Privacy & Cookies
What information we collect when you order a cake, why we need it, and the cookies this website uses.
Last updated: August 2026
On this pageShowHide
1. Who we are
Fluffy Bakehouse is a sole-trader cake business based in Norwich, England. For UK data protection law we are the data controller for the personal information described in this policy.
You can contact us about privacy at info@fluffybakehouse.com.
2. Information we collect
When you send a cake request, we collect: your name, your email address, your phone number (if you provide one), the date you need the cake, and your cake details — shape, size, guest numbers, flavour, fillings, piping, colours, add-ons, cake message and design notes.
If you tell us about an allergy, intolerance or dietary requirement, we collect those details too.
If you upload inspiration photographs, we store those images.
If you place a shop order, we collect the items ordered, the total, and your collection or delivery details, including a delivery address where relevant.
If you create an account, we store your name, email address and phone number in your customer profile, plus any loyalty points.
If you send us a message through the site, leave a review, or subscribe to the newsletter, we store what you submit — for a message: your name, email, phone (optional) and message; for a review: your name, rating and review text, plus your email separately if you give one; for the newsletter: your email address.
Our hosting and backend providers also process technical information such as your IP address and browser type in their server logs for security and reliability.
We do not take card payments on this website, so we do not collect or store card details.
3. Why we use it and our lawful basis
We use your information to review your request, quote for and make your cake, arrange collection or delivery, and communicate with you about your order. Our lawful basis is performance of a contract, or taking steps at your request before entering into one.
We use allergy and dietary information solely to assess whether we can safely make your cake and to make it safely.
We keep records of orders and payments to meet our legal and accounting obligations. Our lawful basis is legal obligation.
We use your information to keep the website secure and working, and to respond to messages and complaints. Our lawful basis is our legitimate interests in running the business responsibly.
We send newsletters only where you have subscribed, and you can unsubscribe at any time. Our lawful basis is consent.
We publish reviews only where you have submitted them for publication and we have approved them.
4. Allergy and health-related information
Information about allergies and intolerances can reveal something about your health, which UK data protection law treats as special category data.
We collect it only because you have given it to us so that we can consider your dietary requirements, and we rely on your explicit consent for that purpose. You do not have to give it, but we may not be able to accept an allergy-related order without it.
We use it only for your order, we do not publish it, we do not use it for marketing, and it is visible only to Fluffy Bakehouse through the password-protected admin area.
You can ask us to delete allergy details after your order has been completed.
5. Who has access to your information
Your information is visible to Fluffy Bakehouse through a secure, sign-in protected admin area. Other customers cannot see your order, contact details, allergy information or uploaded images.
We use the following service providers, which process data on our behalf:
- Lovable Cloud (backed by Supabase) — website hosting, database, file storage and account sign-in;
- Resend — sending order notification and transactional emails;
- Google — optional sign-in with a Google account, if you choose to use it.
We do not sell your information or share it for other organisations' marketing.
We may share information where we are legally required to do so.
6. International transfers
Some of our service providers may process data outside the UK. Where that happens, we rely on our providers' safeguards for international transfers, such as UK-approved standard contractual terms.
7. How long we keep it
We keep order records for as long as needed to fulfil the order and then for the period required for tax and accounting purposes.
Uploaded inspiration images are kept for as long as they are useful to your order and are deleted on request.
Allergy details are kept with the order record and can be deleted on request once the order is complete.
Newsletter subscriptions are kept until you unsubscribe. Messages and reviews are kept while they remain relevant.
Account information is kept while your account is open.
8. Security
The website is served over HTTPS. Data is stored in a managed database with row-level access rules so that customer records are not publicly readable, and uploaded inspiration images are held in a private storage bucket that is not publicly listable.
Access to the admin area requires signing in, is limited to authorised accounts, and signs out automatically after a period of inactivity.
9. Your rights
You have the right to ask us for a copy of the personal information we hold about you, to have inaccurate information corrected, to ask for information to be deleted, to object to or restrict certain processing, to ask for your information in a portable format, and to withdraw consent where we rely on it.
To exercise any of these rights, email info@fluffybakehouse.com. We will respond within one month.
10. Complaints
If you are unhappy with how we have handled your information, please tell us first at info@fluffybakehouse.com so we can put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
We may update this policy as the business changes. The date at the top of the page shows when it was last updated.