01Who we are
Bunchy is responsible for the details of florists and their staff who use Bunchy. For the details of a florist's customers, the florist is responsible and Bunchy looks after them on the florist's behalf (see our data processing addendum). Contact us through Help in your portal or at hello@bunchy.co.uk.
02What we collect about you, the florist
Your name, email address and password (stored scrambled, so nobody can read it), your shop's name, address, phone number, company and VAT numbers, and what you do in the portal so we can keep it working and secure. If you write to our help desk, we keep the conversation.
03What we hold for your shop
Your customers' names, email addresses, phone numbers and addresses, the people they send flowers to, card messages, orders, invoices, delivery photos and emails sent from your shop. We use these only to run your shop for you.
04Why we use it
To provide Bunchy to you under our agreement, to keep it safe and working, to send you emails about your account (for example a payment that didn't go through), and to keep proper accounts as the law requires. We'll only send you news about Bunchy if you're happy to get it, and you can stop it any time.
05Who we share it with
Only the services that help us run Bunchy:
- Cloudflare, which hosts the platform and stores your data and photos.
- Amazon Web Services, which keeps our encrypted backups and security records in London.
- Stripe, which handles card payments: your customers' payments, and your Bunchy subscription.
- The AI providers behind Bunchy's AI help and the shop assistant: Anthropic's Claude, run by Amazon Web Services in the UK or the EU, or Cloudflare Workers AI if Claude isn't available. They process the text sent to them to give an answer, don't keep it afterwards and don't use it to train their models.
- Our email delivery service, to send order confirmations and other emails from your shop.
- Google, only on a florist's website where the florist has switched on Google Analytics, and only for shoppers who say yes to analytics cookies.
Some of these services may handle data outside the UK. When they do, it's protected by the UK's approved safeguards, such as the International Data Transfer Addendum. We never sell personal details.
06How long we keep it
Orders, invoices and payments are kept for 6 years after the end of the financial year they belong to, because the law requires accounts to be kept (UK VAT and company law); we delete them after 7 years. Delivery photos are deleted automatically after 12 months. The contents of emails sent from your shop are deleted after 18 months (we keep a short note that an email was sent, for as long as the order it was about). Website visit counts are kept for 26 months, your shop's activity log for 2 years, suggestions from the assistant for 12 months and messages to our Help desk for 2 years after the last one.
When you close your shop, we keep it so you can reopen it. If you choose "Delete this shop permanently" (or ask us from Help), we delete it 30 days later: your website, products, orders, customers, photos, emails and team logins. A shop that stays closed or without a plan is deleted 13 months after it closed, after we've emailed the owner. The only thing we keep is a copy of the shop's invoices and credit notes without the customers' names or contact details, because tax law requires them to be kept; we delete that copy 7 years after each invoice was issued. Our security records keep only coded ids, never names or emails, for up to 7 years.
Deleted details leave our encrypted backups within 90 days, as the backups expire.
07Cookies
The portal uses one cookie to keep you signed in. Florists' shop websites use cookies they need to work, such as the basket. If a florist switches on Google Analytics, their website asks shoppers first and only loads it if they say yes. Bunchy's own welcome page and designs gallery count visits with Cloudflare Web Analytics, which uses no cookies and doesn't identify you. Visitors in the EU aren't counted. If you arrive through another florist's invite link, one cookie remembers who invited you for 60 days, so the free month reaches you both.
08The assistant on this website
The “Ask a question” chat on platform.bunchy.co.uk is an AI assistant, and it says so. It answers only from a fact sheet about Bunchy and can make mistakes. What you type is sent to the AI providers named above to work out an answer, and isn't used to train them. We don't save the conversation: we only count questions, and keep a scrambled (hashed) form of your internet address for up to a day to stop misuse. Please don't type personal or payment details into it. To reach a person, write to hello@bunchy.co.uk.
09Keeping it safe
Everything is sent over secure connections, passwords are scrambled, card messages and phone numbers are encrypted, each team member only sees what their role needs, sign-in can be protected with a second step, and we keep encrypted daily backups in a separate place (Amazon Web Services in London) for 90 days.
10Your rights
You can ask to see, correct, download or delete the details we hold about you. Write to hello@bunchy.co.uk. If you're unhappy with how we've used your details, you can complain to the Information Commissioner's Office (ico.org.uk), but please talk to us first.
If you're a customer of a florist, please contact the florist first: they're in charge of your details, and we'll help them answer you.