Privacy Policy
Last updated: June 14, 2026
This policy explains what personal information Dahlia Market collects, how we use and share it, how long we keep it, and the rights you have over it. It applies to thedahliamarket.com and the Dahlia Market mobile app.
Information we collect
- Identifiers & account info: email address, name, and profile photo when you sign in with Google, Apple, or create an account.
- Profile info you provide: username, bio, location, website, garden entries, and photos you upload.
- Listing & commerce info: titles, descriptions, photos, and pricing for listings you create, and order history.
- Transaction info: order details processed through Stripe. We do not collect or store payment card numbers — Stripe handles all payment data.
- Usage & device data: pages visited and actions taken on the Platform, plus basic device and log data, used to operate and improve the product.
We do not collect sensitive personal information (such as government IDs, precise geolocation, or health data), and we do not knowingly collect information from children under 13.
How we use it
- To operate the marketplace — matching buyers with sellers, processing orders, and managing your account.
- To send transactional emails (order confirmations, watchlist alerts). We do not send marketing email without your consent.
- To display your public profile and garden at thedahliamarket.com/garden/[username].
- To investigate reports of prohibited listings, objectionable content, or abuse, and to keep the Platform safe.
- To comply with legal obligations and enforce our Terms.
Who we share it with
We share personal information only with service providers who process it on our behalf, under contracts that restrict their use of it:
- Supabase — database and file storage (supabase.com)
- Stripe — payment processing (stripe.com)
- Vercel — hosting (vercel.com)
- Google & Apple — authentication only, if you use their sign-in
- Resend — transactional email delivery (resend.com)
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We may disclose information if required by law or to protect the rights and safety of our users.
How long we keep it
We keep your personal information for as long as your account is active. When you delete your account we delete or de-identify your personal information within 30 days, except where we are required to retain certain records (for example, transaction records for tax and accounting purposes).
Your privacy rights
You can edit your profile at any time from your account settings. You can permanently delete your account and all associated personal data from your account settings on the web (Account → Your profile) or in the Dahlia Market mobile app, or by emailing us at the address below. Deleting your account removes your profile, listings, garden, and personal information, subject to the retention note above.
Depending on where you live (including if you are a California resident under the CCPA/CPRA), you have the right to:
- Know what personal information we collect about you and how we use and share it.
- Access a copy of your personal information.
- Delete your personal information.
- Correct inaccurate personal information.
- Opt out of any sale or sharing of personal information — note that we do not sell or share it.
- Not be discriminated against for exercising these rights.
Use your account settings (on the web or in the app) to access, correct, or delete your information, or email admin@thedahliamarket.com to make any of these requests. We will verify your identity and respond within the time required by law (45 days under the CCPA, extendable once where permitted). You may authorize an agent to make a request on your behalf.
Children's privacy
The Platform is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
Security
We use reasonable technical and organizational measures to protect your information, including encryption in transit and access controls. No system is perfectly secure, but we work to safeguard your data and will notify you and any required authority of a breach as the law requires.
Changes to this policy
We may update this policy from time to time. When we make material changes we will update the “Last updated” date above.