Privacy & browser storage

Who is responsible?

Ladybug Greeting Cards is part of We Love Balloons Ltd. We Love Balloons Ltd is responsible for the personal information collected through this website. Company number 10314442. VAT registration number 247169486. Contact address: 240 High Street, Wibsey, Bradford, BD6 1QP. If you have a question about your information, email info@weloveballoons.co.uk or call 01274 693092.

Orders

We use your name, contact details, order contents, personalisation, recipient or delivery details, dates and notes to answer your questions, take payment and fulfil your order. The lawful basis is taking steps at your request before a contract, and then performing that contract. We need the required order fields to arrange your order, but you can browse without placing one. Please only give us another person's details when the order needs them, and let them know about this notice.

For an eCard, we use the recipient's name and email address, your message and the send date you choose. We use them to email the eCard on that date. The eCard email is sent through Resend.

Payment references, amounts and status help us match payments to orders. We keep accounting records to meet our legal obligations. We also use the records we need to resolve queries, prevent fraud and handle disputes. Our legitimate interests here are protecting customers and running the business safely. You enter your card number and security code with the payment provider (Square or PayPal). They are not stored in our website order database.

Who receives information?

Our authorised team uses your order details to help you. Cloudflare hosts and protects the site and stores website records. Square receives the information it needs when you pay by card through Square. PayPal receives the information it needs when you choose to pay with PayPal. Postal services receive the recipient and delivery details they need. Resend sends website order emails and eCard emails, and our email providers handle correspondence. Professional advisers or authorities may receive records when they are needed for accounting, a legal duty or a dispute.

Steve read-aloud uses OpenAI to make audio from fixed card wording when it is available. This voice request does not include your checkout details.

Some providers process data internationally, including in the United States. Cloudflare's published data-processing terms describe its international transfer safeguards, including the UK transfer arrangements. Square and PayPal explain their own safeguards in their privacy notices. Contact us if you'd like information about the safeguards that apply to your data. See Cloudflare's data-processing terms, Square buyer privacy information and PayPal's privacy statement.

Roast Your Own and eCards

When you generate a personalised roast or a loving message, we send what you enter to OpenAI, which writes three choices for you. That includes the first name, relationship, occasion, habits or memories, qualities you like or love, and any off-limits notes. Please avoid sensitive details. If you choose read-aloud, the selected message is sent to OpenAI to make the audio. A device voice may be used if that service isn't available. We keep the audio on our Cloudflare storage for up to 7 days, so repeat plays of the same message don't need to be made again, and then it is deleted automatically. Our website doesn't save these form entries, generated messages or custom audio in its order database. OpenAI may keep API data under its own service policies.

An eCard link holds the message and recipient name in the part after the # symbol. Anyone with the full link can read it, and it may stay in browser history or wherever you share it. Sharing a link doesn't send an email by itself.

How long information is kept

We keep order, invoice and payment records for as long as we need them to fulfil the order, meet tax and accounting requirements and handle claims. We may keep consent and suppression records to show your choices and to avoid contacting you again. Copies held in email, calendars and backups are also covered. How long we keep a record depends on its purpose, our legal duties to keep it, and whether a matter is still open. Contact us if you'd like to know how long a particular record is kept.

Browser storage and cookies

The site uses local storage on your device to remember your basket, your personalisation and your checkout draft. Checkout drafts can include contact and delivery details, so please take care on shared devices. These stay until they are removed or replaced, or until you clear the site's browser data. Payment recovery references are kept for up to 30 days and removed once a payment has been matched. They stop paid items staying in your basket.

This storage supports shopping features you choose to use. Clearing site data removes saved drafts and baskets from that browser. It doesn't remove order records already sent to us. Cloudflare, Square and PayPal may use security, session or payment cookies under their own notices.

Site measurement and your choice

We count page views and certain actions using the page path, the referring website's hostname and a broad device category. Our analytics stores combined daily counts, not a profile of a named visitor. Our purpose and legitimate interest is understanding which parts of the site are useful. Hosting and security services also process technical request information, such as IP addresses, to deliver and protect the site.

You can switch off browser-sent site measurement below. This doesn't stop essential order processing or security logs. A small local setting remembers your choice on this browser. We also respect browser Do Not Track. We don't use this measurement to make decisions about you that have legal or similarly significant effects.

Your rights

You can ask to see or correct your information. Where the law applies, you can also ask us to erase it, restrict how we use it, or give you a portable copy. You have the right to object to processing based on legitimate interests, and to direct marketing. You can withdraw consent at any time. Email or call us using the details above. We may need some proportionate information to check it's you.

To raise a data-protection complaint with us, email, call or write to us using the details above. Please explain your concern and what you'd like us to do. We'll acknowledge it within 30 days, look into it without undue delay, keep you informed and explain the outcome. We normally answer data access requests within one month, subject to the legal rules.

You can complain to the Information Commissioner's Office (ICO). You don't have to contact us first, but we'd welcome the chance to put things right.