Candy Clouds LLC respects the privacy of every visitor, retailer, planner and family that reaches out to our taffy kitchen. This Privacy Policy explains what information we collect, why we collect it, how we use it and how we protect it. Our small team is led by developer Candy Mist, who built this website and oversees the systems that support our small-batch candy work at 591 W Aspen View Ct, Lehi - 84048-4255, United States (US). We keep this policy plain and direct so a reader does not need a legal background to understand our practices.
This Privacy Policy applies to the website located at candymist.mom and to any page, form or message that links back to this document. It covers personal information that we collect through the site, through email at welcome@candymist.mom, through telephone calls to +16185909609 and through in person visits to our kitchen address. It does not cover information that a third party collects on its own site, even when we link to that site from a page here.
Candy Clouds LLC operates as a small candy manufacturer and seller. We do not run a large advertising network, and we do not build profiles of visitors for resale. The information we hold is the information we need to answer questions, quote orders, ship candy and keep proper business records. Where this policy describes a practice in general terms, the same practice applies across all pages of the site unless a specific page states otherwise.
We collect two broad kinds of information. The first kind is information that identifies or can reasonably be linked to a person, such as a name, an email address, a telephone number or a shipping address. The second kind is technical information that describes how a device interacts with the site, such as a browser type or a general region. We treat both kinds with care regardless of where a visitor resides.
We do not ask for sensitive categories of data such as health details, precise location, government identifiers or financial account numbers through this website. If a payment is ever required for an order, we arrange it through a processor that handles the payment directly, and we do not store full card numbers on our own systems.
When a visitor completes the contact form on this site, that visitor provides a name, an email address, an optional subject line and a message. The form prepares an email to our team, so the information travels to us the same way any email does. We use that information only to read the message, reply to it and keep a record of the conversation if an order follows.
A visitor may also provide information by calling our kitchen, by sending an email directly, or by requesting a quote for wholesale cases, custom flavor runs, gift tins, seasonal boxes or corporate orders. In each case the information is provided by choice, and a visitor may always decline to provide it, though some requests cannot be completed without a name and a way to reply.
Like most websites, our hosting environment may record basic technical information when a page is requested. This can include an internet protocol address, a browser name and version, an operating system, a referring page and a timestamp. We review this information in aggregate to understand which pages are useful, to diagnose errors and to keep the site secure. We do not use it to single out an individual visitor for advertising.
We do not enable invasive tracking scripts by default. Any analytics or performance tool we adopt in the future will be selected for strong privacy settings, and this policy will be updated before such a tool begins to collect data. Where a tool can be configured to avoid storing a full address, we configure it that way.
Some technical information is created simply because a request must travel across the internet. A server must know where to return a page, and a network must route that page correctly. We treat that basic routing information as operational data rather than as marketing data, and we keep it only for the short period needed for security review and troubleshooting. We do not combine it with a contact record to build a hidden profile, and we do not enrich it with data bought from a data broker.
When a retailer, event planner or family places an order, we create a record that may include a contact name, a business name, a billing address, a shipping address, an email address, a telephone number, the items ordered, the agreed price and the delivery date. We keep these records because they are necessary to produce the order, ship it correctly, answer follow up questions and satisfy our own accounting duties.
For custom flavor runs, the record may also include the approved recipe, the wrap tint and the label artwork that the customer supplied. We keep those items so a repeat order tastes and looks the same. A customer may ask us to delete the artwork or the recipe card at any time, and we will do so when no open order or legal duty requires us to keep it.
We use information to respond to messages, prepare quotes, produce and ship orders, process returns, send order updates, keep accounting records, protect the site against abuse and improve the content we publish. We also use aggregated technical information to decide which pages deserve more detail and which pages confuse readers.
We do not sell personal information. We do not rent a contact list. We do not share a customer email address with an unrelated advertiser. When a message asks a question that a supplier or a shipping partner can best answer, we may share the minimum details needed to resolve the question, and we limit that sharing to the purpose at hand.
Where a privacy law requires us to name a legal basis, we rely on a small set of grounds. We process information to perform a contract when a visitor places an order or asks us to prepare a quote. We process information based on our legitimate interests when we secure the site, prevent fraud and keep normal business records. We process information based on consent when a visitor asks to join a mailing list, and that consent may be withdrawn at any time.
We also process information when we must comply with a legal obligation, such as keeping tax records or responding to a lawful request from a public authority. When we rely on legitimate interests, we weigh those interests against the rights of the individual and we limit the data to what the interest truly requires.
We rely on a small number of service providers to run the site and the business. A hosting provider stores the pages. An email provider delivers and receives messages. A shipping partner moves the candy. An accounting provider keeps the books. Each provider receives only the information needed for its task, and each is expected to protect that information under a written agreement.
We review providers before we engage them and we avoid providers that claim broad rights to customer data. If a provider can no longer meet our standards, we replace it. A customer who wants to know which categories of providers touch a particular order may ask us and we will explain the path that order follows.
We keep contact messages for as long as needed to resolve the request and then for a reasonable period in case the person writes again. We keep order and accounting records for the period required by tax and business law. We keep custom recipe and artwork files until the customer asks us to remove them or until the files are no longer useful for reorders.
When a retention period ends, we delete the information or make it unreadable. If information exists only in a backup, we let the backup cycle expire on its normal schedule and we do not restore that information for any purpose other than a disaster recovery event.
We use reasonable technical and organizational measures to protect the information we hold. These measures include access controls that limit who may view a record, encrypted connections for the website, routine software updates and a practice of collecting only the data we actually need. Our team is small, and each member understands that customer information is not to be shared or repurposed.
No method of transmission or storage is perfectly secure. We cannot promise absolute security, but we work to reduce risk and we act quickly if we learn of a problem. If a breach ever affects personal information, we will notify affected individuals and the relevant authorities as the law requires, and we will explain what happened in plain language.
Depending on where a person lives, that person may have the right to request a copy of the personal information we hold, to ask us to correct an error, to ask us to delete information, to ask us to restrict or object to certain processing, and to receive information in a portable format. A person may also have the right to withdraw consent at any time when consent is the basis for processing.
To exercise a right, a person may write to welcome@candymist.mom and describe the request. We will verify the identity of the requester before we act, so that we do not release information to the wrong party. We will respond within the time a relevant law allows. We do not charge a fee for a reasonable request, and we do not discriminate against a person who exercises a privacy right.
This site is intended for a general audience and is not directed to children. We do not knowingly collect personal information from a child. If a parent or guardian believes that a child has provided information to us, that parent or guardian should contact us, and we will delete the information promptly.
Orders that involve a child, such as a party tray or a gift tin for a young person, are placed by an adult. We ask that only an adult completes a form, sends an email or calls the kitchen on behalf of a child.
We send order updates and replies to direct questions because those messages are part of the service a person requested. We send marketing messages only when a person has asked to receive them. Every marketing message includes a way to opt out, and an opt out takes effect promptly.
We do not buy email lists and we do not add a person to a mailing list because that person placed a single order. A retailer who wants seasonal announcements may opt in, and a retailer who changes their mind may opt out at any time without affecting the order relationship.
Our pages may link to a shipping carrier, a payment page or a social profile. When a visitor follows such a link, the visitor leaves our site and the destination site applies its own privacy policy. We do not control that site and we cannot promise how it treats information. We encourage a visitor to read the privacy policy of any site before providing personal information.
If we ever embed a third party tool, such as a map or a video, the embed may allow that third party to receive technical information about the visit. We will prefer embeds that respect privacy, and we will describe material embeds in this policy.
Candy Clouds LLC is based in the United States, and our records are kept in the United States. A visitor who contacts us from another country understands that the information will be transferred to and processed in the United States. We take steps to protect information during such a transfer, and we use providers that offer appropriate safeguards.
Where a law requires a specific transfer mechanism, we rely on the mechanism our providers offer, such as standard contractual clauses. A person with a question about a transfer may contact us and we will explain the safeguards that apply.
We may update this policy when our practices change, when we add a feature or when the law requires a new disclosure. When we update it, we change the date at the top of the page. If a change is significant, we will provide a clear notice on the site so that a visitor can review the new terms before continuing to use the site.
We encourage a visitor to review this page from time to time. Continued use of the site after an update means that the visitor accepts the revised policy for information collected after the update.
Questions about this policy or about personal information may be sent to Candy Clouds LLC by email at welcome@candymist.mom or by telephone at +16185909609. Written requests may be mailed to 591 W Aspen View Ct, Lehi - 84048-4255, United States (US). Please include enough detail for us to identify the request and to reply.
Our team reads every privacy message and treats each one as a priority. If a request needs more time than expected, we will acknowledge it and explain the next step. Thank you for trusting Candy Clouds LLC with your information while you enjoy our small-batch taffy.