When you order

At checkout we ask for your name, email, phone (required for shipped orders), and a delivery or shipping address, plus what you ordered and any notes. We use these to make the order, confirm it by email, and get it to you. Payment happens on a secure page run by our payment partner, iPOSpays — your card number never touches our website, and we never see or store it.

For shipped orders we pass your name, address, and phone to ShipStation to print the label — carriers require them. Delivery and pickup orders stay with us.

Emails we send

• Order confirmations go to the email you gave at checkout, with a copy to us.
• Newsletter — only if you sign up. You’ll get a welcome note and occasional news (new flavors, market days, seasonal treats). Every one carries an unsubscribe link; one click and you’re off the list.
• Cart reminder — only if you tick the box at checkout. If you step away before paying we send a single reminder, never a series, and we forget the cart after 14 days or the moment you order.
• Custom-order inquiries you send through the form are emailed to us so we can reply.

Emails are delivered through Resend, our email service.

Ask Khota (our AI helper)

The chat helper on this site is powered by artificial intelligence (Anthropic’s Claude). What you type is sent to that service to generate an answer and is not saved by us afterward. Khota can make mistakes — treat answers as a friendly guide, and always confirm allergen or health questions with us directly. Please don’t share sensitive personal information in the chat.

Cookies, storage, and analytics

We set no advertising cookies and use no tracking pixels. The site keeps a small cookie that remembers you’ve seen the intro animation, a short-lived secure cookie that carries your order details while you pay, and your cart in your own browser’s storage. We use Vercel’s privacy-friendly analytics to count visits and page speed in aggregate — no personal profiles, no cross-site tracking.

Who we share with

Only the services that run the site, and only what each one needs: Vercel (hosting and analytics), Upstash (the small database behind newsletter signups and cart reminders), Resend (email), iPOSpays / Dejavoo (payments), ShipStation (shipping labels), and Anthropic (Ask Khota). We never sell, rent, or trade your personal information, and we don’t share it for anyone else’s marketing.

How long we keep things

Order confirmations live in our mailbox as our record of your order. Newsletter addresses stay until you unsubscribe. Cart reminders are deleted after 14 days. Inquiry emails stay in our mailbox until we’ve helped you.

Your choices

Unsubscribe from the newsletter with the link in any email. To see, correct, or delete the information we hold about you, email hello@candykhotad.com — a real person answers.

Children

Our site is meant for adults placing orders. We don’t knowingly collect personal information from children under 13; if you think a child has given us some, email us and we’ll delete it.

Security

The site runs over HTTPS, card details are handled entirely by our payment partner, and the keys that connect our services are kept on the server, never in your browser.

Changes and contact

If we change how the site handles your information, we’ll update this page and the date at the top. Questions? Email hello@candykhotad.com. See also our terms.