Privacy Policy

This website and the ice cream sold through it are operated by Cold Flower Inc., a company based in New York City. We deliver across the New York metro area and sell in person at popups and markets. We are the party responsible for the personal information described here — a “controller” or “business,” depending on which law applies to you.

You can reach us any time at coldflowericecream@gmail.com or by message on Instagram.

The categories of personal information we collect are:

• Identifiers and contact details — your name, email address, and phone number if you give one.
• Delivery information — the street address, city, state and ZIP code you want your order brought to.
• Order and transaction information — the flavors and quantities you ordered, the amount, your chosen payment method, the delivery window, and whether the payment succeeded. If you pay by card we keep our payment processor's reference for the charge — never your card number, which does not reach our systems at all.
• Delivery notes, including allergies — whatever you write in that box. We ask for allergy information there, so this can include health-related details you choose to share. Please tell us only what you want the person packing and delivering your order to know.
• Messages you send us — the content of emails and Instagram messages, including catering enquiries.

What we do not collect: we use no analytics service, no advertising pixels and no third-party tracking cookies. There is no account to create, so we store no password. We do not buy personal information, and we do not build profiles of you across other websites. Your shopping cart is saved in your own browser's local storage so it survives a refresh — it stays on your device and reaches us only when you place an order.

• Directly from you — when you fill in the checkout form, email us, or message us on Instagram. This is the source of almost everything we hold.
• From our payment processors — Stripe tells us whether a card payment succeeded and gives us a reference for it. If you buy from us in person, Square records the transaction.
• Automatically — like any website, our hosting and server providers keep basic technical logs (such as IP address and request time) for security and reliability. We do not use these to identify or track individuals.

We do not obtain personal information from data brokers or third-party lists.

Giving us information is voluntary — but some of it is necessary to complete a purchase, and we cannot deliver an order without it.

• Required to order: name, email address, and delivery address. Without these there is nothing to deliver and no way to confirm it.
• Optional: phone number and delivery notes. A phone number only helps us reach you on the day; allergy notes are entirely your choice, though we'd rather know.

• To make your order and deliver it to the right address
• To take payment and to send you an order confirmation
• To schedule the delivery and give the assigned driver what they need
• To make sure allergy information reaches whoever packs and delivers your order
• To contact you if there is a problem with your order
• To keep our business records and meet tax and accounting obligations
• To keep the site and our systems secure and working

We only email you about your order. We do not run a marketing list and will not add you to one.

We are a New York business and most of our customers are in the United States, where a specific legal basis generally is not required. For anyone protected by the UK or EU GDPR, our bases are:

• Performance of a contract — using your name, address, contact details and order to make and deliver what you bought.
• Legal obligation — keeping records of sales for tax and accounting.
• Legitimate interests — keeping our site and systems secure, and preventing fraudulent orders.
• Consent — for allergy details you choose to give us, which you can ask us to remove at any time.

We use a small number of service providers to run the business. Each receives only what it needs for its part, acts on our instructions, and may not use your information for its own purposes:

• Payment processors — we use Stripe for card payments on this website and Square for card payments at popups and markets. Your card details go to them directly and are handled under their own privacy policies.
• Calendar scheduling — we schedule each delivery as an event in Google Calendar. The event includes your name, address, contact details and what you ordered, and is visible to our team and to the driver assigned to your delivery.
• Email delivery — an email service sends your order confirmation, and receives your email address and order details to do so.
• Database and hosting — cloud infrastructure providers store our database and run the servers behind this website. They hold the information described above so that the site and your order work at all.

We describe these by category rather than by brand because the specific companies can change. If you want to know exactly which providers we use today, email us and we will tell you.

We may also disclose information where the law requires it, or to protect our legal rights. If the business were ever sold or merged, customer records could transfer as part of it, and this policy would continue to apply to them.

We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, and we have not done so in the past twelve months.

Your information is stored and processed in the United States, where our database and servers are located. Our service providers are US-based companies, some of which operate globally and may process data in other countries.

If you order from us while outside the United States, your information is transferred to the US, which may not offer the same protections as your home country. Where the UK or EU GDPR applies, transfers rely on the safeguards our providers have in place, such as Standard Contractual Clauses or the EU–US Data Privacy Framework. Placing an order means you understand it will be handled in the US so we can fulfil it.

We keep order records for as long as necessary for the purposes described in this policy, and to meet our legal, accounting and tax obligations. Messages you send us are kept as long as they are useful for answering you and any follow-up.

You can ask us to delete your information sooner and we will, except where we are required to keep a record of a completed sale.

Your name, email address, phone number and delivery address are encrypted in our database rather than stored as readable text. The dashboard that can read them requires a login, restricts what each team member can see by role, and is not open to the public. This site and everything behind it is served over HTTPS. Card numbers never reach our systems.

No system is perfectly secure and we will not claim otherwise. What we can say is that we hold as little as we can, for as narrow a purpose as we can.

Wherever you live, you can ask us to do any of the following, and we will not treat you differently for asking:

• Tell you what personal information we hold about you, and where it came from
• Give you a copy of it in a portable format
• Correct anything that is wrong
• Delete it, subject to records we are legally required to keep
• Restrict or object to a particular use
• Withdraw consent you have given, such as allergy details

There is nothing to opt out of regarding sale or targeted advertising, because we do neither.

To make a request, email coldflowericecream@gmail.com from the address you ordered with, or include the email address or phone number on the order so we can find it. We will respond within 45 days, and will tell you if we need longer. You may also ask an authorised agent to make a request for you.

If you are in the UK or EU and think we have handled your information badly, you may complain to your local data protection authority — though we would rather you told us first so we can put it right.

We do not run a loyalty programme, and we offer no discount, reward or other incentive in exchange for your personal information. The price you pay does not depend on what you share with us.

This site is not directed at children under 13, and we do not knowingly collect personal information from them, in line with the Children's Online Privacy Protection Act. If you believe a child has given us personal information, email us and we will delete it promptly.

If we change how we handle your information, we will update this page and change the effective date at the top. Where a change is significant — a new category of data, a new service provider with access, or a new purpose — we will say so clearly at the top of this page, and where we hold your email address for a recent order, we will tell you directly.

We review this policy at least once a year, and whenever we add or change something that touches customer data, so that it keeps pace with how the business actually works and with privacy law as it develops.

This version is effective August 22, 2026.

This policy is linked from the footer of every page on this site, is free to read without an account, and is written as ordinary web text so it can be enlarged, reflowed, or read aloud by a screen reader. If you need it in another format, email us and we will send one.

Questions about this policy, or about anything we hold:

• Email coldflowericecream@gmail.com
• Message us on Instagram
• Or use our contact page

Cold Flower Inc., New York, NY.