Privacy Policy

At House of Flowers (בית הפרחים) we respect your privacy. This policy explains what we collect, why, who it is shared with, how long we keep it and what your rights are, under Israel's Protection of Privacy Law, 5741-1981, and its Amendment 13. The Hebrew version is the binding text.

Who is responsible for your data

The data controller is the operator of the House of Flowers shop, 230 Ben Yehuda Street, Tel Aviv-Yafo.

For any privacy question or request: tlvflowers2@gmail.com or 054-949-4201.

What we collect

• The person ordering: name, phone, email, address, and invoice details for businesses (company name and VAT number).
• The gift recipient: name, phone and delivery address (including apartment, floor and entry code), and the message you wrote for the card. You give us the recipient's details; please make sure they would not object.
• The order: products, delivery date and area, notes and payment status. Your card details never reach us (see below).
• Your account: name, phone, saved addresses, your birthday and any important dates you saved for reminders, wishlist and back-in-stock alerts.
• Loyalty programme: points balance, earning and redemption history, completed missions, and the link to any review you submitted for approval.
• Subscriptions: frequency, address, card message and preferences such as favourite flowers, flowers to avoid and pet-friendly arrangements.
• Event enquiries: name, phone, email, event date and venue, number of guests and design requests.
• Newsletter: your email address, language, and a record of your consent (time, IP address and browser type) as proof you gave it.
• Reviews: the name you chose to show and what you wrote.
• Technical data: IP address and browser details recorded in server logs for security and operation.

The plant-finder quiz runs in your browser only; your answers are not stored by us.

Why we use it

• To prepare and deliver your order and contact you about it, including status updates.
• To issue an invoice or receipt, as the law requires.
• To run your account, subscription and loyalty membership.
• To send the date reminders you asked for.
• Marketing emails, only if you explicitly agreed. Every message has an unsubscribe link, and you can also ask us.
• To keep the site secure, prevent fraud and meet our legal obligations.

We do not sell or rent personal data, and we make no automated decisions that significantly affect you.

Who we share it with

We share data only with the providers who help us deliver the service, and only what each one needs:

• Supabase: the site's database, login and file storage.
• Vercel: website hosting.
• HYP (payment provider): name, email and ID number if you gave one, to take the payment. You enter your card details directly on its payment page.
• EZcount: name, email, phone and address, to issue invoices and receipts.
• Resend: sending the site's emails (order confirmations, updates and the newsletter).
• Telegram: our team gets an alert for each new order in an internal group. It contains the order number, products, delivery time, neighbourhood and card message, but not the address, phone or email.
• Google: address autocomplete in the order form, and the map embedded on the home and delivery pages.
• Cloudflare: storing and serving product photos (no personal data).
• Couriers: the recipient's name, phone and address, for the delivery only.
• WhatsApp (Meta): when you message us on WhatsApp, the conversation runs on their service.

We also disclose data where the law or a competent authority requires it.

Transfers outside Israel

Some of the providers above (including Supabase, Vercel, Resend and Telegram) store data on servers outside Israel, including in the European Union and the United States. Data is transferred only to providers bound to keep it secure and to use it only to provide their service to us, in line with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations.

Payment security and card details

Payment takes place on the payment provider's secure page. Card details are entered in an encrypted environment and are not stored on our servers. For subscriptions, the payment provider keeps a token that allows repeat charges, not the card number.

Cookies and browser storage

The site uses no analytics tools, advertising pixels or third-party tracking cookies. We only use what the site needs to work:

• hof_lang (cookie, one year): the site language you chose.
• Local browser storage: your basket and coupon, language and colour theme, your login (if you signed in), and whether you have seen the welcome window.
• Session storage: protection against forged requests (CSRF) and a draft of the subscription form.

Because these are essential to the site, they do not require consent. You can delete them in your browser settings; your basket and language will reset. The embedded Google map may set its own cookies when it loads.

How long we keep data

• Orders, invoices and payment records: 7 years, as tax law requires.
• Unfinished orders (abandoned checkouts): deleted or stripped of identifying details after 60 days.
• Account, loyalty points and subscription: while your account is active, or until you ask us to delete it (except records we must keep by law).
• Newsletter: until you unsubscribe. The record of consent and unsubscription is kept as proof.
• Event enquiries: up to two years from the enquiry, or 7 years if a contract was signed.

Your rights

You may see the data we hold about you, ask us to correct or delete it, and ask us not to send you marketing. To use a right, write to tlvflowers2@gmail.com. We reply within 30 days and will ask you to confirm your identity before releasing data.

If you think we did not handle your request properly, you can contact Israel's Privacy Protection Authority.

Minors

The site is meant for people aged 18 and over. We do not knowingly collect data about minors, other than the name and delivery details of a minor receiving a gift.

Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page, and we will announce any material change on the site.