Privacy Policy

Account, contact, and order information:

• Name, email, phone number, account credentials, saved recipients, and preferences
• When you choose Google or Apple sign-in: the provider's stable account identifier plus the verified email, display name, and profile image the provider makes available. Apple may provide a private relay address. Topinu does not receive your Google or Apple password.
• Billing address, delivery address, recipient details, text/audio/video gift messages, access notes, and requested delivery windows
• Order, cart, product, add-on, support, refund, and fulfillment history
• Flora Pass plan, trial, renewal, cancellation, entitlement, and payment-status records
• Stripe customer, payment, subscription, connected-account, transfer, and refund identifiers; Stripe processes card and bank details directly

Flora and customer-support information:

• Chat messages, product recommendations, availability notices, support requests, and conversation status
• Event Studio briefs, proposals, messages, and private photo attachments shared with the florist selected for that event conversation
• Actions an authorized florist takes in the conversation, such as sending a product, updating the customer cart, or requesting checkout
• Operational records needed to attribute, secure, troubleshoot, and audit those actions

Automatically Collected Information:

• User-Agent and coarse device information (browser and version, operating system and version, device class or model when the browser provides it, and preferred language)
• Public client IP address, trusted proxy source, and approximate city/region location supplied by our edge provider; an IP may represent a carrier, VPN, or proxy rather than a person
• Pages visited and time spent on our site
• Referring website or search terms
• Shop interactions such as chat, product views, cart activity, and checkout progress
• Security, error, performance, and provider request metadata

Delivery and mapping information: We process delivery addresses, verified coordinates, delivery windows, route order, estimated arrival information, and fulfillment status. When a driver chooses to share location on an active shop route, authorized staff can follow the latest work location. Once a purchaser's delivery is within three stops, that purchaser can see their own destination and an approximate driver area based on a location recorded within the last five minutes. The last approximate location may remain visible for that period after sharing stops. Purchasers cannot see other recipients, their addresses, the full route, or delivery proof photos. Guests must have a private email link and enter the email or phone used at checkout; these links are not sent to gift recipients. Location collection stops when the driver leaves the active route screen.

Personal routing information: When you use Topinu Routes for your own trips, we process the route name and date; destination names, street addresses, map coordinates, order, and optional notes; completion state; and generated route geometry, distance, and duration. Personal routes are private to your signed-in account and are separate from florist deliveries. Florists cannot view them through merchant tools. Authorized Topinu personnel may access this information only when needed to operate, secure, troubleshoot, or support the service.

Topinu Go information: The app processes your account and session, saved stops and personal routes, florist-assigned deliveries, route assignments, destination addresses and coordinates, priority and completion state, delivery notes, and synchronization status. If you choose current location for a route or enable live sharing on an active delivery route, the app processes foreground location while that feature is in use. Topinu Go does not request background location. It can use the camera or photo library only when you choose a delivery-proof image. Authentication secrets are stored in protected device storage. Current work and an offline synchronization queue use app-local storage so approved work can recover after an interruption.

Topinu Manager information: For invited shop staff, we process identity, shop membership, role and permissions, sessions, and attributed operational actions. Authorized staff may access and update the customer, recipient, order, delivery, route, support, refund, product, activity, catalog, and merchant-sync information required for their role. When notifications are enabled, we process the device push token, platform, notification preferences, quiet hours, and delivery or error status. Notification previews are designed not to include private customer or recipient content.

Shop media and optional AI tools: Topinu Manager accesses a photo or video on your device only after a staff member chooses the camera or media library. Product Studio and Activity can upload shop-selected product or activity media and related titles, descriptions, prices, availability, audience, and publication state. Images prepared by the app exclude location metadata. When an authorized staff member intentionally requests a Premium AI suggestion, Topinu sends the selected product image, or a bounded image/contact sheet derived from selected activity media, together with relevant shop and editor context to the configured AI provider. For video, only selected visual frames are analyzed; audio is not transcribed. AI suggestions require staff review and are not published automatically.

Delivery proof photos: For an unattended handoff, the assigned driver photographs the arrangement in its safe placement. A driver may also add an optional arrangement photo after handing an order to the recipient, but must not photograph a person without consent. The app instructs drivers to avoid faces, home interiors, labels, and unrelated personal details and removes photo location metadata before upload. The selected florist's authorized staff and authorized Topinu platform personnel may view a private proof photo when needed to verify fulfillment, resolve a delivery question, operate the service, or investigate security.

Anonymous storefront identity: We place a random, first-party identifier in a secure browser cookie so your chat and shopping journey can continue and the florist can understand genuine interest. The database stores a one-way hash of that identifier. We do not build a device fingerprint from fonts, hardware, canvas, or similar signals.

Topinu Manager's Premium AI tools are optional editor aids. An authorized staff member chooses when to analyze selected media and remains responsible for reviewing product facts, prices, availability, claims, audience, and publication settings. Topinu does not automatically publish AI-generated copy or change a product or activity based only on an AI response.

These tools are separate from Flora chat. The storefront data-sharing setting described below applies to Flora chat inputs and outputs; it does not turn shop media into public content. Do not submit faces, recipient details, delivery labels, private addresses, or other sensitive personal information for product or activity analysis.

Flora uses your current message, relevant conversation history, selected shop context, and shopping information to produce a response. Flora can make mistakes. Do not include complete card numbers, government identifiers, medical information, or other sensitive information in chat.

When a conversation is escalated, authorized staff for the selected florist can view the customer-visible conversation, product cards, cart snapshot, and support history needed to assist you. Platform support administrators may access a conversation when needed to operate, secure, or troubleshoot the service. We do not display private model reasoning to florist staff.

Staff-assisted cart changes and checkout requests are attributed in the conversation. You remain responsible for reviewing the current cart, delivery details, total, and payment terms before completing checkout.

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

• Payment transactions are transmitted over encrypted connections
• Card and connected-account onboarding data are collected and processed by Stripe
• We never store your complete credit card information
• Access to personal data is restricted to authorized personnel only

No system can guarantee absolute security. Please use a unique password and contact us if you believe your account or order information has been accessed improperly.

We retain information only for as long as reasonably necessary for the purpose collected, including to:

• maintain your account, active cart, Flora and Event Studio conversations (including sent private attachments), private digital gift media, membership, order, delivery, and support history;
• complete payments, payouts, refunds, accounting, fraud review, and legal or tax obligations;
• resolve disputes, enforce agreements, and maintain security and audit records; and
• honor consent, deletion, suppression, and communication-preference records.

Anonymous browser and unconverted lead records expire on a shorter operational schedule. Raw lead IP addresses and browser/device context are restricted to authorized platform administrators and expire on a configurable short operational schedule. Florist staff receive only aggregated, approximate city-level patterns—not individual IP addresses, User-Agents, or visitor dots. Using “Forget Topinu activity” removes the current anonymous browser link and unconverted lead activity, but it does not erase Google Ads measurement data, completed orders, payment records, security records, or an account you created where retention remains necessary or legally required.

Delivery proof photo access ends 90 days after the delivery is finalized. Access and replay eligibility for a secured photo held through an offline or interrupted completion end at its 90-day server deadline even if the delivery is not finalized; deletion becomes due at that deadline. Cancellation, reassignment, or abandonment may make deletion due earlier. Deletion is completed asynchronously with a storage-lifecycle backstop; the delivery status, method, notes, and non-image audit history may remain as part of order, dispute, accounting, security, or legal records.

Personal routes and their destinations remain with your account until you delete a stop or route, request account deletion, or they are no longer reasonably needed to provide the routing service. Deleting a personal route removes its active route and destination records; limited backups, security logs, or legally required records may remain for a bounded period. You may also request access, correction, portability, or deletion through the contact below.

Topinu Go provides permanent account deletion from its Account screen. You must be online and verify a linked password, Google, or Apple sign-in; deletion requests are not stored or retried while offline. Deletion signs you out everywhere, removes personal routes, private mobile data, and shop memberships, and durably schedules renewable Flora Pass cancellation and billing-customer cleanup as part of the committed deletion. A sole active shop Owner must transfer ownership or close the shop first. Active assigned routes, pending order payments, open store checkouts, and Flora Pass changes or checkouts must also be resolved before deletion. Completed or cancelled order records are retained only in anonymized form, while information still needed for active fulfillment, refunds, fraud prevention, tax, disputes, security, or other legal obligations may be retained for the applicable period.

Topinu Manager product, activity, catalog, and shop media remain until an authorized user removes them or they are no longer reasonably needed for the shop, publication, support, security, or legal purpose. Disabling notifications removes the app's current push registration from the active account flow; sign-out and invalid or expired registrations are also cleared through normal session and provider cleanup. Limited delivery, notification, access, security, and staff-action records may remain for troubleshooting, accountability, and legal obligations.

Protected device data is cleared during sign-out or confirmed account deletion where the app supports it. Operating-system, backup, provider, and security records may persist for their applicable bounded lifecycle.

Topinu asks for a device permission when a feature needs it. You can later change permissions in iOS or Android settings.

• Location: used for a current starting point or foreground route sharing. Turning it off removes those conveniences; manual addresses and other app features remain available.
• Camera and photos: used only after you choose to add delivery proof, product, or activity media. Turning access off prevents new selection or capture.
• Notifications: used by Topinu Manager for enabled shop alerts. You can change app preferences or system permission at any time.

We use cookies and similar tracking technologies to enhance your browsing experience. Cookies help us:

• Remember your preferences and cart items
• Keep you signed in to your account
• Understand how you use our website
• Improve our services based on usage patterns
• Keep a Flora conversation and shopping journey connected to the same shop

You can control cookies through your browser settings. Disabling cookies may affect some website functionality.

On topinu.com, we use Google Ads measurement to understand visits from our ads and, when configured, shopping steps such as product views, successful delivery-area checks, cart additions, checkout starts, payment attempts, and completed orders for the Topinu platform shop. These events may send a pseudonymous cart or order ID and the current cart or order value. They do not send the ZIP or address you entered, recipient details, gift messages, or payment details. Personalized-ad signals are disabled for this tag.

PostHog helps us understand which public storefront pages and shopping steps are useful and provides masked replay to find confusing public shopping experiences. These anonymous sessions use in-memory storage only. We do not identify you to PostHog. We exclude checkout, account, order lookup, delivery tracking, private gift, sign-in, contact, event-planning, partner, membership, and Flora pages from replay; block all forms and Flora; mask every input; and do not send names, email addresses, phone numbers, delivery or billing addresses, recipient or gift content, payment details, or order identifiers. Device and browser type, a query-free page path, an approved coarse campaign source, anonymous shopping-step events, and network metadata needed to deliver the request may be processed. Topinu disables IP geolocation in analytics events. PostHog is used only for product analytics, not cross-context behavioral advertising. You can turn it off below at any time.

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Opt-out: Unsubscribe from marketing communications and, where applicable, opt out of sale or sharing
• Limit: Request limits on certain uses of sensitive personal information where applicable
• Data Portability: Receive your data in a portable format
• Non-discrimination: Receive equal service when exercising applicable privacy rights

California residents: Depending on whether the law applies to the relevant business, you may have rights to know, access, correct, delete, and receive information, to limit certain uses of sensitive personal information, and to opt out of sale or sharing for cross-context behavioral advertising. Topinu does not sell personal information or share it for cross-context behavioral advertising.

We may need to verify your identity and authority before completing a request. Some information may be exempt from a request, including information needed to complete transactions, protect security, prevent fraud, or meet legal obligations. You may use an authorized agent where applicable.

We disclose information to service providers and other parties only for the purposes described here:

• Selected florist and authorized staff: order fulfillment, customer support, assisted shopping, refunds, and delivery
• Stripe: card payments, recurring billing, fraud services, refunds, connected-shop identity verification, transfers, and payouts. Stripe receives information under its own Privacy Policy.
• Google Identity Services and Sign in with Apple: optional account authentication. The selected provider processes the sign-in request and returns a signed identity credential plus the account information you authorize. See the Google Privacy Policy and Apple Privacy Policy.
• Google Maps Platform: address validation, geocoding, route planning, and travel-time estimates, including destination addresses and coordinates entered for a personal route. Route names and private notes are not needed for these requests. Google processes related request data under the Google Privacy Policy.
• Google Ads: measurement of visits and configured shopping steps on topinu.com, including product views, successful delivery-area checks, cart additions, checkout starts, payment attempts, and completed purchases. Events may include a pseudonymous cart or order ID and current cart or order value, but not the entered ZIP or address, recipient details, gift messages, or payment details. Personalized-ad signals are disabled for this tag. See the Google Privacy Policy.
• PostHog: cookieless anonymous product analytics and fully masked replay on approved public storefront pages only. Topinu blocks all visible text, images, video, canvas, forms, and user-facing text attributes from replay; disables person profiles, IP geolocation, console and network-body recording, automatic error capture, advertising use, and replay on sensitive routes; and provides an immediate opt-out above. See the PostHog Privacy Policy.
• Cloudflare: edge delivery, security, original-IP forwarding, and approximate IP geolocation. Cloudflare processes related request data under its Privacy Policy.
• Drivers and delivery partners: recipient, address, window, contact, access, and order information needed for fulfillment
• Expo Push Service, Apple Push Notification service, and Firebase Cloud Messaging: device token, platform, and operational delivery metadata needed to send enabled Topinu Manager notifications
• Hosting, object storage, communications, security, and analytics providers: infrastructure, private and public media storage, transactional messages, performance measurement, abuse prevention, and diagnostics
• Configured AI provider: Flora sends chat messages and relevant shopping context to the configured provider (such as OpenAI or Google Gemini) to generate a reply. When authorized shop staff request Product Studio or Activity analysis, selected shop media or bounded visual derivatives and relevant editor context are sent to the configured provider to generate a suggestion. Do not include payment details or other sensitive information.

This storefront participates in an opt-in provider data-sharing program, so Flora chat inputs and outputs may also be used by the configured AI provider to improve its models.

Providers have their own privacy terms and may process information in the United States or other countries. We may also disclose information when required by law, to protect people or the service, in a corporate transaction, or with your direction or consent.

We require service providers that process personal information for Topinu to protect it and use it only for the services and purposes we authorize, subject to their applicable terms and our agreements.