Privacy Policy

1. Who we are

The Flying App is a local farm in Grandora, Saskatchewan. This policy applies to theflyingappsk.ca, our customer reservation service, garden preview and sharing features, and related communications.

2. Information we collect

Depending on how you use the service, we may collect:

• Account information: your name, email address, sign-in provider, and the provider account identifier needed to connect your account. We support Microsoft, Google, and Facebook sign-in and do not receive your provider password.
• Reservation and service information: products, quantities, selected options, pickup date, price, order status, phone number, notes, and communications about the reservation.
• Images and content: garden photos, generated garden previews, images you choose to share, and content you submit through site features.
• First-party traffic measurement: a random browser session identifier stored in your browser's sessionStorage; page paths; product views; reservation, game, contact, directions, and social-link actions; and timestamps. If present, we also record sanitized campaign details (UTM source, medium, and campaign) and the referring website's domain only. This helps us understand which pages and outreach are useful without adding a new third-party analytics cookie.
• Order attribution: when you make a reservation, campaign details and the landing page associated with that browser session may be saved with the reservation so we can understand how customers find us.
• Hosting, security, and diagnostic information: Azure, Cloudflare, and our application infrastructure may process IP address, browser and device information, requested pages, timestamps, diagnostic events, and error or security logs to deliver and protect the service. Our first-party traffic-measurement table does not store IP addresses or full referring-page URLs.
• Cookies and browser storage: an essential session cookie keeps you signed in and protects account requests. The first-party traffic measurement described above uses sessionStorage, not a tracking cookie. The Facebook page plugin, Google Maps, and font providers may set or read their own identifiers when their content loads.

3. Why we use information

We use information to authenticate accounts; accept, confirm, update, and fulfil reservations; manage inventory and pickup; respond to requests; send service notifications; provide garden previews and approved gallery sharing; understand website traffic and outreach; secure, troubleshoot, and improve the service; maintain business and accounting records; and meet legal obligations.

Where applicable, we ask for consent or provide choices. Some processing is needed to provide a service you request, while other processing supports reasonable business, security, and legal purposes, subject to applicable law. You can withdraw optional consent, but that does not affect processing already completed and may limit the related feature.

4. Service providers and disclosures

We do not sell personal information. We disclose it only as needed to operate the service, respond to you, protect the business or users, or comply with law. Providers may include:

• Microsoft Azure and Cloudflare for hosting, delivery, availability, and security.
• Microsoft, Google, and Meta when you choose their sign-in services. Google Maps, Google Fonts, and the Facebook page plugin also receive browser requests when embedded content loads.
• OpenAI when you use the garden preview feature; the submitted garden image and instructions are processed to generate the preview. Authorized administrators may also use an AI assistant for business operations.
• Email providers for reservation and administrative service messages.

Some providers process information outside Saskatchewan or Canada. Their privacy laws may differ, and lawful authorities in those locations may be able to access information.

5. Retention

• Signed-in sessions normally expire after up to 30 days of inactivity.
• Unshared garden preview files are normally removed after about 24 hours. Approved shared images remain until removed by you or an administrator.
• First-party website event records are retained for up to 395 days. The random browser session identifier is not an account identifier, although reservation actions may be connected to the reservation they create.
• Account and reservation records, including order-attribution fields saved with a reservation, are retained while needed to provide service, maintain accurate inventory and business records, resolve disputes, and meet tax, accounting, or other legal requirements.
• Operational and security logs are kept only as long as reasonably needed for reliability, fraud prevention, and investigation.

Backup copies may persist for a limited period after live records are changed or deleted.

6. Safeguards

We use access controls, encrypted network connections, secure cookies, restricted administrative functions, input and upload validation, backups, and monitoring appropriate to a small business service. No internet or storage system can be guaranteed completely secure.

7. Your choices and rights

You may ask to access or correct your information, withdraw optional consent, remove shared content, or request deletion subject to records we must retain. See our data deletion instructions. You can also disconnect The Flying App in your Microsoft, Google, or Facebook account settings.

8. Children

The service is intended for people who can make a farm purchase or reservation. If you believe a child provided personal information without appropriate consent, contact us so we can review and remove it where required.

9. Changes to this policy

We may update this policy as our services or providers change. We will post the revised policy here and change the “Last updated” date. Material changes will be highlighted when appropriate.

10. Contact

This policy is general operational information and is not legal advice. The business should obtain Canadian privacy-law review as its data use and customer volume grow.