Privacy Policy

Who we are

Bonsai Wonderland (“we”, “us”) is a free bonsai care library and shop operated by Tranquil Pots LLC, 2603 Lakeview Drive, Florence, SC 29505, USA. You can reach us any time at [email protected].

Information we collect

Information you give us:

• Email address — when you sign up for seasonal care reminders or a newsletter.
• Order and shipping details — your name, shipping address, email, and items when you place an order. Card payments are processed by Stripe; we never see or store your full card number.
• Your saved trees and preferences — the “My Trees” list you build, and your USDA hardiness zone if you provide it. Your My Trees list is stored in your own browser unless you subscribe to reminders, in which case the tree list is saved with your subscription so we can email the right advice.
• Messages — anything you send us by email.
• Sign-in information (when available): if you choose to sign in with Google or Facebook, we receive your name, email address, and profile picture from that provider. We do not receive your password.

Information collected automatically:

• Usage analytics — we use privacy-friendly, self-hosted analytics (Umami) and may use Google Analytics to understand which pages are useful. This includes pages viewed, approximate location, device and browser type, and referring site.
• Essential storage — small amounts of local storage/cookies needed to remember your cart, your saved trees, and your preferences.

How we use your information

• Fulfil and deliver your orders, and contact you about them.
• Send the seasonal reminders and newsletters you opted into (and only those).
• Operate, secure, and improve the site.
• Respond to your questions and support requests.
• Comply with the law and enforce our terms.

We do not sell your personal information, and we do not use it to serve ads.

Who we share it with

We share information only with the service providers needed to run the site, and only what they need:

• Nursery partners (e.g. Bonsai Boy of New York) — to pack and ship the items you order.
• Stripe — to process payments securely.
• SMTP2GO — to deliver our emails.
• Analytics providers — as described above.
• Google and Meta (Facebook) — only if you choose to sign in with them.
• Authorities — only when legally required, and only under the process described in “Government & law-enforcement requests” below.

Government & law-enforcement requests

We treat any government, law-enforcement, or other legal request for user information seriously, and we disclose personal data in response only when we are legally required to do so. When we receive such a request, we follow this process:

• We review each request for legality. Before disclosing anything, we check that the request is valid and legally sufficient — that it is properly issued, comes through appropriate legal process (for example a subpoena, court order, or warrant suited to the data sought), identifies the data with reasonable specificity, and actually applies to us and to information we hold.
• We challenge requests that appear unlawful or overbroad. If a request is defective, overbroad, vague, improperly served, or otherwise unlawful, we push back rather than comply automatically — seeking to narrow it, requiring proper legal process, or objecting to or declining it, with qualified counsel where appropriate.
• We disclose the minimum necessary. Where a valid request must be honoured, we release only the specific data the request legally requires — the least amount needed to comply — and we object to demands for more than that. This is separate from, and in addition to, our general practice of collecting as little personal data as possible in the first place.
• We give notice where permitted. When we are legally allowed to do so, we will try to notify the affected user before disclosing their information, so they have a chance to respond, unless a valid legal order prohibits it or there is an emergency involving risk to someone’s safety.
• We document what happens. We keep a record of the legal requests we receive and how we handle them — what was requested, who made the request, the legal basis cited, our own review and reasoning, what (if anything) we disclosed, and the dates involved.

As a small operation we receive such requests rarely, if ever; this is the process we commit to following whenever we do. If you have questions about it, contact [email protected].

Your choices and rights

• Unsubscribe from reminders or newsletters any time via the link in every email.
• Access, correct, or delete your information — email [email protected] and we’ll take care of it.
• Clear your device — your My Trees list and cart live in your browser; clearing site data removes them.

Deleting data from Facebook sign-in

If you signed in with Facebook and want the data we obtained deleted, email [email protected] with the subject “Facebook data deletion”. We will delete the associated account information within 30 days and confirm when it’s done.

Data retention & security

We keep personal information only as long as needed for the purposes above (for example, order records for accounting, or your reminder subscription until you unsubscribe), then delete or anonymise it. We use reputable providers and reasonable safeguards to protect your data, though no method of transmission over the internet is 100% secure.

Children

Bonsai Wonderland is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we’ll remove it.

Changes to this policy

We may update this policy from time to time. We’ll change the “Last updated” date above and, for significant changes, do our best to let subscribers know.

Contact

Questions about your privacy? Email [email protected]. See also our Terms of Service and shipping & returns.

This policy is provided for general information and is not legal advice. We recommend reviewing it with qualified counsel for your specific situation.