PRIVACY POLICY
Your details and your request.
This draft describes the website’s order-request and general-enquiry features. It needs review against the business’s final contact details, hosting, email services and policies before publication.
Draft — review before launch. Confirm the business operator’s name and contact details, approve the retention setting, and add any relevant hosting, email, analytics or other service information.
Information you provide
An order request asks for your name and email address, the soaps and quantities you would like, and optional phone and notes. A general enquiry asks for your name, email address and message. The order form also records when its privacy acknowledgement was given. Please include only information needed to handle your request.
How the information is used
The business uses the information to respond to enquiries, review availability and discuss payment and delivery arrangements. No payment is taken on this website.
Order records & enquiry emails
Valid order requests are saved privately in the WordPress database before emails are attempted. Each record contains a request reference, contact details, a snapshot of product names, quantities, sizes and any prices at submission, request status, the privacy acknowledgement time and separate email-sending results. Access is restricted to authorised administrators. General enquiries are emailed to the configured contact inbox and are not saved as request records by this plugin.
Email processing
Order details are emailed to the configured business recipient, and an acknowledgement is attempted to the customer’s email address. General enquiries are emailed to the configured contact recipient. The website records whether WordPress accepted an order email for sending; this does not establish inbox delivery. Saved order requests remain available to the business if email sending fails.
Draft — service details needed: Identify the business’s email and hosting providers, how those services handle the data, and the contact process for privacy questions.
Form protection
The forms use a temporary, 24-hour session cookie, fresh form tokens, spam checks, submission limits and duplicate-submission protection. The cookie is HttpOnly and SameSite. The plugin uses short-lived, hashed IP-based identifiers to limit attempts and opaque hashed markers to recognise duplicates. Raw IP addresses and message bodies are not stored in those markers. This technical data is separate from private order details.
Keeping and deleting information
The plugin’s default order-record retention setting is 180 days. The business can change it; a setting of zero disables automatic deletion. Authorised administrators can delete records manually. A daily WordPress scheduled task permanently deletes up to 200 records older than the configured period per run. When it runs depends on the site’s WordPress scheduling. Email inboxes, hosting logs and backups can have separate retention arrangements.
Draft — retention review: Confirm the period the business will use and describe the separate retention arrangements for email, logs and backups.
Questions about your information
Contact the business if you have a question about information you have submitted, or want to request a correction or deletion. Include your request reference if you have one. Authorised administrators can use WordPress privacy tools to export or erase stored order records by email address.
Draft — contact details needed: Add the business operator and privacy contact details. Review the complete policy before it goes live.
Contact the business