Privacy Policy

1. Who We Are

Bold Move is a technology-enabled coordination platform that connects customers with local bakery partners for custom cake delivery. We operate at getboldmove.com. "Bold Move," "we," "us," and "our" refer to the company operating this Platform. Questions about this Policy may be directed to hello@getboldmove.com.

2. Information We Collect

We collect information in the following categories, consistent with how major technology and commerce platforms collect data to operate their services:

A. Information you provide directly:

• Account information: full name, email address, phone number, and password when you create an account
• Order information: sender name, email, and phone; recipient name, company, and physical delivery address; requested delivery date; cake flavor, size, and custom message; allergy and dietary disclosures; delivery instructions
• Design uploads: images, logos, QR codes, or other artwork you submit for cake customization
• Payment information: submitted through Stripe, our third-party payment processor. Bold Move does not receive, store, or have access to your full credit or debit card number
• Communications: emails, messages, or other correspondence you send us
• Special requests and waitlist submissions: email address, city, and the details of any request you submit

B. Information collected automatically when you use the Platform:

• Device and browser information: IP address, browser type and version, operating system, device type, screen resolution
• Usage data: pages visited, time spent on each page, links clicked, order flow steps completed or abandoned, features used
• Session data: login timestamps, session duration, referral source (how you arrived at our site)
• Cookies and similar technologies: we use session cookies to maintain your login state and to understand how visitors use our Platform. See Section 9 for details.

C. Information from third parties:

• Stripe: transaction status, payment confirmation, and fraud signals associated with your transaction
• Google Maps / Places API: address verification and autocomplete data when you enter a delivery address

3. Lawful Basis for Processing (UK & EU Users)

If you are located in the United Kingdom or European Union, we process your personal data under the following lawful bases under UK GDPR and EU GDPR:

• Contract performance: Processing your order, routing to a Bakery Partner, facilitating payment, and sending order status communications
• Legitimate interests: Platform security, fraud prevention, analytics to improve the service, and communicating service updates — where these interests are not overridden by your rights
• Legal obligation: Retaining financial records as required by applicable law
• Consent: Marketing communications and non-essential cookies — you may withdraw consent at any time

4. How We Use Your Information

We use the information we collect for the following purposes:

• Order fulfillment: To route your order to a Bakery Partner, communicate order details and design files, schedule delivery, and track order status
• Payments: To process transactions through Stripe and maintain financial records
• Communications: To send order confirmations, status updates, and responses to your inquiries
• Account management: To create and maintain your account, authenticate logins, and manage your order history and rewards
• Platform improvement: To understand how users interact with the Platform, identify bugs, improve features, and optimize the order experience
• Capacity and operations: To manage bakery routing, city coverage, and demand planning
• Legal and security: To enforce our Terms of Service, detect and prevent fraud, and comply with legal obligations
• Marketing (opt-in only): To send promotional communications to users who have opted in. You may opt out at any time.

5. How We Share Your Information

Bold Move does not sell your personal information. We share your information only as follows:

• Bakery Partners: We share with the assigned Bakery Partner only the information necessary to fulfill your order: recipient name and delivery address, cake specifications, your design image, allergy disclosures, and delivery instructions. Bakery Partners are contractually required to use this information only for order fulfillment and to maintain its confidentiality.
• Stripe (payment processing):Your payment details are collected directly by Stripe under their own privacy policy. We receive transaction status and a payment reference — not your card number. Stripe's privacy policy is available at stripe.com/privacy.
• Delivery services:If a third-party on-demand delivery service (such as DoorDash Drive or Uber Direct) is used, the recipient's name and delivery address will be shared with that service to dispatch a driver. These services have their own privacy policies.
• Google Maps / Places API:Address data you enter may be processed by Google's APIs for autocomplete and verification. Google's privacy policy applies to this processing.
• Infrastructure and service providers: We use Supabase (database and file storage) and Resend (email delivery). These providers process data on our behalf under data processing agreements and do not use your data for their own purposes.
• Legal requirements: We may disclose information when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect the rights, property, or safety of Bold Move, our users, or the public.
• Business transfers:In the event of a merger, acquisition, or sale of all or part of Bold Move's assets, user information may be transferred as part of that transaction. We will notify affected users by email prior to any such transfer.

6. International Data Transfers

Bold Move is operated from the United States. If you are located in the United Kingdom or European Union, your personal data will be transferred to and processed in the United States.

For UK users: We rely on the UK's adequacy regulations and, where applicable, the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses to ensure your data is protected to a standard equivalent to UK GDPR.

For EU users: We rely on the European Commission's Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to protect your data. By using the Platform, you acknowledge this transfer. If you have questions about the safeguards in place, contact us at hello@getboldmove.com.

7. Design Images and Uploaded Content

Images, logos, QR codes, and other files you upload are stored in our secure cloud storage (Supabase Storage) and are shared exclusively with the Bakery Partner assigned to fulfill your order. Uploaded files are not used for advertising, shared publicly, or disclosed to any third party except as required by law. We may retain uploaded files as part of your order record for up to three years after fulfillment. You may request deletion by contacting us.

8. Recipient Information

When you place an order, you provide the name, company, and physical address of a third-party recipient. By providing this information, you represent that you have a legitimate business or personal reason to send a gift to that person, and that you have obtained any consent required by applicable law, including any requirements under UK GDPR or EU GDPR where those laws apply. Bold Move uses recipient information solely to coordinate and complete the delivery of your order.

9. Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Policy and to comply with our legal obligations:

• Order records and associated personal data: minimum 3 years for accounting and legal compliance (6 years for UK VAT purposes where applicable)
• Account information: retained while your account is active, plus 1 year after closure
• Uploaded design files: up to 3 years after order fulfillment
• Server logs and usage data: up to 12 months
• Waitlist and special request data: until the request is resolved or you request deletion

You may request deletion of your account and personal data at any time by emailing hello@getboldmove.com. We will process deletion requests within 30 days, except where retention is required by law (e.g., financial records).

10. Security

We implement industry-standard security measures to protect your information, including: HTTPS encryption on all connections, access controls limiting who within Bold Move can access personal data, secure cloud infrastructure through Supabase, and PCI-compliant payment processing through Stripe. However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security and are not liable for unauthorized access by third parties despite our reasonable precautions.

11. Cookies and Tracking Technologies

We use the following types of cookies:

• Strictly necessary cookies: Required for login sessions and basic Platform functionality. These cannot be disabled without affecting how the Platform works.
• Analytics cookies: Used to understand how visitors use the Platform (pages visited, time on site, drop-off points). This helps us improve the experience. We may use tools such as PostHog or similar analytics providers for this purpose.

We do not use third-party advertising cookies or sell data to advertising platforms.

UK and EU users: Under UK PECR and EU ePrivacy rules, we will request your consent before setting non-essential cookies. You can withdraw consent at any time by adjusting your browser settings or contacting us. Disabling strictly necessary cookies may affect your ability to log in or use the Platform.

12. Your Rights and Choices

Depending on where you live, you have the following rights regarding your personal information. To exercise any right, email hello@getboldmove.com. We will respond within 30 days (or within 1 calendar month for UK/EU GDPR requests).

All users:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request deletion of your personal data, subject to our legal retention obligations
• Opt out of marketing: Unsubscribe from promotional emails at any time

UK and EU users (UK GDPR / EU GDPR):

• Portability: Receive your personal data in a structured, machine-readable format
• Restriction: Request that we restrict processing of your data in certain circumstances
• Object: Object to processing based on legitimate interests, including profiling
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Lodge a complaint: UK users may complain to the Information Commissioner's Office (ICO) at ico.org.uk. EU users may complain to their local supervisory authority.

California residents (CCPA):

• You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.

13. Children's Privacy

The Platform is intended solely for users 18 years of age and older. We do not knowingly collect personal information from children under 13 (or under 16 where required by applicable law). If we become aware that a child has provided personal information, we will delete it immediately. If you believe we have inadvertently collected such information, please contact us.

14. Changes to This Policy

We may update this Policy as our services and legal obligations evolve. We will update the "Last updated" date and notify registered users of material changes by email. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy. UK and EU users will be given 30 days' notice of material changes before they take effect.

15. Contact

Privacy inquiries, data requests, or concerns: hello@getboldmove.com

UK users: If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.