prevention.

What we never do

We do not sell personal information. We do not run third-party advertising or tracking. Review submissions store your IP address solely for abuse prevention. Business listing data (shop names, addresses, phones, hours) is business, not personal, information, compiled from public sources and owner submissions.

Your choices

To correct or remove a review you submitted, or to update your shop's listing, use the claim flow on your listing page. California and other state-law requests are honored on the same basis.

What each feature handles

The short version above is true, but "the minimum information" is vague until you know what each part of the site actually touches. So here it is, feature by feature. If you only ever use the first two, we hold nothing about you beyond a short-lived server log.

• Searching. When you search for a city, a ZIP code or a shop name, the words you type are sent to our server so it can answer. They are not tied to an account, because there are no customer accounts on RateAFlorist. If you choose to share your location so we can show nearby shops, your browser asks permission first and the coordinates are used for that one lookup, not saved to a profile.
• Reading listings. Opening a shop's page is the same as opening any page: a standard server log entry and nothing more. We do not record which shops you looked at, and there is no "recently viewed" feature quietly building a history.
• Writing a review. We store the star rating, the text, the display name you choose, the optional email address, the shop the review is about, the date, and the IP address the review was submitted from. The email is used for two things only: confirming you are the author if you later ask us to edit or remove the review, and, occasionally, asking a clarifying question before a moderator publishes it. The IP address is kept for abuse prevention and is never displayed.
• Claiming a listing. When a florist claims a shop at /portal/signup, we store the contact name, the business email, the phone number given, the shop being claimed, and the date. We use these to confirm the claim and to reach the shop about its listing. Business details that appear on the public page (shop name, street address, phone, hours) are business information and were already public before the claim.
• Buying Premium. Payment happens on a Stripe checkout page. Stripe receives the card details; we never see the full card number, only a confirmation from Stripe, the last four digits, the amount, the plan (monthly or yearly), and the dates the subscription is paid through. We keep those records for as long as the subscription exists plus the period we need them for bookkeeping.
• Contacting us. The contact form sends us the name, email and message you type, plus the IP address the form came from. We keep the message as long as it takes to deal with it and for a reasonable period afterwards so we can follow up if you write again.
• Subscribing to the blog newsletter. We keep the email address, the date you subscribed, and the IP address at that moment. Every email includes an unsubscribe link, and an unsubscribed address is not emailed again.
• The florist portal. Signing in to the portal creates a session so we know which shop you manage. Inside it we store the edits you make to your listing, your reply to a review, and your subscription status. We keep a short activity record (what changed and when) so we can undo a mistake and spot misuse.

Cookies and local storage

The public side of RateAFlorist works without cookies. You can search, read every listing and read every review with cookies switched off, and nothing breaks.

Two small cookies exist and both are functional. The first is a session cookie set when a florist signs in to the portal, or when a member of our team signs in to the admin area. It tells the server who is signed in and expires when the session ends or after a period of inactivity. The second is a CSRF token, a random value that protects forms (the review form, the contact form, the newsletter box and the portal forms) from being submitted by another site on your behalf. It identifies nothing about you and is discarded once it has done its job.

There are no advertising cookies because there are no ads. There is no third-party analytics script, no tracking pixel and no social media button reporting your visit to someone else. We do not use browser local storage to build a profile. If your browser reports a "do not track" preference, we have nothing to switch off, because nothing was tracking you to begin with.

Server logs and how long we keep things

Like every web server, ours writes a line for each request: the IP address, the page, the time, and the browser's description of itself. We use these logs to keep the site up, to notice attacks, and to see which parts of the site are used in aggregate. They are kept briefly, rotated automatically, and are not combined with review or claim data to identify who read what.

Some records are kept longer for a specific reason. The IP address attached to a review stays with that review while it is published, because it is one of the few tools we have to notice a batch of fake reviews coming from a single source. When a review is removed, the address goes with it. Claim and subscription records last as long as the claim or subscription does, and then for the period bookkeeping requires. Contact messages and newsletter addresses are kept until they are no longer needed for the purpose you gave them, or until you ask us to remove them, whichever comes first.

Companies that process data for us

We do not sell or rent any of the information above, and we do not share it with data brokers or marketing partners. A small number of companies handle data on our behalf so that the site can function. Each one receives only what its job requires.

• Stripe processes Premium payments. Card details are entered on Stripe's page and handled under Stripe's own privacy policy. We receive a confirmation, not the card.
• An email delivery service sends transactional email: claim confirmations, review notifications to a claimed shop, password resets and the newsletter. It sees the address the message is going to and the message itself.
• Cloudflare sits in front of the site to block attacks and serve pages quickly. Every request passes through it, so it sees the same request details our own server log sees.
• Google Maps is involved only when you choose to open a shop's map link. Until you click that link, nothing about your visit is sent to Google. Once you do, you are on Google's service under Google's terms.

Our hosting provider stores the database and files that make up the site, as any host does. We may also disclose information if the law requires it, or to protect the site and its users from fraud or abuse, and in that case we disclose only what is needed.

Published reviews are public

A review is written to be read. Once a moderator publishes it, the display name, the rating, the text and the date are visible to anyone on the shop's page, may be counted in the shop's rating badge that a florist can embed on its own website, and may be picked up by search engines and shown in their results. The email address and IP address you gave are never part of what is published.

Choose your display name with that in mind. A first name or initials work well. If you later regret the name you used, ask us via the contact page and we will change it after confirming with the email on file. If a claimed shop replies to your review, the reply is public in the same way, and a shop's reply may mention details of the order you described, so a review that gives an order number or a recipient's full name is one we may ask you to trim before it goes up.

Children

RateAFlorist is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. There is no reason for a child to submit a review or claim a listing. If you believe a child has given us information, tell us through the contact page and we will remove it.

Privacy rights under state law

Several states give their residents specific rights over personal information, and we extend the same treatment to every visitor regardless of where they live. You can ask us:

• What we hold about you. We will tell you which of the records above are linked to your email address and send you a copy.
• To correct it. A wrong display name, a typo in a review, an out-of-date business email on a claim.
• To delete it. We will remove your review, your newsletter subscription, your contact messages, or your claim and portal account, with two limits: a shop's public business details are not personal information and stay in the directory, and payment records may need to be kept for the period bookkeeping law requires even after a subscription ends.
• Confirmation that we do not sell personal information. We do not, so there is no opt-out to exercise, and we do not "share" it for cross-context advertising either.

To make a request, use the contact page and say what you are asking for. To make sure we are talking to the right person, we reply to the email address you originally gave us when you wrote the review, subscribed or claimed the listing, and we act once you confirm from that address. If you no longer have access to that address, tell us and we will ask a few questions about the record only its owner could answer. We aim to answer within a few weeks, and we will not treat you any differently for asking.

Visitors outside the United States

RateAFlorist lists florists in the United States and is hosted on servers in the United States. If you visit from another country, the information described in this policy is transferred to and handled in the United States, where privacy law may differ from your own. By using the site you accept that. The practical protections are the same for everyone: we collect little, we sell nothing, and you can ask us to delete what we hold.

Keeping data safe

In plain terms: the site is served over an encrypted connection, the database is not reachable from the public internet, sign-in to the portal and admin area is protected by password and session controls, and card numbers never touch our servers at all because Stripe handles them. Access to the admin area is limited to the people who run the site. No system is perfect, and if we ever discover a breach that affects your information we will tell you as the law requires, using the email address on file.

Updates to this policy

When we change how the site handles information, we update this page and change the effective date at the top. The date is the day the new wording took effect. Small clarifications that do not change what we collect or share may be made without a separate notice; a change that materially expands what we collect will be flagged on this page and, where we hold an email address for you, sent to it. The current version is always at /privacy, and the rules that govern use of the site are in the Terms of Use. Questions go through the contact page, and the FAQ answers the most common ones about how reviews and ratings work.