Twisty Olive Oils LLC (“Twisty Olive Oils,” “we,” “us”), of DeLand, Florida, respects your privacy. This policy explains what we collect through this website, how we use and share it, how we protect it, and your choices.
1. Information we collect
- Orders: your name, email, phone (optional), shipping address (just your name for market pickup), the items you buy, any promo code and your order history. If you send a gift, we also keep the recipient’s name, the address you ship it to and any gift message you add. The message is printed on our packing slip, which shows no prices and names you only as the sender, without your email or phone.
- Accounts: your first and last name, email and a password (held by our sign-in provider; we never see it), plus a phone number if you add one.
- Subscriptions: the package or bundle you choose, the name and address it ships to, its schedule and status. Stripe also keeps a customer record with your name, email and addresses, and, if you cancel on Stripe’s page, any reason you choose to give.
- Messages: your name, email, phone (optional), topic and message from our contact form, and our replies.
- Newsletter and offers: your email when you join our newsletter, tick “Email me offers and news from Twisty” at checkout (it starts unticked) or ask us to add you (for example, on a sign-up sheet at our market), with your name if you gave it and when and how you agreed. If we run a sign-up offer and you join through it, we also record the words you agreed to, your IP address and the code we gave you.
- Customer list: each paid order adds your name, email, first and latest order dates and number of orders to our customer list. This alone never signs you up for marketing email.
- Order lookup: if you look up orders without an account, the email you enter and the 6-digit code we send.
- Chat: what you type to our chat assistant (section 5).
- Wholesale applications: wholesale is coming soon. Once it opens, the application asks for your business and contact details, your resale certificate (number and upload), estimated monthly volume and a message.
- Technical data: our web host’s request logs (IP address, browser details, pages visited). The services our pages load from (Supabase for photos, videos and sign-in, Cloudflare’s spam check and our chat assistant) also see your IP address and browser details. We also count requests by IP or email address to limit repeated ones (Upstash, section 4).
Payments: card details are entered on Stripe’s secure checkout and processed by Stripe. We never see or store your full card number. Stripe sends us a record of each payment with your name, email and address; some records, such as refunds, also include basic card details like the brand and last four digits.
2. How we use it
- To take payment for, pack, ship and support your orders and subscriptions, and to answer your messages
- To send order, subscription and account emails (receipts, shipping and refund updates, payment notices, lookup codes, password resets)
- To send marketing email only if you agreed to it: our newsletter, and offers or reminders that may depend on what you’ve bought (such as a new-customer offer)
- To stop marketing email to addresses that bounce or report it as spam
- To prevent fraud and spam, keep the site secure, run our shop and keep tax records
We use your phone number only to reach you about an order or a message you sent us. We don’t send text messages.
3. We do not sell your information
We do not sell, rent or trade your personal information, and we do not share it for anyone else’s marketing or for targeted advertising. We don’t use analytics or advertising tools on this site.
4. Who we share it with, and how
We share only what each provider needs to help us run the shop. Our site sends it to them over encrypted (HTTPS) connections; emails then travel the usual way to inboxes, and carriers see your name and address on the shipping label.
- Stripe — payments and subscription billing. Stripe receives your name, email, phone, shipping address, gift details, items and prices, any promo code and your account ID on our site; you type your card details on Stripe’s own page. Stripe’s privacy policy also applies.
- Supabase — our database, sign-in and file storage, where most of the information in section 1 is kept.
- Vercel — hosts this website and keeps its request logs.
- Resend — delivers our emails (each email’s address and content) and tells us about bounces and spam reports.
- Ember Development Studios — our web developer, which looks after this site and runs our chat assistant. Our emails come from its address, no-reply@emberdevstudios.com.
- Google (Gmail) — our shop inbox: new-order alerts with customer details, contact messages, sign-up notices and your replies to our emails.
- Cloudflare Turnstile — the spam check on our forms (including the newsletter sign-up on every page). It runs in your browser, and Cloudflare receives your IP address and browser details.
- Upstash — counts requests to our checkout, forms and emailed codes so we can limit repeated ones. It receives only a scrambled (hashed) form of your IP address, email address or account ID, and each count expires within about two hours.
- Cari (cari.rocks) — the chat assistant on our site, run by Ember Development Studios with AI from Anthropic and Google (section 5).
- Shipping carriers (USPS and UPS) — deliver the orders we ship (your name and shipping address).
Inside our shop, only our admins (the owner and the people we add) can see customer details, after signing in; our web developer can also reach them to keep the site running. We may disclose information when the law requires it, or to protect our rights, customers or others from fraud or harm. If our business is ever sold or merged, customer information may pass to the new owner, who would have to keep following this policy. Our website and database are hosted in the United States.
5. Our chat assistant
The chat bubble on our public pages is Cari, an AI assistant that Ember Development Studios runs at cari.rocks. Its answers are written automatically by AI: Cari sends what you type to Anthropic, whose AI writes the replies, and may also send it to Google’s AI to search our shop’s information. What you type, including any contact details you give, is saved as a conversation in our Cari inbox, not in our shop’s database. The bubble loads from cari.rocks, so Cari receives your IP address and browser details on the pages where it appears, even if you don’t chat. The chat doesn’t appear on cart, checkout, account, sign-in or order pages. Please don’t share card numbers, passwords or other sensitive details in it.
6. Cookies and browser storage
We use only the cookies and browser storage the site needs to work, and no advertising or analytics cookies:
- a sign-in cookie that keeps you signed in;
- a checkout cookie (2 hours) so our thank-you page shows your order only to your browser;
- browser storage that remembers your cart, an applied promo code and a Build Your Own Bundle in progress, until you empty them or clear your browser;
- tab storage that notes when you arrived (it times our sign-up offer), cleared when you close the tab;
- if we run a sign-up offer, a cookie and browser storage that remember you closed it or signed up.
Stripe uses its own cookies on its checkout and billing pages, for example to prevent fraud. The chat window comes from cari.rocks and sets no cookies on our pages, and Cloudflare’s spam check runs in its own frame.
7. How long we keep it
We don’t delete shop records on a schedule. The only automatic deletions: our providers’ request logs and our request counts at Upstash expire on their own, and once wholesale opens, a resale certificate that no application on file uses is deleted after a day. In practice:
- Orders and payment records (including gift details): at least 7 years, for tax and accounting. Deleting an account doesn’t delete its past orders.
- Account and subscription details: until you ask us to delete your account (cancelled subscriptions stay on record until then). Each box we sent stays on record as an order.
- Messages: until we delete them.
- Chat: kept in our Cari inbox; contact us if you’d like yours deleted.
- Newsletter: we email you until you unsubscribe, then keep your address marked unsubscribed (or, if we delete it from our list, only a scrambled one-way copy on the list) so we never email you by mistake. Copies of sent newsletters are kept.
- Lookup codes, email delivery records and our admin log: kept until we delete them, like our other shop records.
You can ask us to delete other personal information at any time.
8. How we keep it safe
- The whole site runs over HTTPS, and browsers are told to use only the secure connection.
- Card details are entered only on Stripe’s PCI-compliant pages; our site never handles card numbers.
- Passwords are held by our sign-in provider and need at least 8 characters; new accounts confirm their email first.
- Our database lets only our own server read orders, customer lists, messages and newsletter records; a signed-in customer sees only their own account, and every admin page checks the person is an admin. The database’s master key is never sent to your browser.
- Checkout, order lookup and our forms limit repeated attempts, our public forms filter spam, and checkout, billing and cancel requests sent from other websites are refused.
- Updates our site receives from Stripe and Resend must carry a valid signature before we act on them.
- Cancel-order links are long random codes, stored only scrambled, that stop working once we start packing. Lookup codes expire after 10 minutes and allow only a few tries.
- We work to keep shoppers’ details out of our error logs.
No way of sending or storing information is completely secure, but we work to protect yours.
9. Children
Our shop is intended for adults. We do not knowingly collect information from children under 13. If you think a child has given us information, contact us and we’ll delete it.
10. Your choices and rights
- Update your name and phone, change your email or reset your password from your account.
- Update your card or address, see invoices or cancel a subscription from your account: choose Manage subscription & card.
- Unsubscribe from marketing email with the link in any marketing email (it opens a page with one button) or your mail app’s unsubscribe button. Order and account emails still come. After you unsubscribe, signing up again or ticking the box at checkout won’t restart our emails; contact us to turn them back on.
- Ask us to see, correct or delete your information, or for a copy, by email or our contact form. To protect you, we may ask you to confirm the request from the email address we have for you. There’s no delete button, so we handle these by hand, and we keep order records for tax (section 7).
US state privacy rights: if you live in California or another state with a consumer privacy law, you may have the right to know, access, correct and delete your personal information, and to opt out of its sale or use for targeted advertising. We don’t sell personal information or share it for targeted advertising. To make a request, contact us as above; we won’t treat you differently for asking.
11. Changes
We may update this policy; the effective date above shows the latest version.
12. Contact
Twisty Olive Oils LLC, DeLand, Florida. Email twistyoliveoil@gmail.com, call (386) 747-0238, or use our contact form.