Privacy Policy

Enchanted Forest ("we", "us", "our") operates www.enchantedforest.com. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. We collect only what we need to operate the store, ship plants, and improve your experience.

By using our website or creating an account, you agree to this policy.

We collect the following categories of information:

• Account information: email address, name, hashed password, optional phone number, and shipping/billing addresses.
• Order information: items purchased, quantities, prices, and order history.
• Payment information: we never see or store your full card number. Saved cards are held by our payment processor (Stripe). We keep the card brand, last 4 digits, and expiration date for display purposes only.
• Auction history: bids you place, including amount, timestamp, and outcome.
• Communications: contact form submissions, support emails, restock alert subscriptions, and any messages you send us.
• Cookies and session data: a session cookie for your cart and account login, plus aggregate analytics cookies.
• Automatic data: IP address, browser type, device type, pages visited, referring URL, and timestamps.

We use your information to:

• Process orders and ship plants to you
• Charge winning auction bids automatically as agreed at the time of bid
• Send transactional emails (order confirmations, shipping notifications, auction outcomes, password resets)
• Send marketing emails — only if you have explicitly opted in. You can unsubscribe at any time.
• Notify you about restocks of items you specifically asked to be alerted about
• Operate, improve, and secure the site, including fraud prevention
• Comply with tax, legal, and accounting obligations

We share information only with the service providers required to operate the business:

• Stripe — payment processing. Stripe Privacy Policy
• SendGrid (Twilio) — transactional and marketing email delivery. Twilio Privacy Policy
• Railway — website hosting infrastructure. Railway Privacy Policy
• Shipping carriers (USPS, UPS, FedEx) — your shipping address and order details, only as needed to deliver your order.

We do not sell your personal information to anyone for any purpose. We may disclose information if required by law (subpoena, court order) or to protect our rights and the safety of our users.

Marketing emails go only to subscribers who explicitly opted in via the newsletter form or during account creation. Every marketing email includes a one-click unsubscribe link.

Restock notifications fire only when you specifically request one for a product, and you can unsubscribe via the link at the bottom of each notification.

Transactional emails — order confirmations, shipping notifications, auction outcomes, password resets — are required to operate the service and cannot be opted out of separately. To stop receiving them, you would need to close your account.

We use cookies for two purposes:

• Session cookie — required for your shopping cart and account login. Deleted when you log out or your session expires.
• Analytics — anonymized page-view tracking so we can understand which pages are useful and fix what isn't. We don't share personal information with third-party analytics services.

You can disable cookies in your browser settings, but some features (cart, login, checkout) will not work.

You have the right to:

• Access — request a copy of all personal information we hold about you
• Correction — update your account information anytime via your account page
• Deletion — email us to request account closure and removal of your personal information
• Portability — receive your data in a machine-readable format
• Marketing opt-out — use the unsubscribe link in any marketing email

Residents of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with applicable privacy laws have additional rights. To exercise any of these rights, email us at hello@enchantedforest.com.

We keep different categories of data for different periods:

• Order and transaction records — 7 years (tax and accounting requirement)
• Auction bid history — indefinitely, for dispute resolution and fraud prevention
• Account information — until you request account closure
• Marketing email subscribers — until you unsubscribe
• Restock alert subscribers — until the alert fires or you unsubscribe

We do not knowingly collect personal information from anyone under 13 years old. If you are a parent or guardian and become aware that your child has provided us with personal information, please contact us at hello@enchantedforest.com and we will delete it.

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be announced via email to active account holders or via a notice on the site.

Privacy questions, data requests, or concerns? Email hello@enchantedforest.com.