Privacy Policy

This Privacy Policy explains what personal data MyOliveTree collects, why we collect it, who we share it with, and the choices you have. We keep it plain, because you should be able to understand what happens to your data without a law degree.

1. Information we collect

We collect the following, mostly because you give it to us or because you use the site:

• Account details: your email address, a password (stored only as a secure hash, never as plain text), and a display name.
• Order and adoption details: the adoption tier and grove region you choose, your order and renewal history, and the Stripe identifiers tied to your payments (see below).
• Shipping details: when you claim a shipment, the name and full delivery address (address lines, city, region, postal code, and country) you provide. For a gift, the recipient's name and email address and the message you write to them.
• Personalization content: the text you put on your custom bottle label and any image you upload, plus your tree's name and any photo you add to it.
• Communications: the emails you send us and our replies, and a log of the transactional emails we send you (the recipient address, subject, and message type).
• Usage and device data: your IP address, browser and device type, the pages and actions you take on the site, and related identifiers, collected through the analytics and advertising tools described in section 5.

We do not collect or store a phone number. Where a form offers one as optional, it is not saved to your account.

2. How we use your information

• To take and fulfill your adoption: process your payment, produce your label, ship your oil, and manage seasonal renewals and gifts.
• To create and manage your account and your virtual tree on the grove map.
• To send transactional messages you need: order and shipping confirmations, renewal reminders, gift-claim links, password resets, and season updates about your tree.
• To provide customer support and answer your questions.
• To send marketing about MyOliveTree where allowed by law, always with an easy way to opt out.
• To measure and improve the site and our advertising (see section 5).
• To keep the service secure, prevent fraud, and meet our legal, tax, and accounting obligations.

3. Legal bases for processing

Where the GDPR applies, we rely on these legal bases:

• Contract: to provide the adoption and services you buy and to manage your account.
• Legitimate interests: to run, secure, and improve our business, prevent fraud, and market responsibly where permitted, balanced against your rights and freedoms. We do not rely on legitimate interests for the non-essential analytics and advertising technologies in section 5.
• Consent: for marketing emails where the law requires it, and, for visitors in the EEA and UK, for the non-essential analytics and advertising technologies described in section 5, which under ePrivacy rules require your consent before they load. Where we rely on consent you can withdraw it at any time. Section 5 explains how this works today and how you can opt out.
• Legal obligation: to keep records and meet tax, accounting, and consumer-law duties.

4. Who we share information with

We do not sell your personal data. We share it only with the service providers who help us run MyOliveTree, and only with the data each of them needs:

• Stripe handles payments and subscription billing, and receives your email and purchase details. Your payment is processed by Stripe; we never see or store your card number.
• Resend sends our transactional email, and receives the recipient address, subject, message, and any attachments (such as your tree certificate PDF).
• Cloudflare R2 stores the files you upload (label and tree images) and the certificate PDFs we generate.
• Google receives analytics data through Google Analytics 4, as described in section 5.
• Meta receives advertising-measurement data through the Meta Pixel and Conversions API, as described in section 5.
• Hosting and infrastructure providers run our website, database, and background jobs.
• Delivery and fulfillment providers receive the shipping details needed to produce and deliver your oil.

We may also disclose information where required by law, to enforce our Terms, to protect our rights or the safety of others, or in connection with a merger, acquisition, or reorganization (with continued protection of your data).

5. Cookies, analytics, and advertising

We use cookies, local storage, and similar technologies to keep the site working, to understand how it is used, and to measure our advertising.

Essential storage. These items are strictly necessary to run the site and cannot be switched off:

• A first-party login cookie named ov_refresh keeps you signed in. It is httpOnly, marked Secure in production, uses SameSite=Lax, and lasts about 30 days. Login does not work without it.
• A short-lived access token kept in the app's memory (not in a cookie).
• A cart record in your browser's local storage, which holds no personal data.
• A pending-order record in local storage that lets you complete checkout. It can include your email and, for a gift, the recipient's name and email.

Analytics and advertising. These are not essential. They help us measure traffic and our ads, and in the EEA and UK they require your consent before they load. This bucket includes:

• An identity record in your browser's local storage that can include your email and Meta identifiers, together with event IDs used to de-duplicate ad-measurement events.
• Google Analytics 4 measures traffic and how visitors move through the adoption funnel (for example page views, add-to-cart, begin-checkout, and purchase). With Enhanced Conversions, it sends your email address to Google. Google sets _ga cookies.
• Meta Pixel (in your browser) measures ad performance. Advanced Matching sends Meta your email address (hashed by the pixel) along with an identifier, and each event carries an event ID. Meta sets _fbp and _fbc cookies.
• Meta Conversions API (on our server) sends Meta a server-side purchase event. It contains a hashed email address, your Meta browser identifiers (fbp and fbc), an external ID, and your IP address and user-agent. It is matched to the browser pixel through a shared event ID so the same purchase is de-duplicated rather than double-counted.

We do not currently show a cookie-consent banner or preferences tool: today these analytics and advertising technologies load based on our configuration when you visit the site. You can control or block them through your browser settings, though blocking some cookies may affect how the site works, and you can write to info@myolivetree.it at any time and we will help you opt out of analytics and advertising. If you are in the EEA or UK, where consent is normally required before such technologies load, please use those browser controls or contact us; we may also introduce a consent tool in the future.

6. Marketing and communications

The transactional messages you need (order, shipping, renewal, gift-claim, and password emails) are part of providing the service, so they are not marketing and cannot be switched off while you have an active adoption. Marketing emails are separate: you can unsubscribe at any time using the link in the email or by writing to info@myolivetree.it.

7. Data retention

We keep your personal data while you have an account or an active adoption. After that, we keep it only as long as we need it: to meet our legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements. You can ask us to delete your data at any time and we will do so, subject to those obligations. Deletion and access requests are handled by our team rather than a self-serve tool, so please email info@myolivetree.it and we will take care of it.

8. International data transfers

Your data is processed internationally, including in the United States. Some of our service providers process data outside your own country. Where personal data is transferred out of the EU/EEA or the UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (or the UK equivalent) or an adequacy decision. You can ask us for more detail about the safeguards in place.

9. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is inaccurate or incomplete;
• delete your data ("right to be forgotten"), subject to legal retention duties;
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent where we rely on it; and
• lodge a complaint with your data-protection or supervisory authority.

To exercise any right, write to info@myolivetree.it. We may need to verify your identity first, and we will respond within the time the law allows.

10. California privacy rights

If you are a California resident, you have rights under the CCPA and CPRA, including the right to know what personal information we collect and how we use it, to access and delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. The categories of personal information we collect, and the sources and purposes, are described in sections 1 and 2, and the parties we disclose them to are listed in section 4. The categories we "share" for cross-context behavioral advertising are identifiers (such as a hashed email address and Meta or cookie IDs) and internet or device activity.

Any sensitive personal information we hold, such as your account login credentials, is used only to provide and secure the service and is not used to infer characteristics about you, so the CPRA right to limit the use of sensitive personal information does not apply.

We do not sell your personal information for money. However, our use of the Meta and Google advertising tools described in section 5 may be treated as "sharing" for cross-context behavioral advertising under California law. You can opt out of this sharing by using your browser's cookie controls to block the analytics and advertising cookies, or by writing to info@myolivetree.it, and we will not discriminate against you for exercising any of these rights.

11. Data security

We take reasonable technical and organizational measures to protect your data: encryption in transit, passwords stored only as secure hashes, payment handling delegated to Stripe, and access limited to those who need it. No method of transmission or storage is perfectly secure, but we work to keep your data safe and will notify you and the relevant authority of a breach where the law requires.

12. Children's privacy

MyOliveTree is intended for adults. Our services are directed to people 18 and over, are not directed to children under 18, and we do not knowingly collect their personal data or ask for age information. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, give reasonable notice. Please check back occasionally.

14. Contact

For any question about your privacy or to exercise your rights, write to info@myolivetree.it. Real people read every email. You can also read our Terms.