BakePorch Privacy Policy

# BakePorch Privacy Notice **Effective date: October 24, 2026** ## 1. Who we are BakePorch (bakeporch.com) is an online platform that lets independent home bakers and small food businesses create a storefront, manage products, recipes, bake dates and orders, and sell to their own customers for pickup or delivery. BakePorch is owned and operated by IT Tech LLC, 18930 E Garden Dr, Aurora, CO 80015 (support@bakeporch.com). This notice covers: - **Sellers:** people who create and run a storefront on BakePorch, and their staff. - **Shoppers:** people who visit a BakePorch storefront to browse or order. Each Seller is an independent business. When you order from a Seller, that Seller also receives your order details and handles them under its own practices. ## 2. Information we collect **From Sellers** - **Account information:** name, email address, password (stored only in hashed form), and staff roles and permissions. - **Business information:** business name, location, timezone, how you sell, what you sell, description or story, logo and photos, pickup locations, bake dates and ordering settings. - **Product and recipe information:** products, prices, options, ingredients, allergen statements, private recipes, and inventory or purchase records. Private recipes and ingredient details are never shown to Shoppers. - **Plan and billing records:** your plan, fees and any manual payment records. **From Shoppers** - **Order information:** name, email address, phone number if provided, order contents, pickup or delivery details, and order history with a given Seller. - **Payment information:** card payments are processed by Square. We do not collect or store full card numbers. - **Reviews** you choose to leave after an order. **From everyone** - **Technical and usage information** collected automatically, such as browser and device type, pages visited, and approximate location based on IP address (see section 6). ## 3. How we use information We use information to: - run BakePorch: create accounts, build and host storefronts, process orders and manage staff access; - send account and order messages, such as order confirmations and pickup reminders; - provide the AI-assisted features described in section 5; - keep the platform secure and prevent fraud and abuse; - understand how BakePorch is used and improve it; - meet legal, tax and accounting obligations. ## 4. How we share information We share information only as needed to provide the service: - **With the Seller you order from,** so they can fulfill your order. - **With service providers** who work on our behalf under confidentiality obligations: - Square (card payments); - OpenAI (AI-assisted features, see section 5); - Twilio and mobile carriers (text messages); - SMTP2GO (email delivery); - hosting and infrastructure providers. - **With advertising partners, only as described in section 6** (Meta measurement on storefronts). - **When required by law,** or to protect the rights, safety or property of BakePorch, our users or the public. - **In a business transfer,** such as a merger or sale, subject to this notice. We do not sell personal information. We do not share a Seller's private recipes or ingredient details with anyone outside that Seller's authorized staff. ## 5. AI-assisted features BakePorch uses OpenAI to power these features: 1. **Storefront drafting.** When you create a store, we send your business name, location, how and what you sell, and any story, logo or images you provide to OpenAI to create a draft of your storefront: wording, layout suggestions, FAQs and images. This is explained next to the signup form. You can edit or replace everything before publishing. If you'd prefer we not use AI for your store, contact support@bakeporch.com before or after signing up and we'll set up your storefront without it. 2. **Photo adjustment.** When you upload a photo to your storefront, we may use AI to remove or adjust the background, lighting and framing so it fits your store's design. We keep your original photo, and you can choose to use it unchanged. 3. **Recipe reading.** If you upload a recipe (photo, PDF, Word or text file, including handwritten recipes), we use OpenAI to read it and fill in recipe and ingredient fields. Recipe files stay private to your store and are never used as public photos or shown to Shoppers. Material you submit for these features is used only to produce the requested result for your store. It isn't used to train BakePorch's own models. OpenAI processes it under its API data-use terms, which state that API data is not used to train OpenAI's models by default. Only upload material you have permission to use. ## 6. Cookies, analytics and advertising measurement **Essential cookies** keep you signed in and make the site work. Blocking them may break parts of the site. **First-party analytics.** On public pages and storefronts, BakePorch automatically collects first-party analytics. This includes: - referral sources and campaign tags; - pages and products viewed, and product availability; - cart and checkout activity; - signup-form interactions (not the values you type), navigation between pages, technical error categories, and confirmed registrations; - active viewing time, attributed paid orders, and approximate country, region and city based on IP address. Scoped browser identifiers tell new visits from returning ones. Each storefront has its own identity scope. Sellers see reports only for their own store. We do not record sessions, form contents or GPS location. Visit records are kept for 90 days and browser identifiers for up to 180 days. We honor Global Privacy Control and Do Not Track signals. There is currently no on-site analytics consent banner. **Security and diagnostics.** For security and troubleshooting, we keep restricted diagnostic records for up to 30 days, visible only to BakePorch platform administrators. These can include: - full IP address and approximate network; - browser, operating system and device type; - screen size, language and timezone. To separate our own and Sellers' internal activity from real customer traffic, we use a signed first-party cookie across the platform and storefronts. We may link a browser to a Seller account after that Seller signs in, and keep those links for up to 180 days. We do not use canvas, WebGL, font or audio fingerprinting, and IP addresses are never used to merge visitors. **Meta advertising measurement (optional).** If you allow Meta advertising measurement on a storefront, Meta Pixel and the Meta Conversions API send Meta: - page and product activity; - purchase identifiers, products, order values and currency; - browser and click identifiers, IP address and browser information. Purchases may include a hashed (SHA-256) email address for matching. Hashed identifiers can still be matched to you, so they are not anonymous. Declining doesn't affect ordering, and you can withdraw permission in a storefront's Meta advertising privacy settings, though data already sent can't be recalled. We honor Do Not Track and Global Privacy Control, and exclude internal and test traffic. Encrypted checkout matching data is kept for up to 45 days. Pending delivery data is removed within 7 days of the purchase event. Meta processes the data it receives under its own privacy policy. ## 7. Email and text messages **Order messages.** Confirmations and pickup reminders are part of placing an order and are not marketing. **Seller email updates.** Shoppers can sign up for a specific Seller's updates about upcoming bakes and ordering windows. - Public signups require you to click Subscribe and confirm by email. Pending confirmations expire after 72 hours. - Sellers may import an existing subscriber list only after confirming and documenting that those people agreed to receive their emails. - We send through SMTP2GO. Lists are never shared between Sellers. - Every marketing email has an unsubscribe link. Unsubscribing doesn't stop order messages. - We keep opt-out records so you aren't re-added later. **Text messages (SMS).** SMS updates are optional, specific to one Seller, and separate from email. - Signing up requires a separate unchecked consent box and confirmation by text. - Sellers may import up to 100 customers who already gave that Seller permission to text, after recording and confirming that permission. Importing doesn't send a message. - An order or email signup is not consent to texts. - We store the number, the Seller, the consent wording or recorded permission, timestamps, subscription status, opt-out records and delivery status. - Twilio and carriers process the messages. - Mobile information is never sold or shared with third parties or affiliates for their marketing. - Reply STOP to stop all texts from the shared BakePorch number, or HELP for help. Each marketing text also links to a Seller-specific unsubscribe page. Stopping texts doesn't cancel orders or change email subscriptions. Full details: [SMS opt-in policy](/terms/sms). ## 8. How long we keep information - **Account and order information:** while your account is active, then as needed for legal, tax and legitimate business purposes. - **Private recipes and ingredient data:** until you delete them or close your account. - **Analytics and diagnostics:** for the periods listed in section 6. - **Opt-out and suppression records:** kept so we can keep honoring your choice. ## 9. Your rights and choices Depending on where you live, you may have the right to access, correct or delete your personal information, to get a copy of it, and to opt out of certain uses. This includes residents of California (CCPA/CPRA), other US states with privacy laws, and the EU/UK (GDPR) where it applies. To make a request, email support@bakeporch.com. We'll verify your request and respond within the time the law requires. If you're a Shopper asking about an order, we may forward your request to the Seller you ordered from. ## 10. Security We use reasonable safeguards to protect information, including password hashing, encrypted connections and restricted administrative access. No system is completely secure, so we can't guarantee absolute security. ## 11. Children BakePorch is not intended for children under 13, and we don't knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it. Seller accounts require users to be 18 or older. ## 12. Changes to this notice We may update this notice. We'll post the new version here with a new effective date, and take reasonable steps to notify Sellers and Shoppers of material changes. ## 13. Contact IT Tech LLC — BakePorch Aurora, CO 80015 support@bakeporch.com