Privacy Policy

Only what we need to bake and hand you your order:

• Your name and phone number — required for every order, so we can identify you at pickup and text you if a drop changes.
• Your email address — optional, used to send order confirmations and receipts.
• A delivery address — only if you choose delivery instead of pickup.
• Your order history — items, quantities, totals, pickup slot, and any notes you add to an order.
• Reviews you submit — the display name, rating, and text you choose to publish, plus whether the review is tied to a verified purchase.
• Basic security and delivery logs — our hosting and email providers record things like IP address and timestamps to prevent abuse and confirm messages were delivered.

We never see your card number. Card payments are handled entirely on Stripe’s hosted checkout page. We receive only the outcome of the payment and the last four digits — never the full card, and never the CVC.

• We do not sell or rent your information. Not to anyone, ever, for any amount.
• We run no advertising pixels. There is no Meta pixel and no ad-retargeting tracking on this site.
• We do not use your information to build an advertising profile or share it with data brokers.

We use Google Analyticsto understand how people find and use the site — which pages get visited, which drops get attention, and whether the site is working on people’s phones. This helps us decide what to bake and what to fix.

Google Analytics sets cookies and collects things like your approximate location (from your IP address), device and browser type, and the pages you view. We use it for aggregate reporting only — we are not trying to identify you personally, and we don’t use it for advertising.

You can opt out with Google’s official browser add-on, or by using your browser’s Do Not Track or cookie-blocking settings. The site works fine with analytics blocked.

Aside from analytics, the only cookie we set is the one that keeps you signed in to your own account.

We text you only about your own orders (confirmations, “your order is ready,” drop changes) and — separately, and only if you opt in — about upcoming drops.

Reply STOP to any message to stop them immediately. Reply HELP for help. Message and data rates may apply; message frequency varies. Opting out of marketing texts does not stop essential messages about an order you have already placed.

When you opt in, we record the date, the source, and the exact wording you agreed to. We keep that consent record even after you unsubscribe, because phone carriers require us to be able to prove consent was given. It is used for nothing else.

Only the service providers that make the site work, and only with what each one needs:

• Stripe — payment processing. They handle your card details directly under their own privacy policy.
• Telnyx — sending text messages and verifying your phone number at sign-in.
• Resend — sending order confirmation emails.
• Vercel and Railway — website hosting and the database where orders are stored.
• Google Analytics — aggregate website usage statistics, as described above.

We may also disclose information if the law requires it, or to protect our rights or someone’s safety.

Order records are kept for as long as we need them for our business and tax records. Account information is kept until you ask us to delete it. SMS consent records are kept as described above. You can ask us to delete your account at any time; we may need to retain order and tax records even after your account is closed.

• Ask for a copy of the information we hold about you.
• Ask us to correct anything that’s wrong.
• Ask us to delete your account and personal information.
• Stop marketing texts any time by replying STOP.

Texas residents, and residents of other states with privacy laws, have these rights under those laws. To use any of them, email hi@nancysbakehouse.com. We will not treat you differently for asking.

This site is meant for adults placing orders. We don’t knowingly collect information from children under 13. If you believe a child has given us information, email us and we’ll delete it.

The site is served over HTTPS, payments are handled by Stripe, and access to customer information is limited to the bakery’s own staff accounts. No system is perfectly secure, but we don’t store the information that would be most damaging to lose — card numbers — at all.

If we change this policy we’ll update the date at the top of this page. If the change is significant, we’ll say so on the site.

Nancy's Bake House LLC
The Woodlands, TX
hi@nancysbakehouse.com

See also our Terms of Service.