Privacy Policy

Seamless Delivered ("we," "us," or "our") is a Brooklyn-based weekly backdrop paper delivery service operating at seamlessdelivered.com. This Privacy Policy explains what information we collect, why, who we share it with, and your rights regarding it.

By using our Service, you agree to the practices described in this policy. If you don't agree, please don't use the Service.

We collect information you give us directly, information generated when you use the Service, and information from third-party providers we rely on to run the business.

a) Information you give us

• Account info: studio name, contact name, email address, phone number, street address, ZIP code, and password (stored hashed using bcrypt — we never see your plain password).
• Delivery preferences: drop-off instructions you save on your account or add to a specific order.
• Order details: the colors, sizes, and quantities you order; the delivery address and notes for that order.
• Communications: any messages you send us by email or other channels.

b) Information generated automatically

• Session cookie: a single HTTP-only, HMAC-signed cookie used to keep you logged in. Cleared when you sign out or when its 7-day expiry passes.
• Server logs: IP address, browser user agent, and request paths, retained briefly for security, debugging, and abuse prevention.
• Delivery proof photos: when our driver marks an order delivered, they take a photo of the drop-off location. This photo is associated with your order, sent to you by email, and stored on our infrastructure (see Section 4).

c) Information from third parties

• Payment status from Stripe: when you pay, we receive confirmation from Stripe that payment succeeded along with a transaction reference. We do not receive or store your full card number, CVC, or expiration date.
• Email deliverability signals from Resend: open and delivery status of transactional emails (e.g., your confirmation and delivery emails).

• To create and maintain your account;
• To verify your email address, ZIP eligibility, and process orders;
• To accept payments via Stripe and send receipts via Resend;
• To deliver your rolls and send you a delivery confirmation with proof-of-delivery photo;
• To send transactional emails (signup verification, order confirmation, delivery confirmation, waitlist activation);
• To respond to support requests and resolve disputes;
• To plan delivery routes and prioritize zone expansion using aggregate waitlist signups;
• To detect and prevent fraud, abuse, and security incidents;
• To comply with our legal obligations and enforce our Terms of Service.

We do notuse your information for advertising, targeted advertising, or behavioral profiling. We don't sell it.

To operate the Service, we share specific information with a small set of trusted third-party providers. Each one has its own privacy and security obligations; we recommend you read their policies.

• Vercel, Inc. — hosts our application and stores delivery proof photos via Vercel Blob. Vercel Privacy Policy.
• Supabase, Inc. — provides our Postgres database where account info, orders, and order history are stored. Supabase Privacy Policy.
• Stripe, Inc. — processes all payments. Stripe receives your card information directly via its hosted checkout page; we receive only payment status and a transaction reference. Stripe Privacy Policy.
• Resend, Inc. — sends our transactional emails (verification, order, and delivery confirmations). Resend Privacy Policy.
• Cloudflare, Inc. — provides DNS and email security for our domain.

We may also disclose information to government authorities or other parties when required by law (e.g., in response to a valid subpoena), or when necessary to protect the safety, rights, or property of Seamless Delivered, our customers, or the public.

We use a single first-party session cookie (sd_session) to keep you logged in. It is HTTP-only, signed using HMAC-SHA256, marked Secure in production, and expires after 7 days or when you sign out — whichever comes first.

We do not use analytics cookies, advertising cookies, social media tracking pixels, or third-party trackers.

• Account information is kept while your account is active and for a reasonable period afterward to meet our tax, legal, and accounting obligations.
• Order records are retained for at least 7 years for tax and accounting compliance.
• Delivery proof photos are retained for at least 1 year after delivery so we can resolve any later disputes. Older photos may be deleted as part of routine cleanup.
• Email logsfrom Resend follow Resend's retention schedule (currently 30 days for opens/clicks).
• Server logs are typically retained for 30 days.

Depending on where you live, you may have the right to:

• Access the information we hold about you;
• Correct inaccurate or incomplete information;
• Request deletion of your information (subject to legal retention obligations);
• Object to or restrict certain uses of your information;
• Receive a copy of your information in portable form;
• Withdraw consent for processing that is based on consent (e.g., by closing your account).

To exercise any of these rights, email hello@seamlessdelivered.com. We may need to verify your identity before acting on a request. We will respond within the timeframe required by applicable law.

We use industry-standard safeguards, including HTTPS for all traffic, hashed passwords (bcrypt), HMAC-signed session cookies, and access controls on our infrastructure. No system is completely secure, however; we encourage you to use a strong, unique password and to notify us immediately if you believe your account has been compromised.

The Service is intended for businesses and adults 18 or older. We don't knowingly collect personal information from anyone under 18. If you believe a child has provided information to us, please contact us so we can delete it.

Our Service is operated from the United States, and our service providers (Vercel, Supabase, Stripe, Resend, Cloudflare) primarily process data on infrastructure in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., where data protection laws may differ from those in your country.

We may update this Privacy Policy from time to time. The "Effective" date at the top reflects when the current version took effect. If we make material changes, we'll notify registered users by email or post a notice on the site.

Privacy questions or requests? Email hello@seamlessdelivered.com.