Privacy Policy

Information we collect

We collect the following, and only for the purposes listed in the next section.

Information you give us

• Account details: your name and email address when you create an account.
• Contact details for orders: shipping address, phone number, and the name for delivery. These are saved to your account profile if you enter them there, and they are also collected by our checkout provider when you place an order.
• Order information: what you bought, the amount, and the status of the order.
• Newsletter signup: your email address, if you choose to subscribe. This is opt in.
• Messages you send us: if you use the contact form, we store your name, email address, subject, and message so we can reply and keep a record of the conversation.

Information collected automatically

• Basic technical data such as your IP address and browser, handled by our hosting provider as part of serving and securing the site.
• Analytics data, only if you accept analytics cookies. See "Cookies and similar technologies" below.

Payment information

We do not collect or store your card details. Payment is handled entirely by Stripe on Stripe's own hosted checkout page. Your card number never reaches our servers. Stripe shares back with us the information we need to fulfil the order, such as your email address, the amount, the shipping address you entered, and whether the payment succeeded.

How we use your information

• To process and fulfil your orders, including packing, shipping, and customs paperwork.
• To send you transactional email about your order, such as order confirmations and shipping updates.
• To respond to messages you send us.
• To send occasional email about new drops and restocks, only if you opted in. Every one of those emails has an unsubscribe link.
• To operate, secure, and improve the website.
• To meet legal, tax, and export documentation requirements.

We do not sell, rent, or trade your personal information. We do use the third parties listed below to run the business, and we use Google Analytics for site measurement only if you accept analytics cookies.

Third parties that process your information

We share the minimum information needed with the following providers. Each is bound by its own contract and privacy terms.

• Stripe.Payment processing and hosted checkout. Receives: Your name, email, billing and shipping address, and payment details you enter on Stripe's page.
• Vercel. Website hosting and delivery. Receives: Technical request data such as IP address and browser, as part of serving the site.
• Supabase. Database and account authentication. Receives: Your account, profile, order, newsletter, and contact form records.
• Resend. Sending transactional and marketing email. Receives: Your email address and the contents of the message we send you. Our sending address is contact@nexusplants.com.
• Cloudinary. Image hosting for plant photos. Receives: No customer personal information. Images only.
• Google (Maps and Places). Address autocomplete on the account address form. Receives: The text you type into the address field, sent to Google as you type so it can suggest addresses.
• Google Analytics 4. Aggregate site usage measurement. Receives: Usage data tied to a Google Analytics identifier, and only after you accept analytics cookies.
• Shipping carriers. Delivering your order. Receives: Your name, delivery address, and phone number.

Cookies and similar technologies

We use two kinds of browser storage.

Functional storage, always active. This is needed for the site to work and is not used for tracking.

• The account session cookie set by Supabase when you are logged in.
• An admin session cookie (nexus_admin), only ever set on staff devices.
• Your shopping cart, stored in your browser's localStorage on your device.
• Your cookie choice itself, stored in localStorage so we do not ask again on every page.

Analytics storage, off until you accept.When the site loads, Google Analytics is set to deny all storage. Nothing analytics related loads and no analytics cookies are set unless you click "Accept" on the cookie banner. If you do not accept, Google Analytics is never loaded.

Clearing your choice. You can clear cookies and site data in your browser settings. The banner will appear again the next time you visit, and some site features may behave differently until you make a new choice.

International transfers

We operate from Thailand. Our service providers, including Stripe, Vercel, Supabase, Resend, Cloudinary, and Google, store and process data in the United States and in other countries. When you use the site or place an order, your information will be transferred to and processed in those countries, which may have different data protection rules from your own. We rely on the contractual terms offered by each provider to protect that data.

Data retention

We keep your information only as long as we need it.

• Order records: kept for 7 years after the order, to meet tax and accounting obligations.
• Account and profile data: kept until you ask us to delete your account, or until 3 years after your last order or login, whichever comes first.
• Contact form messages: kept for 2 years, then deleted.
• Newsletter subscribers: kept until you unsubscribe, then removed within 30 days.
• Analytics data: retained for 14 months in Google Analytics, then automatically deleted by Google.

When a retention period ends we delete the data or anonymise it.

Your rights

You can ask us to:

• give you a copy of the personal information we hold about you,
• correct information that is wrong,
• delete your information, subject to records we must keep by law such as completed order and tax records,
• stop sending you marketing email. You can also unsubscribe using the link in any marketing email.

To make a request, email contact@nexusplants.com. We will respond within a reasonable time. Depending on where you live, local law may give you further rights, including the right to complain to a data protection authority.

Children

The site is not directed to children. We do not knowingly collect personal information from children under 13. Customers under 18 should use the site only with the involvement of a parent or guardian, who places the order. If you believe a child has given us their information, contact us and we will delete it.

Security

Your information is held in systems operated by the providers named above, with access limited to people who need it to run the business. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page, and for material changes we will make the update visible on the site. Continuing to use the site after an update means you accept the revised policy.

Contact

Questions about your data or this policy: contact@nexusplants.com.

NEXUS BOTANICA CO., LTD., company registration number 0105569111858, Bangkok, Thailand. Our full registered address is available on request.