Privacy Policy

We collect information you provide directly, including:

• Account information (name, email address, username)
• Profile information (display name, bio, skills, portfolio images, location, links)
• Job listing details you submit
• Messages sent through the platform between you and other users
• Payment information processed through Stripe (we do not store full card details)
• Feedback and support requests

We also automatically collect usage data such as pages visited, device and browser information, approximate location derived from IP, and error events when something goes wrong.

Categories of personal information (CCPA / state privacy laws)

Mapped to the categories enumerated in the California Consumer Privacy Act and similar state laws:

• Identifiers — name, email address, username, IP address, device identifiers
• Internet or other electronic network activity — pages visited, referrers, interactions with the service
• Geolocation data — approximate location from IP, plus optional zip / city / state you provide on your profile
• Professional or employment-related information — skills, portfolio, bio, job listings, applications
• Commercial information — subscription and payment metadata received from Stripe
• Visual information — avatar, header, and portfolio images you upload
• Inferences — none currently drawn for advertising or profiling purposes

We do not collect sensitive personal information as defined under the CPRA (e.g. precise geolocation, government IDs, biometric data, health data, racial/ethnic origin, religious belief, sexual orientation).

• To create and maintain your account and public profile
• To facilitate job postings, applications, and messaging between users
• To process payments for paid features (via Stripe)
• To send transactional emails (sign-in links, application notifications, account changes)
• To improve our services, debug errors, and prevent abuse
• To respond to your inquiries and support requests
• To comply with legal obligations

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act and similar state laws. We have not done so in the past 12 months and have no plans to do so. Cross-context behavioral advertising is not part of our business model.

We do share data with the following categories of recipients:

• Service providers — Supabase (database and authentication), Stripe (payments), Resend (transactional email), Vercel (hosting and aggregate analytics), Sentry (error monitoring). Each is bound by a written agreement to use your information only to deliver services to us.
• Other users — Your public profile is accessible to anyone with the URL and may be indexed by search engines. While you can switch your profile to private at any time in Settings, content that has been viewed, cached, or shared by others may persist outside our control. Job posters can see applications submitted to their listings.
• Legal requirements — We may disclose information when required by law, valid legal process, or when necessary to investigate fraud, protect our rights, or protect users' safety.
• Business transfers — In the event of a merger, acquisition, or asset sale, your information may be transferred subject to this policy.

We use essential cookies to maintain your session and preferences. We use Vercel Analytics for aggregate, non-identifying usage statistics (no third-party advertising cookies are set). We use Sentry to capture errors so we can fix them; Sentry receives the URL where the error occurred, a non-PII user identifier, the name of the failed action, and the error message. Sentry does not receive form contents, profile fields, or message bodies. Neither tool is used to build advertising profiles. You can disable cookies in your browser settings, though some features may not function properly.

Depending on where you live, you may have the right to:

• Know what personal information we collect, use, share, and how we use it
• Access a copy of the personal information we hold about you
• Correct inaccurate or incomplete personal information
• Delete your personal information (with limited exceptions for legal or operational obligations)
• Port your data to another service in a structured, machine-readable format
• Opt out of the sale or sharing of your personal information (we do not sell or share, but you can confirm this in writing)
• Limit our use of any sensitive personal information (we do not collect any)
• Non-discrimination — we will not deny services, charge different prices, or provide a different level of service because you exercised your rights
• Lodge a complaint with your state attorney general or, if you are in the EU/UK, your local data protection supervisory authority

Many of these rights can be exercised directly from your account settings (update profile, toggle visibility, delete account). For requests we can’t fulfill in-product, email hello@floraltalent.com with the subject line “Privacy Request.”

To protect your data we will verify your identity before fulfilling a request, typically by confirming control of the email address on file. You may also use an authorized agent — please include written authorization. We aim to acknowledge requests within 10 business days and substantively respond within 45 days (CCPA) or 30 days (GDPR), with extensions where permitted by law and disclosed to you.

We retain personal information for as long as your account is active and as needed to provide the service. When you delete your account, we remove your personal data within 30 days, except where retention is required by law or for legitimate operational purposes. Specifically:

• Profile and account data — deleted within 30 days of account deletion
• Job listings, applications, and messages — retained for up to 24 months after account deletion to support the other party in any inquiry or dispute, then deleted
• Payment and transaction records — retained up to 7 years to comply with tax and accounting obligations
• Authentication and security logs — retained up to 90 days
• Error events (Sentry) — retained per Sentry’s default retention (typically 30–90 days)
• Aggregate analytics — retained indefinitely in non-identifying form

Floral Talent is intended for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it promptly. Parents or guardians who believe their child has provided us with personal information can contact us at hello@floraltalent.com.

Floral Talent is currently offered only to residents of the United States. We do not market the service in the European Union, United Kingdom, or other regions outside the U.S., and individuals outside the U.S. should not register for an account. Our service providers (Supabase, Vercel, Stripe, Resend, Sentry) process data in the United States.

We use commercially reasonable administrative, technical, and physical safeguards to protect your information. No system is 100% secure; if you have reason to believe your account has been compromised, contact us immediately.

In the event of a security incident affecting your personal information, we will notify you and any applicable regulators as required by law and without undue delay. We log application errors and authentication events to detect anomalies and respond quickly.

We may update this policy from time to time. Material changes will be communicated by email and reflected in the “Last updated” date above. Continued use of the service after changes take effect constitutes acceptance.

If you have questions about this privacy policy or want to exercise any of your rights, reach out through our contact page or email us at hello@floraltalent.com.