What we hold, and what we do with it.

Who we are

SeedStand is operated by Sequel Solutions LLC, a limited liability company registered in the State of Michigan, United States.

Privacy questions go to support@seedstand.org.

The short version

• A district's customer list belongs to that district. Not to us. It is exportable in full, at any time, without asking us.
• We do not sell, rent, or broker personal data.
• We do not show advertising and we do not run advertising or analytics trackers that follow people across other websites.
• We never see card numbers. Card payments go directly to Stripe.

Two kinds of people, two relationships

District staff hold accounts with us. We are the data controller for their account details: name, email address, and the password hash needed to sign them in.

People who buy plants do not have accounts with us. They give their details to a district, and we hold those details on that district's behalf and under its instructions. We are the processor; the district is the controller. If you bought plants and want your data corrected or deleted, the fastest route is to ask the district you ordered from. If you would rather ask us, write to support@seedstand.org and we will pass the request to the district.

What we collect

From district staff: name, email address, password (stored only as a hash), and the district details they enter: sale name, catalog, pickup locations, policies, and any branding they upload.

From plant buyers, at checkout: name, email address, optional telephone number, the items ordered, the chosen pickup time, and any note they add. An email address is needed to pay by card and recommended otherwise; without one, no order confirmation can be sent. For an order taken on paper or by phone, the district may also enter a mailing address.

Automatically: ordinary server logs (IP address, timestamp, page requested) kept for security and debugging; the network address an online order was placed from, kept with that order so a district can spot a burst of fake orders; and a small number of strictly necessary cookies: a sign-in session for district staff; a security cookie that remembers which browsers have signed in to an account before, so failed sign-in tries from elsewhere do not lock its owner out; a cookie for the sale an administrator is viewing and a short-lived one for card setup; and, for shoppers, a cart cookie and short-lived cookies that keep the checkout form and the order just placed. There is no advertising cookie and no cross-site tracking pixel. On the public pages and district storefronts we also keep a cookieless count of page views (which pages, how many, roughly where from), kept by Vercel on our own domain, with no cookie, no cross-site identifier, and nothing that identifies you.

From anyone who joins a waitlist on a district's online store: an email address and an optional name. SeedStand uses them to send that person the district's back-in-stock email for that plant, to show the district whether that person has since ordered it, and to check them against the district's unsubscribe list. The district can see and download its waitlist. Every such email has a link to be removed from the waitlist, the district can remove anyone on request, and unsubscribing from the district's emails after joining also stops them. The store also remembers, in that browser, which plants it joined a waitlist for and when. No email address is kept there.

In a shopper's browser: while a store page is open, what the shopper types and chooses at checkout (name, email address, telephone number, note, pickup time and payment choice) and into Find my order (the order number and the email address or telephone number) is kept in that browser tab's session storage, so going back a page does not empty the boxes. While a card payment is still being checked, the tab also keeps that payment's reference and the items ordered, so reloading the page finishes that payment instead of starting a second one. Nothing about a card is kept there. It is removed when the order is placed or found, or when the tab is closed. After Place order is pressed, the browser also keeps, for 30 minutes, a random code for that order and a scrambled check of its details, not the details themselves, so that pressing again after a lost connection does not place the order twice. After 30 minutes it is no longer used, and it is removed the next time a store page is opened in that browser.

On volunteers' phones: the volunteer check-in page keeps that sale's pickup list (customer names, order numbers, items and amounts owed, never email addresses or phone numbers) in the phone's browser storage, so it works without a signal. It stays on the phone until the browser's site data for seedstand.org is cleared.

Mailing lists and consent

On a district's online store, a buyer joins its mailing list only by ticking the box at checkout and giving an email address. The tick is stored against them, and it is theirs to withdraw: every marketing email carries the district's postal address and a link to stop receiving them.

Order emails are sent either way. The order confirmation, notices about changes to the order and, if the district sends one, a pickup reminder are messages about a purchase, not marketing, so turning off marketing email does not stop them.

There are two separate exports: a mailing-list file, which leaves out anyone who has not said yes, and an all-customers file.

Who else touches the data

We use a small number of subprocessors, and only these:

• Vercel: application hosting (United States).
• Neon: the database (United States).
• Resend: sending transactional and announcement email.
• Stripe: card payment processing, where a district has enabled it. Stripe receives the payment details directly; we receive only the result. We also send Stripe the buyer's email address, for Stripe's receipt, and the district's name.
• Anthropic (Claude): for the optional catalog import from an order form. It receives only the file you upload, and only when you use that import.

We do not transfer personal data to anyone else, and we will not, except where a law or a valid legal process requires it. In that case we will tell the affected district unless we are legally forbidden from doing so.

How long we keep it

Order and customer records are kept for as long as the district keeps its account, because a district needs last season's list to run this season's sale. No order or customer record is deleted automatically, including after a sale closes.

A district can ask in writing for its data to be deleted, as described in the terms. We then delete or irreversibly anonymize it, except payment records (amounts, dates and order numbers), which are kept for as long as tax law requires.

If data is exposed

If we learn that a district's data was accessed without authorization, we will notify the district's administrator by email without undue delay.

Your rights

Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected, to have it deleted, and to object to certain uses. We honor these requests wherever you live.

Write to support@seedstand.org. If the request concerns data a district holds, we will pass it to that district.

Children

SeedStand is a tool for district staff and their adult customers. It is not directed at children and we do not knowingly collect personal data from anyone under 13. If you believe we have, write to support@seedstand.org and we will delete it.

Changes

Our policy on changes: when we change this page, we change the date at the top. We will email your district's contact email address before a material change takes effect. See also our terms of service.