Privacy
Last updated: 13 October 2026
In short: we keep the flower you send and the message on it, nothing more. You don't need an account, we set no cookies, and we use no analytics or third-party trackers. Payment details stay with Stripe. About the person who receives the flower, we only know whether it has been opened.
Who is responsible
The data controller is Inluup S.R.L., company ID (CUI) 55426861, Drumul Între Tarlale 41C, Cățelu, Glina, Romania. For anything about your data, write to contact@flowerfor.you.
What we keep
- The flower you create: the species, colour, opening animation, your message and your signature. The message is the only personal content we hold, and only you decide what goes in it.
- The order: the Stripe payment session ID, the amount, the currency, the payment status, and the version and time of your consent to immediate delivery (the checkbox before payment).
- Whether the flower was opened: yes or no. We do not record when, how many times, or by whom.
- Whether your flower was started from “Send one back”: yes or no, stored with the flower you create. It does not say which flower you received or who sent it to you.
- Your IP address, briefly: kept only in memory, for about ten minutes, to limit abuse (too many requests from one place). It is never written to disk.
We do not keep your email address, your name or your card details. Stripe collects them on its payment page and keeps them. After payment we read your email address from Stripe once, to send you the flower's link, and do not store it.
Why we use it
- To deliver the flower you paid for: showing it at its link (performance of a contract).
- To show you whether your flower has been opened (our legitimate interest in telling you it arrived).
- To keep proof of the order and of your consent (legal obligation and legitimate interest).
- To count, in total, how often a flower someone received leads to a new one (our legitimate interest in knowing whether the service works).
- To prevent abuse and keep the service running (legitimate interest).
On your phone
While you create a flower, your browser keeps a copy of it (including the message, and whether you came from “Send one back”) in local storage, so you don't lose it if you close the page. It is deleted after a successful payment. Your browser also remembers which flowers were sent from it, so that opening your own link doesn't mark the flower as opened. This is not a cookie and is never sent to us. You can clear it from your browser settings. We store nothing on the recipient's phone.
Who else sees it
- Stripe, through Link, processes the payment and is the seller of record. Your payment details are handled under Stripe's privacy policy. Your message is never sent to Stripe.
- Fly.io hosts the site and Supabase hosts the database, both in Frankfurt, Germany. They process data only on our behalf. See Fly.io's privacy policy and Supabase's privacy policy.
- Resend sends the email with the flower's link. It receives your email address and the link, never the message, and processes them only on our behalf. See Resend's privacy policy.
- Anyone with the link can see the flower and its message. The link is long and random, but share it only with the person it is meant for. Link previews in messaging apps never show your message or your name.
We do not sell or share data with anyone else.
How long we keep it
- A flower you started but didn't pay for is deleted after 7 days without changes.
- If a payment fails, the message and signature are erased after 7 days; the record of the failed payment stays.
- A paid flower stays for as long as the service exists, as promised in the terms, until someone deletes it.
- If the payment is fully refunded, or your bank decides a dispute in your favour, the flower is deleted the same way.
Deleting a flower
The sender or the recipient can ask us to delete a flower by writing to contact@flowerfor.you with the flower's link. Deleting erases the message and signature at once, and the link stops working. We keep only the record of the payment, without any of the content. If the service ever closes, deleted flowers are not part of the archive described in the terms.
Your rights
You can ask us to access, correct or delete your data, to restrict or object to how we use it, or to receive a copy of it. Write to contact@flowerfor.you and include the flower's link, since that is the only way we can find it; we do not know who you are otherwise. For your email and payment details, ask Stripe. You can also complain to the Romanian data protection authority, ANSPDCP.
Changes
When this policy changes, we publish the new version here, with its date.