Privacy Policy

Who we are and how to reach us

Tudobuy Floral Studio operates this website in Charlotte, North Carolina. Privacy requests: [email protected]. Telephone: +1 (704) 379-5767. For service inquiries, please contact us by email or telephone.

This policy applies to tudobuy.com and the inquiries submitted through it. If you contact us by telephone or email instead of using the form, your message will be handled for the purpose of responding to your request. Information supplied during any later agreed service may also be needed to arrange fulfillment; the details of that arrangement are confirmed directly with you.

Information we collect

When you use the inquiry form, we collect your name, email address, selected floral service, and message. You can also provide a phone number, requested event date, and destination ZIP code. These optional details help us discuss timing, design, and delivery. The form also records your acknowledgment of this policy, a request identifier, the submission time, and whether the server successfully saved the inquiry.

To protect the form, the website generates a CSRF token, a session cookie, and a submission key used to prevent duplicates. It uses a hidden anti-spam field and a rate limiter based on a salted hash of the connecting IP address; the inquiry file itself does not store a plain-text IP address. Technical logs record events such as form rejection and successful local storage without intentionally storing the text of your message.

Please keep your message relevant to the floral request. Do not provide payment-card numbers, government identifiers, medical records, or other sensitive information through the form. No online account, shopping cart, or website payment form is provided.

How we use your information

We use the information you submit to read and answer your inquiry, understand floral preferences, discuss timing and availability, prepare a proposal where appropriate, coordinate the details of an agreed request, prevent spam and duplicate submissions, and maintain records needed to administer or resolve an inquiry. Your email address may be used to reply; a phone number is used for the inquiry if provided. We do not use form submissions to enroll you automatically in promotional emails.

How the inquiry form works

Your browser submits the form to a PHP endpoint on the website server. After checking required fields, a CSRF token, a hidden anti-spam field, and rate limits, the server saves the inquiry to a protected local file outside the publicly served website directory. A confirmation means the server successfully stored the information. The form does not email the studio or send any automatic notification, and no one is automatically alerted to a new inquiry.

Because no notification is sent, a saved inquiry should not be treated as a confirmed conversation, approved proposal, booking, or delivery arrangement. If you need a prompt response, contact the studio directly using the published email address or telephone. If the server cannot save an inquiry, it reports an error instead of displaying a success message.

Hosting and permitted disclosure

The hosting provider processes form submissions and stores the protected inquiry file. People authorized to administer the site may access stored inquiries. No inquiry email or SMTP notification is sent by this form, and the website does not transfer form submissions to an external mailing platform. We do not sell inquiry data. The current site does not use an advertising network, third-party analytics, customer tracking pixel, or marketing mailing-list system.

We may disclose relevant information where required by applicable law, to protect the website from misuse, or to establish or respond to a legal claim. If service providers, analytics tools, or processing practices change, this policy must be updated to reflect the actual operation of the site.

Retention and deletion

Inquiry records are retained for as long as reasonably necessary to answer and administer the request, address follow-up questions, protect against abuse, and meet applicable legal obligations. The software supports a configurable retention period of 730 days, but automatic deletion is not currently active. Records are therefore removed through administrative action or upon an appropriate verified deletion request until a retention schedule is configured and operated. Website backups, if enabled by the hosting provider, may have their own rotation periods.

To request deletion, contact the privacy email listed above and, if available, provide your request ID or the email address used for the inquiry. We may need enough information to confirm that the record belongs to you. Some information may be retained when reasonably necessary for legal, security, or dispute-resolution purposes.

Security

The form uses server-side field validation, security tokens, anti-spam controls, and limits on repeat submissions. Stored inquiries are intended to remain outside the public document root with restricted access. Website responses do not expose stored inquiry contents or server file locations. Transport security depends on the website being served over HTTPS; no mail transport is used by the form.

No online service can guarantee absolute security. If you believe an inquiry was sent incorrectly or your information has been exposed, contact us promptly using the details above.

Your privacy requests and choices

You may request access to the information you provided, ask us to correct inaccurate details, or request deletion where applicable. We will consider requests according to applicable law and may ask for reasonable verification before disclosing or changing a record. You can also choose not to submit the form and instead contact the studio by the published channels. We do not use a newsletter subscription or promotional opt-in through this form.

Cookies and analytics

The form uses a first-party session cookie named TUDOBUYSESS to connect a browser session to its CSRF protection. It is not an advertising identifier. The current site does not load Google Analytics, Google Ads remarketing, social tracking pixels, or persistent marketing cookies. See our Cookie Policy for details and browser controls.

Children, external websites, and changes

The site is intended for people arranging floral services and is not designed to collect information from children. If you believe a child submitted personal information, contact us for assistance. Links to third-party websites, if any, are governed by those sites' own privacy practices.

We may revise this policy as our website, services, or legal obligations change. The effective date above identifies the current version. For privacy questions, use [email protected].