Privacy Policy

C'est Si Bon Bakery (“CSB,” “we,” “us,” or “our”) is a small bakery based in San Jose, California, operating at 1375 Blossom Hill Road, Suite 38, San Jose, CA 95118. We sell Persian cookies online at persiancookies.com and can be reached at orders@persiancookies.com or (408) 266-2253.

This Privacy Policy explains how we collect, use, and protect personal information when you visit our website or place an order with us. By using our website, you agree to the practices described below.

Information you provide directly:

• Name — used to personalize your order and confirmation emails
• Email address — used to send order confirmations and respond to inquiries
• Phone number — used to follow up on your order if needed
• Shipping or delivery address — used to calculate shipping rates and fulfill your order
• Order details — cookie selections, quantities, fulfillment type (pickup or shipping), requested date, occasion, and any special requests you provide
• Messages via our chat assistant (Shirin) or contact form — the text of your inquiry, which we use to respond to you

Information collected automatically:

• Cart data — stored locally in your browser's localStorage. This data never leaves your device unless you proceed to checkout.
• Basic server logs — standard web traffic data (IP address, browser type, page requests) collected by our hosting provider, Vercel. We do not use this for marketing or profiling.

What we do NOT collect: We do not collect payment card numbers, CVV codes, or bank account information. All payment processing is handled directly by Square (see Section 4 below).

We use the information we collect for the following purposes:

• Processing and fulfilling your order
• Sending order confirmations and other transactional emails about your order
• Following up on your order by phone or email if we have questions
• Responding to customer service inquiries and chat messages
• Calculating live shipping rates from FedEx for your delivery address
• Improving our website and customer experience

We do not use your information for advertising, profiling, or automated decision-making. We do not sell, rent, or trade your personal information to third parties.

We work with a small number of trusted third-party providers to operate our website. Each provider receives only the data necessary to perform their specific function.

• Square (Block, Inc.) — Payment processing. When you click “Proceed to Payment,” you are redirected to a Square-hosted checkout page. Square collects and stores your payment card details directly; we never see or store your card number. Square is a PCI-DSS Level 1 certified payment processor. See Square's Privacy Policy at squareup.com.
• FedEx Corporation — Shipping rate quotes. When you request shipping rates at checkout, your delivery address is sent to FedEx's API to retrieve live rate estimates. FedEx's privacy policy is available at fedex.com.
• Resend (Resend Inc.) — Transactional email delivery. Order confirmation emails sent to you and order notification emails sent to us are delivered via Resend. Email content includes your name, order summary, and contact details. See Resend's privacy policy at resend.com.
• Anthropic, PBC — AI chat assistant. When you chat with Shirin (our AI assistant), your messages are sent to Anthropic's Claude API to generate responses. We send only the text of your conversation; no order or payment data is shared. See Anthropic's privacy policy at anthropic.com.
• Vercel Inc. — Website hosting and serverless functions. Our website is hosted on Vercel, which may process standard web traffic data (such as IP addresses) as part of serving web requests. See Vercel's privacy policy at vercel.com.
• Salesforce, Inc. — Order management. Each paid order (your name, email, phone, order details and shipping address) is recorded in our Salesforce account so our team can prepare and track it. See Salesforce's privacy statement at salesforce.com.
• Discord Inc. — Internal team notifications. When an order is paid, a summary (name, phone, items, date and shipping address) is posted to a private, invite-only channel for our bakery team. See Discord's privacy policy at discord.com.
• Google — Web fonts. Our pages load fonts from Google Fonts, which receives your IP address when the font files are requested. See Google's privacy policy at policies.google.com.

Our website uses browser localStorage (not cookies) to save your shopping cart between page visits. This data stays entirely on your device and is cleared when you clear your browser storage. We do not use third-party tracking cookies or advertising pixels.

Our hosting provider (Vercel) may set technical cookies necessary for security and performance. These are not used to track you across websites.

We retain order information (name, contact details, order contents) for as long as reasonably necessary to fulfill your order, respond to any issues, and comply with applicable tax and record-keeping requirements (generally up to 7 years for business records under California law).

Chat and contact form messages are retained for customer service purposes and are not used for any other purpose.

Payment records are retained by Square in accordance with their data retention policies.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know — you may request a summary of the personal information we have collected about you
• Right to delete — you may request that we delete personal information we hold about you, subject to certain exceptions (e.g., records required for tax purposes)
• Right to correct — you may request that we correct inaccurate personal information
• Right to opt out of sale — we do not sell personal information, so no opt-out is needed
• Right to non-discrimination — exercising your privacy rights will not affect the quality of service you receive from us

To exercise any of these rights, contact us at orders@persiancookies.com. We will respond within 45 days.

We take reasonable technical and organizational measures to protect your personal information against unauthorized access, loss, or misuse. Our website is served over HTTPS. Payment card data is handled exclusively by Square and is never transmitted to or stored on our servers.

No method of transmission over the internet is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

Our website is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at orders@persiancookies.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of our website after any changes constitutes your acceptance of the updated policy. For material changes, we will make reasonable efforts to notify you (e.g., via email if you have placed a prior order).

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

• Email: orders@persiancookies.com
• Phone: (408) 266-2253
• Mail: C'est Si Bon Bakery, 1375 Blossom Hill Road Suite 38, San Jose, CA 95118