What we hold, and what we will never do with it.

Who we are

SeedStand is operated by Sequel Solutions LLC, a limited liability company registered in the State of Michigan, United States.

Privacy questions go to support@seedstand.org.

The short version

• A district's customer list belongs to that district. Not to us. It is exportable in full, at any time, without asking us.
• We do not sell, rent, or broker personal data to anybody, ever.
• We do not show advertising and we do not run advertising or analytics trackers that follow people across other websites.
• We never see card numbers. Card payments go directly to Stripe.

Two kinds of people, two relationships

District staff hold accounts with us. We are the data controller for their account details — name, email address, and the password hash needed to sign them in.

People who buy plants do not have accounts with us. They give their details to a district, and we hold those details on that district's behalf and under its instructions. We are the processor; the district is the controller. If you bought plants and want your data corrected or deleted, the fastest route is to ask the district you ordered from. If you would rather ask us, write to support@seedstand.org and we will pass it to them and confirm what happened.

What we collect

From district staff: name, email address, password (stored only as a hash), and the district details they enter — sale name, catalogue, pickup locations, policies, and any branding they upload.

From plant buyers, at checkout: name, email address, optional telephone number, optional mailing address, the items ordered, the chosen pickup time, and any note they add. Email address is optional but recommended — without one, no order confirmation can be sent.

Automatically: ordinary server logs (IP address, timestamp, page requested) kept for security and debugging; the network address an online order was placed from, kept with that order so a district can spot a burst of fake orders; and a small number of strictly necessary cookies — a sign-in session for district staff, and a cart cookie for shoppers. There is no advertising cookie and no cross-site tracking pixel. On the public pages and district storefronts we also keep a cookieless count of page views (which pages, how many, roughly where from), kept by Vercel on our own domain — no cookie, no cross-site identifier, and nothing that identifies you.

Mailing lists and consent

A buyer joins a district's mailing list only by ticking the box at checkout. The tick is stored against them, and it is theirs to withdraw — every marketing email carries the district's postal address and a link to stop receiving them.

Order confirmations and pickup reminders are sent either way.Those are transactional messages about a purchase somebody actually made, not marketing, and turning off marketing does not turn them off.

The product deliberately keeps two separate exports — a mailing-list file and an all-customers file — so that a district cannot email people who opted out by accident.

Who else touches the data

We use a small number of subprocessors, and only these:

• Vercel — application hosting (United States).
• Neon — the database (United States).
• Resend — sending transactional and announcement email.
• Stripe — card payment processing, where a district has enabled it. Stripe receives the payment details directly; we receive only the result.

We do not transfer personal data to anyone else, and we will not, except where a law or a valid legal process requires it — in which case we will tell the affected district unless we are legally forbidden from doing so.

How long we keep it

Order and customer records are kept for as long as the district keeps its account, because a district needs last season's list to run this season's sale. When a district closes its account, we delete or irreversibly anonymise its data within 90 days, except where we are required to retain records — for example payment records kept for tax purposes.

Your rights

Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected, to have it deleted, and to object to certain uses. We honour these requests regardless of where you live, because drawing a line through the middle of a mailing list based on a postcode is not a policy we want to operate.

Write to support@seedstand.org. If the request concerns data a district holds, we will route it to that district and tell you we have done so.

Children

SeedStand is a tool for district staff and their adult customers. It is not directed at children and we do not knowingly collect personal data from anyone under 13. If you believe we have, write to support@seedstand.org and we will delete it.

Changes

If we change this policy in a way that materially affects how personal data is used, we will tell district administrators by email rather than quietly changing the date at the top. See also our terms of service.