Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

Digital Florists Ltd
7 Booker Avenue, Liverpool, England, L18 4QY
Company number: 15423324
Email:

ICO registration reference: ZB653672

We have not appointed a Data Protection Officer as we are a small business that does not carry out large-scale processing of special category data. For all data protection enquiries, please contact us at the email address above.

2. Introduction

Digital Florists Ltd ("we," "our," or "us") operates the Florist Toolbox service. We are committed to protecting your privacy. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information in accordance with UK GDPR and applicable data protection laws.

3. Information We Collect

We may collect and process the following types of personal information:

• Identity and contact details (e.g. name, email address)
• Account credentials and profile data
• Billing and payment information (processed by Stripe)
• Business or professional information (e.g. florist type, company name, website)
• Text and prompts submitted to AI tools, uploaded reference images, and generated text or images
• Technical data such as IP address, browser type, device information, and usage activity
• Session replay data including mouse movements, clicks, scrolls, and page interactions (collected via Microsoft Clarity)
• In-app feedback responses (e.g. exit survey answers about your experience)
• Referral and affiliate tracking data including referral codes and conversion information
• Partner membership data including membership codes redeemed and the name of the partner membership group (e.g. British Florist Association, Institute of Flowers Ireland, Good Florists Guide)
• Florist Website Checker data: the public pages, screenshots and contact details of the websites that are checked, and details about the people who run checks and confirm they run a website (see section 8)

Providing your identity, contact, and billing data is necessary to enter into and perform your subscription contract. If you do not provide this data, we cannot provide the Service.

4. How We Use Your Information and Our Lawful Basis

We process your personal data for the following purposes, each with a stated lawful basis under UK GDPR Article 6(1):

Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights. Our legitimate interests include improving service usability, preventing fraud, operating analytics, and managing partner programmes.

5. Third-Party Services and Data Sharing

We share your personal data with the following third-party processors:

When you use an AI tool, the text you enter and any reference images you submit are sent through OpenRouter to the model provider used for that request. For tools with account history, we save generated results and the relevant submitted information so you can reopen or delete those entries.

For a full Florist Website Checker report, screenshots of the checked website's homepage, a product page and a category page at computer and phone sizes, text read from those pages (such as headings, buttons and footer details), and the words of its delivery, contact and about pages, are sent through OpenRouter to the AI model provider used for that request. These come from the public website, so they can include anything the website shows, such as names and phone numbers. Section 8 explains the rest of the Website Checker.

If you redeem a partner membership code, we may share your name, company name, and email address with the partner membership group that issued the code. This may happen at the point of redemption and periodically thereafter as part of a member list provided to the membership group for verifying membership eligibility. We will not share any other personal data, tool usage data, or business data with partner membership groups.

We may also share data with hosting providers, content delivery networks, and caching services as necessary to operate the Service. You may request a copy of the relevant transfer safeguards by contacting us.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to analyse traffic and enhance your experience. This includes:

• Essential cookies - Required for website functionality and security (e.g. session authentication, CSRF protection)
• Analytics cookies - To understand how visitors use our site, including cookies set by Microsoft Clarity (_clck, _clsk) for session replay and behavioural analytics, and Google Analytics (_ga, _gid) for usage statistics
• Advertising cookies - Set by Meta Pixel and LinkedIn Insight Tag for ad conversion tracking
• Referral tracking cookies - A first-party cookie that records the referral partner code so we can attribute your signup correctly

For detailed information about the cookies we use, including names, purposes, and durations, please refer to our Cookie Policy.

7. Affiliate and Referral Programme

If you participate in or are referred through our partner programme:

• We store the referral partner code in a first-party cookie when you arrive through a partner link
• We record which partner referred you against your account so we can credit that partner
• We use your subscription payment records to calculate the commission we owe the referring partner
• Referring partners see referral statistics, commission amounts, and the business name of referred shops (or your full name where no business name is set); we do not share your email address or other contact details with them

All referral tracking is handled on our own systems. No referral data is shared with third-party tracking providers.

8. Florist Website Checker

The Florist Website Checker looks at a florist's public website the way a customer would and reports what could be better. This section explains what it collects and why. It covers you if you run a check, and it covers you if you run a website that someone has checked.

Most checks start because someone asks for one. Our team may also check florist websites ourselves, to test that the checker gives accurate results, re-run checks after we fix something and find errors. Those checks follow the rules a website's robots.txt file sets for all automated visitors, and they do not normally include the AI review or the checkout walk.

What we collect from the website being checked

• The website address, and copies of the public pages we visit. A quick check looks at the homepage, and reads the contact page only for the shop's published email address. A full report also looks at the contact, delivery, privacy and about pages, one category page and one product page, and checks up to 40 links on the site.
• Screenshots of those pages at computer and phone sizes, taken in an ordinary web browser.
• Speed results from Google PageSpeed Insights, which loads the homepage from Google's own network.
• Public technical details, such as the website's robots.txt file, sitemap, security certificate and DNS records.
• For a full report, a walk through the checkout. We add one item to the basket, pick the choices a customer has to make on the way (such as a size, the earliest delivery date offered or guest checkout), and stop at the first form that asks for personal, payment or sign-in details. The checker is built not to type names, email addresses, phone numbers, addresses or payment details, and not to place an order or pay. The one thing it may type is the shop's own published postcode, where a delivery postcode box has to be filled in before the checkout goes on.
• The contact details the shop publishes on its website, such as its email address, phone number and postal address. Many florists trade as sole traders, so these details can be personal data.
• For a full report, an AI review of screenshots and page text, sent through OpenRouter as described in section 5.
• For a full report, where we have switched it on, one search of Google Maps business listings (the Google Places API) using the shop's name and postcode or town. We compare Google's answer with the website and then discard it. We keep only Google's reference number for the listing and our own result of the comparison.

The pages are whole copies, so they hold whatever the website itself shows, such as staff names or customer reviews. The checker visits one page at a time with a pause between each. It does not sign in to a website or contact the shop's customers. If a website's security blocks our own browser, we may load the public pages through a hosted browser service (Bright Data) instead.

What we collect about the person running a check

• If you are signed in, your account, which websites you checked and when, and the results.
• A fingerprint of your IP address, when you run a quick check or report a mistake. It is scrambled with a secret key, so your address itself is not stored with the check. We use it to limit how many checks or reports one connection can send, and we clear it after 30 days.
• A Cloudflare Turnstile check on the quick check form, to stop automated scripts running checks.
• A note in your browser session of the quick checks you started, so they can be added to your account if you sign up.
• Anything you tell us about how the shop trades, such as whether it delivers, offers same-day delivery, does funeral work, has a shop customers can visit, offers collection, sells online, or does weddings and events.
• If you report a mistake in a finding, the reason you choose and any note you add.
• How you confirmed that you run a website, as described below.

Confirming you run the website

Anyone can run a quick check, but only someone who has confirmed they run a website can see its full report. You can confirm in one of these ways:

• Your account email. If your confirmed account email address is on the website's own domain, that is enough.
• An email to the shop. We email a link to an address the shop publishes on its homepage or contact page, or to an address on the website's own domain that you type (you type only the part before the @). The email tells the shop who asked: the name on your account and a partly hidden version of your email address. The link works for 48 hours. If it is not used, we clear the address and the link a day after it expires.
• A phone call to the shop, where we have switched it on. We ring a phone number our own check found on the shop's website, not a number you type. We only ring shop landlines and mobiles in the UK, Ireland, the US, Canada, Australia, New Zealand and the EU, and not premium-rate or other special numbers. A computer voice reads a 4-digit code, and the call is placed through Twilio. We store the code scrambled, it lasts 10 minutes and works once. The call is not recorded. We keep a partly hidden version of the number and the call's reference with the confirmation record.
• A DNS record or a tag on the website. You add a code we give you, and we look it up.
• Asking our team. We send your request, with your account name and email address, to our team. We may phone the number shown on the website to check that you work there.

We use a shop's published email address and phone number to confirm ownership only when someone asks to see that website's full report. We do not add them to any mailing list.

Emails we send

• To the shop, when someone asks to confirm they run its website by email. It says who asked and why the shop received it, and is safe to ignore. Replying to it reaches our team, and you can reply to ask us to stop checking the website.
• "Your website is confirmed", to an account holder whose website was confirmed while they were away from the page, for example when our background re-check finds their DNS record or tag, or our team confirms it.
• "Your report is ready", when a full report finishes. It goes to the person who asked for it, or to a confirmed owner who was waiting for a check our team started, and includes the overall score, the top three things to fix and a link to the report. We do not send it for quick checks.

Who can see a check

• A quick check result (scores, the titles of the top issues and the homepage screenshots) can be seen by anyone who has its link, for 30 days.
• A full report can be seen by the people who have confirmed they run the website.
• Someone who can see a full report can create a share link for their web designer or website provider. Anyone with that link can read the report for 30 days. The link stops working sooner if the person who made it can no longer see the report.
• Our team can see checks so we can run and support the service.

How long we keep it

We keep a check's evidence (page copies, screenshots, checkout steps, speed results and the AI review) for 12 months, then delete it. We keep the scores and findings after that, so report history still works. We also keep a long-term copy of the HTML of the pages we visited, without screenshots or AI results, so we can re-check results and find errors in the checker. We delete that copy after 12 months too, or sooner if the website's owner asks. If you delete your account, we remove your confirmations and unlink you from the checks you ran; the checks themselves stay under these periods. Section 10 lists every retention period.

Asking us to stop checking your website

If you run a website and do not want it checked, email us at , or reply to any ownership email we sent your shop. We will stop all checks of that website. Tell us if you also want us to delete what we hold about it, and we will delete its stored pages, screenshots, reports and long-term page copies. You can also block our checker in your website's robots.txt file by disallowing FloristToolboxBot. Checks then stop, unless the person asking has already confirmed they run the website.

9. Data Security

We use technical and organisational measures to protect your personal data, including access controls and regular security reviews. However, no system is completely secure, and we cannot guarantee the absolute security of your data.

10. Data Retention

We retain your personal data for the following periods:

11. Your Rights

Under UK data protection laws, you have the right to:

• Access the personal data we hold about you
• Rectification - request correction of inaccurate data
• Erasure - request deletion of your data ("right to be forgotten")
• Restriction - request we restrict certain processing
• Data portability - request a copy of your data in a structured, commonly used, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent where processing is based on consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Exercising these rights is free of charge. We will respond to your request within one month. In complex cases, we may extend this by up to two further months, and we will inform you if this is the case.

To exercise any of these rights, contact us at:

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Website: ico.org.uk

12. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you.

13. Updates to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "last updated" date and, where appropriate, notify you of any significant changes.