Privacy Policy

Effective July 5, 2026

This policy explains how Toccata Inc. (“Toccata”, “we”, “us”), a Saskatchewan, Canada company and the operator of Florlist, collects, uses, and protects personal information. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy law.

1. What we collect

• Account information: name, email address, password (stored hashed by our authentication provider), and business details such as farm or shop name and location.
• Storefront content: photos, descriptions, pricing, availability, and anything else a Farm publishes.
• Transaction data: orders, order messages, fulfillment details, refunds, and (where card payments are enabled) payment status. Card numbers are handled by Stripe and never touch our servers.
• Subscriber data: email addresses and names that visitors submit to subscribe to a Farm’s updates. This data belongs to the relationship between the subscriber and that Farm.
• Usage data: page visits and feature usage on Farm storefronts and dashboards, used for analytics shown to Farms and to improve the Platform.

2. How we use it

• To operate the Platform: storefronts, orders, messaging, notifications, analytics, and support.
• To send transactional email (order confirmations, notifications) and, where a Farm enables it, marketing email to that Farm’s subscribers.
• To build anonymous, aggregated market pricing for farms that opt in. Aggregates never include names or farm identities.
• To power AI features: review moderation and theme generation. Content sent to AI providers is used to deliver the feature, not to train their models.
• To protect the Platform against fraud and abuse, and to comply with legal obligations.

3. Who we share it with

We do not sell personal information. We share it only with service providers who help us run the Platform:

• Amazon Web Services (Canada region) hosts our infrastructure and data.
• Stripe processes card payments and identity verification for Farms that enable payments.
• Amazon SES delivers email on our behalf.
• AI infrastructure (Amazon Bedrock) processes content for moderation and theme generation.
• Authorities, where required by law, or parties to a corporate transaction (merger, acquisition) under equivalent confidentiality.

4. Cookies and local storage

We use browser storage for essential purposes only: keeping you signed in, remembering your cart on a Farm’s page, page-password unlocks, and course progress. We do not use third-party advertising trackers.

5. Retention

We keep personal information for as long as your account is active or as needed to provide the Platform, comply with legal obligations (for example, transaction records), resolve disputes, and enforce agreements. When a Farm deletes a subscriber, or you delete your account, associated personal data is removed from active systems within a reasonable period, subject to backups that roll off on a schedule.

6. Your rights

• You may access, correct, or delete your personal information. Much of this is available directly in your dashboard; for the rest, email us.
• Subscribers can be removed from a Farm’s list by the Farm, or by contacting us.
• You may withdraw consent to optional processing (like the Market Report opt-in) at any time, without losing access to the core Platform.
• You may complain to the Office of the Privacy Commissioner of Canada if you believe we have mishandled your information.

7. Security

Data is encrypted in transit, stored in Canadian AWS regions, and access is limited to what operating the Platform requires. Authentication is handled by AWS Cognito; payment credentials are handled entirely by Stripe. No system is perfectly secure, and we encourage strong, unique passwords.

8. Children

The Platform is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under the age of majority.

9. Changes

If we make material changes to this policy, we will announce them on the Platform or by email before they take effect.

10. Contact

Privacy questions and requests: Toccata Inc., Saskatchewan, Canada · support@florlist.com

Florlist is owned and operated by Toccata Inc., Saskatchewan, Canada.