Privacy Policy & Paid Advertising Tracking Disclosures

Categories of Data Collected

We collect information strictly necessary to fulfill retail plant inquiries, provide horticultural specifications, and evaluate traffic sources. The data captured comprises:

• Inquiry Submission Records: Name, telephone number, email address, physical delivery or planting municipality, plant categories of interest (annuals, shrubs, trees, produce), specific quantity or cultivar notes, and consent confirmation timestamp.
• Technical Diagnostic Logs: Visitor IP address, user-agent string, operating system version, browser family, referring URL, time of page request, and timestamp of form presentation.
• Support Chat Logs: Text transcript of nursery questions submitted through the Millbury Street desk widget, associated local session token, and optional contact details provided voluntarily.
• Consent Choice Record: Consent state stored under the key site_consent_v2 in the visitor's browser local storage.
• Paid Advertising Identifiers: Inbound query strings appended by commercial search engines, specifically gclid (Google Ads), msclkid (Microsoft Advertising), and fbclid (Meta Ads).

Operational Purposes

Data collected through cynthiabertrand.com is deployed exclusively for explicit business purposes:

• Calculating non-binding plant pricing and confirming nursery bed stock availability for customer orders.
• Transmitting grower recommendations regarding soil prep, root-flare depth, and frost hardening suited to Auburn and Worcester County.
• Diagnosing server performance, combating spam submissions via hidden field traps, and preventing unauthorized site scraping.
• Measuring advertising campaign effectiveness to determine whether paid search listings generate genuine nursery inquiries.

Legal Grounds for Processing

For visitors protected by the European General Data Protection Regulation or equivalent international frameworks, our processing activities rest upon distinct statutory bases:

Paid Advertising Integrations

This website is an active landing destination for commercial marketing campaigns. Cynthiabertrand runs paid traffic from google ads, microsoft advertising, and Meta Ads. Click identifiers attached to inbound visits are: gclid, msclkid, fbclid.

When a visitor arrives via a paid listing, the platform attaches a unique query parameter to the destination URL. Specifically, our systems evaluate:

• gclid — Click identifier assigned by google ads.
• msclkid — Click identifier assigned by microsoft advertising.
• fbclid — Click identifier assigned by Meta Ads.

These tokens allow the respective ad networks to attribute an inquiry form submission to a specific keyword or advertisement. Nothing on this website implies that Google, Microsoft, or Meta has inspected, endorsed, or verified our nursery practices or plant specimens.

Google Consent Mode v2 Implementation

To maintain strict compliance with ad network policies and privacy standards, this website operates Google consent mode v2. Prior to any visitor interaction with the consent banner, four foundational permission signals are held denied until the visitor allows storage, and set back to denied when they decline: ad_storage, ad_user_data, ad_personalization, analytics_storage.

• ad_storage — Prevents persistent cookie storage for advertising purposes.
• ad_user_data — Prohibits transmitting end-user personal identifiers to Google ad systems.
• ad_personalization — Disallows remarketing and personalized profile generation.
• analytics_storage — Restricts non-essential analytical cookies.

Consent Mode v2 holds ad_storage, ad_user_data, ad_personalization, and analytics_storage denied until the visitor allows storage, and sets them back to denied the moment the visitor declines or withdraws consent. When you select “Accept Storage,” an update event transmits granted signals to the tag API. If you select “Decline Non-Essential” or withdraw permission at any time, all four signals are instantly returned to denied.

Third-Party Data Processors

We disclose necessary data points to specified third parties and advertising processors under strict confidentiality contracts:

• Google Ireland Ltd / Google LLC: Google Ads delivery, conversion modeling, and tag management.
• Microsoft Ireland Operations Ltd: Microsoft Advertising search measurement. Its own handling is covered by the Microsoft privacy statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms Inc: Meta Ads attribution where seasonal campaigns are active.
• Hosting Provider & Mail Route: The hosting provider that serves this site and stores the enquiry database, and the mail provider that carries the notification to the operator's inbox ([email protected]).

Cross-Border Data Transfers

Data received through cynthiabertrand.com is hosted on secure servers in the United States. Where visitors connect from the European Economic Area, the United Kingdom, or Switzerland, transmissions rely upon the European Commission's Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework to safeguard information during cross-border transit.

Data Retention Schedules

We retain personal records only for the finite time spans required to satisfy agricultural, legal, and tax obligations. We do not retain data under open-ended or indefinite timelines. Authoritative retention limits are:

• Plant Inquiries & Email Communications: Retained for exactly 18 months from the date of submission to accommodate seasonal re-ordering and planting follow-up.
• Support Chat Transcripts: Retained for exactly 12 months in server records, after which they are systematically purged.
• Server Security & Access Logs: Retained for exactly 90 days before automatic system rotation and permanent deletion.
• Consent Selection Records (site_consent_v2): Stored in local browser storage for 12 months, after which the prompt re-appears for reaffirmation.
• Data Subject Access Requests (DSAR): All validated verification requests are processed and answered within 10 days.

Technical & Physical Security Safeguards

We enforce administrative and digital safeguards to protect customer inquiries against interception, theft, or unauthorized alteration:

• Transport Layer Security (TLS 1.3) cryptographic encryption enforcing HTTPS across the entire domain.
• Firewalled backend relational databases isolated from public web directories.
• Automated bot mitigation and honeypot field traps on all inquiry forms.
• Strict credential access limited exclusively to authorized nursery management at 148 Millbury Street.

Protection of Children's Privacy

cynthiabertrand.com is a commercial nursery and farmstand catalog intended for adult property owners, landscapers, and gardeners. We do not intentionally solicit or collect personal information from individuals under sixteen (16) years of age. If we learn that a minor has submitted personal data without verified parental consent, that record is deleted immediately.

European GDPR Rights

Visitors located within the European Economic Area possess comprehensive statutory entitlements under the gdpr: access, rectification, erasure, restriction, portability, objection, and withdrawing consent.

• Right of Access: You may request copies of personal data maintained about you.
• Right to Rectification: You may demand correction of inaccurate or incomplete contact records.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your inquiry details when retention is no longer necessary.
• Right to Restriction: You may request temporary suspension of data processing during dispute resolution.
• Right to Data Portability: You may request your data in a structured, machine-readable format.
• Right to Object: You may object to data processing based on legitimate interests.
• Right to Withdraw Consent: You may withdraw advertising storage consent at any moment via the footer controls.

United States State Privacy Rights (CCPA / CPRA)

Residents of California, Massachusetts, Colorado, Connecticut, Virginia, and other jurisdictions with active consumer privacy enactments hold distinct rights under statutes including the California Consumer Privacy Act (ccpa/CPRA), including opting out of sale or sharing:

• Right to Know: You may request the categories and specific pieces of personal data collected, sold, or shared over the prior 12 months.
• Right to Delete: You may request deletion of personal information collected directly from you.
• Right to Correct: You may request amendment of inaccurate personal records.
• Right to Opt-Out of Sale or Sharing: We do not sell personal information for cash. However, transferring online identifiers via ad pixels may constitute "sharing" under California law. You may opt out of sale or sharing at any time using our banner or GPC signal.
• Non-Discrimination: We will never deny service, adjust plant pricing, or degrade nursery support if you exercise your statutory privacy rights.

Global Privacy Control (GPC) Adherence

We fully recognize and honor the global privacy control (GPC) browser signal. If your browser transmits the Sec-GPC header indicating a universal opt-out preference, our website automatically suppresses advertising tracking and sets Google Consent Mode parameters to denied without requiring secondary manual prompts.

Supervisory Authority Complaints

If you believe our data practices violate statutory provisions, you maintain the right to register a formal complaint with supervisory authorities:

• In Massachusetts: The Office of the Massachusetts Attorney General, Consumer Protection Division.
• In California: The California Privacy Protection Agency (CPPA) or the California Attorney General.
• In the European Union: The Data Protection Authority in your member state of habitual residence.

Data Subject Access Request (DSAR) Procedure

To exercise any statutory right under the GDPR, CCPA, or applicable state laws, submit a written inquiry specifying your name, contact email, and the nature of your request (Access, Erasure, Correction, or Opt-Out).

Digital Accessibility Commitment

Cynthia Bertrand is committed to ensuring digital accessibility for people of all abilities. We strive continually to improve user experience and apply relevant accessibility standards across cynthiabertrand.com.

This website is designed and coded in conformance with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA specifications:

• High-contrast text ratios exceeding 4.5:1 against the authoritative oat (#E8DFD0) ground.
• Fully keyboard-navigable ARIA tab controls, forms, and interactive price estimation tools.
• Visible skip navigation links enabling keyboard users to bypass header chrome directly to main content.
• Touch targets engineered with a minimum 44px tap dimension for mobile and tablet visitors.
• Descriptive alt text for all botanical photographs and diagrammatic plates.

If you experience difficulty accessing any element of this website, please call our nursery counter at (508) 832-2995 or email [email protected] so we can provide the required plant information or assistance promptly.

Direct Privacy & Operator Contact

For all legal, regulatory, and privacy inquiries, Cynthia Bertrand may be reached directly via: