Privacy Policy

Scope

This policy applies to teaandtoast.co and to the forms on it. It does not apply to any third-party site reached through a link from this one.

Tea & Toast is operated by one person. Where a US privacy law refers to a business or a controller, that is Tea & Toast, contactable at the address given under Contact.

Information collected

Information you provide

The notify form on the home page collects an email address. Submitting the form records that email address and the date of submission.

This site is static and runs no server of its own. The form posts directly to an external customer relationship manager, and no submission is stored on this site.

An email sent to the address under Contact is retained with whatever information it contains.

Information collected automatically

This site uses Google Analytics 4, operated by Google LLC as a service provider. It collects:

• The page viewed, the referring page or search, and the time of the visit.
• Browser, operating system, device type, screen size, and language.
• An approximate location at city or region level, derived from the IP address.
• A randomly generated identifier stored in a cookie, used to recognise a returning browser.
• Events reported by the page, such as a page view, a scroll, an outbound click, or a form submission.

Google receives the IP address carried by each request and uses it to derive the approximate location above. Google Analytics 4 does not report IP addresses to the site operator, and no IP address is stored by Tea & Toast.

No name, email address, or form content is sent to Google Analytics 4. Demographics and interests reporting is disabled on the property, so no age band, gender, or interest category is inferred.

Google's use of the data it processes is described in how Google uses information from sites that use its services and in the Google Privacy Policy.

Analytics storage

Google Analytics 4 events are exported on a schedule into a Postgres database operated by Tea & Toast, where reporting is run in SQL. The export and every connection to the database run over TLS, and the database accepts no connection without credentials.

The database holds the event data described above. Email addresses are held in the customer relationship manager and are not joined to analytics records.

Cookies

Google Analytics 4 sets two cookies. No other cookie is set by this site.

• _ga stores the randomly generated browser identifier and expires two years after it is set.
• _ga_ followed by the property's measurement identifier stores session state and expires two years after it is set.

Neither cookie is used for advertising and neither tracks activity on other sites. This site sets no advertising pixel, no social media embed, and no session cookie.

Cookies can be blocked in browser settings, or measurement can be disabled across all sites using Google's Analytics opt-out browser add-on. No feature of this site depends on either cookie.

How information is used

• To measure how many people visit the site and which pages they read.
• To identify pages that load slowly, fail, or perform poorly.
• To inform decisions about what to publish.
• To send the single message the notify form describes, and to respond to correspondence.
• To comply with a legal obligation, or to establish or defend a legal claim.

Personal information is not used for profiling, automated decision-making, or targeted advertising.

Disclosure

Personal information is disclosed to the following service providers:

• Google LLC, which operates Google Analytics 4 and processes the analytics data.
• Cloudflare, which serves this site and retains request logs, including IP address, browser string, and URL, for a limited period for network operation and security. Its handling is described in the Cloudflare Privacy Policy.
• The database host, which operates the Postgres instance holding exported analytics data.
• The customer relationship manager, which holds the notify list and delivers messages to it.

Personal information may also be disclosed where required by a court order, subpoena, or applicable law. If the site is sold or transferred, the notify list transfers with it, this policy continues to apply, and the list is notified before the transfer takes effect.

Sale and sharing

Tea & Toast does not sell personal information and has not sold personal information in the twelve months preceding the effective date of this policy.

Tea & Toast does not share personal information for cross-context behavioural advertising, as that term is defined by the California Consumer Privacy Act, and has not done so in the twelve months preceding the effective date.

Tea & Toast does not sell or share the personal information of consumers known to be under sixteen years of age.

Retention

• Google Analytics 4 event data: fourteen months, the maximum available to a standard property, after which Google deletes it.
• Exported analytics records in Postgres: twenty-four months, after which they are deleted. Aggregated counts derived from them contain no identifier and are retained indefinitely.
• Analytics cookies: two years from the date each is set.
• Email addresses on the notify list: until you unsubscribe or request deletion, then removed within thirty days.
• Email correspondence: twenty-four months from the final message in the thread.

Security

The site is served over HTTPS. Connections to the analytics database run over TLS. Credentials are held in a password manager and are not committed to the site's source repository. Multi-factor authentication is enabled on the Google, Cloudflare, and database host accounts.

The site is static. It holds no database, executes no server-side code, and offers no account or login.

No method of transmission or storage is completely secure. In the event of a breach affecting personal information, affected individuals and any regulator required by applicable state breach notification law will be notified within the period that law prescribes.

Children's privacy

This site is not directed to children, and personal information is not knowingly collected from anyone under thirteen years of age. If you believe a child under thirteen has submitted an email address, contact the address under Contact and it will be deleted.

Your privacy rights

Comprehensive privacy laws differ by state and take effect on different dates. The rights below are extended to all residents of the United States, regardless of state of residence:

• The right to know what personal information is collected, why it is collected, and to whom it is disclosed.
• The right to access a copy of the personal information held about you.
• The right to correct inaccurate personal information.
• The right to delete personal information, except where retention is required by law.
• The right to obtain that copy in a portable, machine-readable format.
• The right to opt out of the sale or sharing of personal information, targeted advertising, and profiling. None of these activities is carried out.
• The right not to receive discriminatory treatment for exercising any right above.
• The right to appeal a refused request, which will be answered in writing within forty-five days.

No sensitive personal information is collected. This includes government identifiers, precise geolocation, health data, biometric data, racial or ethnic origin, religious belief, union membership, sexual orientation, immigration status, and the contents of mail or messages.

Submitting a request

Send requests to contact@teaandtoast.co, including the email address provided to the notify form.

1. Receipt of a request is confirmed within ten business days.
2. A request is answered within forty-five calendar days. Where reasonably necessary, that period may be extended once by a further forty-five days, with notice and reason given before the first period expires.
3. Requests are verified against the email address on file. No identity document is required.
4. An authorised agent may submit a request with written permission signed by you, which may be confirmed with you directly.
5. Requests are free of charge twice in any twelve-month period. A further request in the same period, or one that is manifestly unfounded or excessive, may incur a fee or be refused, with reasons given.

Analytics data is held against a randomly generated cookie identifier and generally cannot be linked to an identified individual. Where a request cannot be connected to the data held, that will be stated in the response. Clearing this site's cookies ends the identifier.

California privacy notice

This section applies to California residents and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories collected

The following categories of personal information have been collected in the twelve months preceding the effective date:

• Identifiers: an email address where submitted, the Google Analytics 4 cookie identifier, and the IP address received by Google and Cloudflare.
• Internet or other electronic network activity information: pages viewed, referring page, events, and session data.
• Geolocation data: approximate location at city or region level, derived from IP address. Precise geolocation is not collected.

No other statutory category is collected, including commercial information, biometric information, professional or employment information, education information, financial information, audio or visual information, inferences, and sensitive personal information.

• Sources: the consumer, the consumer's browser, Google Analytics 4, and Cloudflare's delivery of the site.
• Business purposes: those listed under how information is used.
• Disclosed for a business purpose to: Google, Cloudflare, the database host, and the customer relationship manager.
• Sold or shared: no category is sold or shared.
• Retention: each category is retained for the period listed under Retention.

California rights

California residents have the right to know, access, delete, and correct personal information, to opt out of its sale or sharing, to limit the use and disclosure of sensitive personal information, and not to be discriminated against for exercising those rights. No personal information is sold or shared and no sensitive personal information is collected.

Requests are submitted by email, as provided under Submitting a request. A business that operates exclusively online and has a direct relationship with the consumer is required to provide one method only.

Under California Civil Code section 1798.83, California residents may request, once per year, details of personal information disclosed to third parties for those third parties' direct marketing purposes. No such disclosures are made.

Under California Business and Professions Code section 22575, this site discloses that it does not respond to Do Not Track browser signals, for which no common standard exists. It does honour Global Privacy Control signals.

Global Privacy Control

Global Privacy Control is an opt-out preference signal sent by a browser or extension and recognised as a valid opt out of sale and sharing in California and several other states. Signals received are honoured. No personal information is sold or shared in any case.

Data location

Personal information is processed in the United States. Google, Cloudflare, and the database host operate global networks, and information may be processed on infrastructure outside the United States under each provider's terms. This site is directed to users in the United States, and this policy is written to US state privacy law.

Changes to this policy

Material changes to this policy are published here with a revised effective date. A change to the categories collected, the purposes of collection, or the recipients of personal information is notified to the notify list by email before it takes effect.

Contact

Questions about this policy and all privacy requests should be sent to contact@teaandtoast.co.

Email is the method offered for a privacy request, because Tea & Toast operates exclusively online. Post reaches the same person at the address below and is answered the same way.

California residents may lodge a complaint with the California Attorney General's office. Residents of other states may contact their own state Attorney General.

Back to the home page