Privacy Policy

Effective date: November 8, 2026

Sarah Lilly's ("we," "us," "our") sells freeze dried novelty candy and treats and freeze dried teas through our website, https://sarahlillys.com, and by local pickup. This policy explains in plain English what information we collect, why, and the choices you have. Our address is 18314 Argyle Park Trace, Richmond, Texas 77407, USA.

The short version: we collect only what we need to run the shop and answer you. We do not sell your information, we do not share it for advertising, and we do not use advertising cookies or tracking pixels. We do use simple, privacy-friendly analytics of our own to see how the site is used (see "Analytics" below).

Notice at collection

At or before the time we collect your information, here is what we collect and why:

Account information (name, email, password) so you can sign in and view your orders.
Order information (items, totals, shipping address, name, email) so we can fill, ship, and support your order.
Messages you send through the contact form or chat, and email addresses you give us for our email list, so we can reply and keep in touch.

We do not sell or share this information, and we keep it only as long as described in the "How long we keep information" section below.

What we collect

Account details: your name, email address, and password. Your password is stored only as a salted hash, so we cannot read it.
Order records: the items you bought, order totals, shipping address, name, and email. These are kept in our database hosted on Cloudflare.
Payment information: payments are processed by our payment partners. We never see or store your card numbers.
Contact form and chat messages: what you write to us, along with the contact details you provide, stored so we can respond.
Email signups: the email address you give us when you join our list, or when you tick the box to receive specials and news at sign-up, at checkout, or in your account.
Discount codes and order status: if you enter a discount code, we record the code and the amount taken off with your order. We also keep your order's status (for example paid, shipped, or ready for pickup) and any tracking details, so we can show them in your account and email you updates.
Phone and text: if you call or text us at 701-721-7965 or email us, we see the information you choose to send.

Why we use your information

To create and manage your account.
To process, ship, and support your orders, including pickup scheduling and returns.
To answer your questions and messages.
To send you our marketing emails if you opted in (you can unsubscribe at any time).
To send order-related emails, such as order confirmations and shipping or pickup updates, and to apply discount codes you enter.
To understand which pages and products are popular so we can improve the shop.
To keep the site secure and working properly.

Who processes your information

We use a few service providers to run the shop. They handle information only to provide their services to us.

Payment processors (Stripe for cards and digital wallets, and PayPal for Venmo and some card payments) process your payment. Their handling of your payment details is governed by their own privacy statements.
Cloudflare hosts our website and the database that holds account and order records.
Cloudflare Workers AI powers our chat assistant. When you use the chat, your messages are processed by this service to produce answers. Please do not type sensitive personal details, such as health information or payment card numbers, into the chat.

We do not sell your personal information, and we do not share it for advertising.

Cookies and local storage

One essential session cookie is set when you sign in, so the site knows you are signed in. It is needed for the account to work.
Local storage: your shopping cart is saved in your browser's local storage so it is still there if you come back. It stays on your device.
We use no advertising cookies and no tracking pixels. Our own analytics (below) do not use cookies.

Analytics

We run a simple, privacy-friendly analytics system of our own, on our own website and database. It records page views, the website you came from (the referrer's domain only), your general device type (mobile, desktop, or tablet), and which buttons are used, such as add to cart and begin checkout. It uses no cookies, does not store your IP address, and does no cross-site tracking; it is not linked to your name or account and we do not share it with anyone. It is used only to understand how the shop is used and to improve it. We honor Do Not Track and Global Privacy Control signals: if your browser sends either one, the analytics do not run for you.

Email

Marketing emails (specials, news, and offers) are sent only to people who opted in, by signing up on our site, ticking the box when creating an account, or ticking the box at checkout. Nothing is pre-checked.
Every marketing email has an unsubscribe link. You can also unsubscribe at any time from the Email preferences section of your account, or by emailing us.
Transactional emails, such as order confirmations, shipping and pickup updates, and password resets, are separate. They are sent because of something you did and are not marketing, so unsubscribing from marketing does not stop them.
We do not sell or rent our email list.

Do Not Sell or Share My Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral (targeted) advertising. We do not use your personal information for targeted advertising or profiling.

Because we do not sell or share personal information, there is nothing to opt out of, but we respect your choice anyway. We honor opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of any sale or sharing. If you would like to confirm your preference or have questions, email our contact form (sarahlillys.com/contact).

How long we keep information

Account information is kept until you ask us to delete your account.
Order records are kept as long as needed to support returns, answer questions, and meet our business, tax, and legal record-keeping needs.
Contact messages, chat messages, and email signups are kept as long as needed to reply and stay in touch, or until you ask us to delete them. If you unsubscribe, we stop sending marketing emails and keep only a record that you opted out.
Analytics are kept in aggregate form and are not tied to you personally.

Security

We take reasonable steps to protect your information. Passwords are stored only as salted hashes, card numbers are handled by our payment partners and never reach us, and our data is kept with Cloudflare. No online service can promise perfect security, but we work to keep your information safe.

Children

Our site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.

Your rights

Everyone can ask us to do the following, and we will honor these requests no matter where you live:

Access: find out what personal information we hold about you and get a copy.
Correct: fix information that is wrong or out of date.
Delete: ask us to delete your personal information.
Opt out: opt out of the sale or sharing of personal information, targeted advertising, and profiling (we do none of these).
Appeal: if we decline your request, you can appeal our decision.

California residents: under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), you have the rights to know, delete, correct, and opt out of sale or sharing, and the right to limit use of sensitive personal information. We do not sell or share personal information and we do not discriminate against you for using your rights.

Texas residents: under the Texas Data Privacy and Security Act, you have the rights to confirm and access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, sale, and profiling. You may appeal a denied request, and if you are unhappy with the result of an appeal you may contact the Texas Attorney General.

How to make a request

Use our contact form or call or text 701-721-7965. Tell us what you would like to do and the email address on your account or order so we can find your records. We may need to confirm it is really you before acting, for example by replying to the email on your account. We respond within 45 days. To appeal a decision, reply to our response or email us with the word "Appeal" in the subject line. You may also use an authorized agent to make a request on your behalf.

How to delete your account

Use our contact form, writing from the address on your account, or call or text 701-721-7965, and ask us to delete your account. We will delete your account information and other personal information we are not required to keep, and let you know when it is done. Some order records may be kept where needed for returns, taxes, or other legal and business record-keeping.

Changes to this policy

If we change this policy, we will post the updated version on this page and update the effective date at the top.

Contact us

Sarah Lilly's
18314 Argyle Park Trace, Richmond, Texas 77407, USA
Phone/text: 701-721-7965
Contact form: sarahlillys.com/contact

This policy is provided for information and is not legal advice.