How we handle your data

Who we are

Stems is a directory for local flower growers, a place to find growers near you and contact them directly. The service is operated by Guardline Ltd, a company registered in England and Wales (company number 13323382), which is the data controller for the personal data described here.

Questions about this policy or about your data: email hello@stems.market .

What we collect

• Account data. Your email address and name. Stems uses magic-link sign-in, so we never ask for or store a password.
• Your grower page. Anything you publish as a grower: your handle, display name, bio, the area you grow in, photos of your flowers, your listings, and the contact methods you choose to show (a WhatsApp number, a contact email, an Instagram handle). This is intentionally public: it's what buyers see and search.
• Billing data. Handled by Stripe. We see a customer ID and your subscription status. We never see your card details.
• Email preferences. Whether you've opted in or out of product and marketing emails.
• Usage analytics. We don't currently run any third-party analytics. If we add a privacy-friendly tool in future it'll be off until you opt in, and we'll detail it in the Cookie Policy .
• Server logs. Cloudflare logs the IP address, request URL, and a timestamp for each request, retained briefly for security and abuse prevention.

Contacting a grower: we stay out of it

Stems has no in-app messaging. When a buyer taps a grower's contact button we simply hand off to that app: WhatsApp, your email client, or Instagram. The conversation happens directly between the two of you. We don't see it, send it, or store it, and a buyer doesn't need a Stems account to browse or to get in touch.

Once you're handed off, that provider's own privacy policy applies to whatever you share there.

What we use it for

• Running your account and publishing your grower page so buyers can find you.
• Sending sign-in (magic) links and other essential service emails.
• Billing you, handling your subscription, and processing cancellations.
• Sending product and marketing emails, only if you opt in. There's an unsubscribe link in every one.
• Measuring how the site is used so we can improve it (subject to your cookie choice).
• Crediting your referrer if you signed up through a referral link.

Legal bases: contract (running your account and page), legitimate interest (security, fraud prevention, and anonymous analytics where you've consented), consent (marketing emails and analytics cookies), and legal obligation (keeping financial records).

Who we share it with

• Stripe: payment processing.
• Cloudflare: hosting (Workers, the D1 database, and R2 file storage).
• Resend: sending sign-in, transactional, and marketing email.

We never sell your data, and we don't share it with anyone for advertising. (Separately, when you contact a grower we hand you off to WhatsApp, your email provider, or Instagram, as noted above.)

Where it lives

Your account, page, and preferences live in a Cloudflare D1 database (SQLite, replicated across Cloudflare's edge network). Photos live in Cloudflare R2. Backups are handled automatically by Cloudflare. Stripe stores billing data in its own infrastructure under its own policy.

How long we keep it

• Active accounts: while your account is open.
• Closed accounts: removed on request, or within 12 months of the account becoming inactive.
• Financial records: 6 years (a UK statutory requirement).
• Server logs: a rolling few days at the Cloudflare edge.

Your rights

Under UK GDPR you can:

• Ask for a copy of the data we hold about you.
• Ask us to correct anything inaccurate.
• Ask us to delete your account and the data attached to it.
• Withdraw consent for analytics or marketing at any time (via the cookie banner or any unsubscribe link).
• Complain to the ICO (ico.org.uk).

Email hello@stems.market to exercise any of these.

Children

Stems isn't aimed at children and isn't intended for use by anyone under 16. We don't knowingly collect data from children. If you believe a child has given us their data, email us and we'll remove it.

Changes to this policy

If we make material changes we'll update the date at the top of this page and, where it affects you, let signed-in growers know by email. The live version here is always the authoritative one.