Skip to content
Crown Garden – Flower, Cake & Gifts

Privacy Policy

Last updated: 10 November 2026

Crown Garden is operated by Muhammad Ali Durrani in I-8 Markaz, Islamabad, Pakistan. This policy covers this shop and Events Decor enquiries.

Information and purposes

  • Google customer and authorised staff sign-in provides a name, email address, profile picture and account identifiers. We do not receive your Google password.
  • Orders include recipient/contact details, delivery address and map coordinates, items, totals and payment references. Event enquiries include your name, WhatsApp number, email, event date/location, guest count, budget and requirements. We use these to respond, quote, arrange services and fulfil orders.
  • Browser local storage holds your cart, checkout details, sign-in session and courtesy request cooldowns. Shared devices can retain these until you clear browser data or sign out.
  • Hosting and authentication providers process technical information such as IP addresses, request logs and device information for delivery, security and abuse prevention. Request budgets use hashed contact identifiers, not device fingerprinting.

Newsletter

Newsletter signup is optional and signed-in only. There is no separate email box: if you choose Subscribe, we use the email address on your Google account. We do not send SMS marketing. Contacting us or requesting a quote does not subscribe you to marketing.

A newsletter record stores: your email address, the time you subscribed (created_at), an unsubscribe token used in unsubscribe links, and a yes/no flag that you confirmed you are 13 or older (age_confirmed). The list table does not store a separate user id. Unsubscribing removes that record; we do not keep an “unsubscribed at” timestamp on it.

You can unsubscribe here at any time, or delete your account from My Account, which also removes any newsletter record matching your account email.

13+ sign-in confirmation

When you sign in with Google you are asked to confirm that you are 13 or older and that you agree to the Terms and Privacy Policy. After that confirmation we store two fields on your customer profile: age_confirmed_at (the time you confirmed) and terms_version (the version of the Terms and Privacy Policy you agreed to). We do not store your date of birth or any other age information.

These fields are stored in Supabase, our database provider, so we can see that you confirmed before checkout or newsletter signup. We keep them while your account exists. They are cleared and the profile is deleted when you use My Account → Delete my account and data.

Where data goes

  • Supabase: database, authentication and product image storage. Customer profiles, orders, enquiries, newsletter subscriptions and authentication sessions are processed here. Only authorised staff can read all order/enquiry/marketing records; customers can read their own account/orders.
  • Cloudflare Pages: website hosting and content delivery. Cloudflare receives network/request information when you visit.
  • Google: OAuth sign-in for both customers and authorised administrators. A displayed profile image may load from Google. Following our Google Maps link opens Google's service.
  • WhatsApp (Meta): if you open an order/support chat, the prefilled text and anything you send are processed by WhatsApp. Enquiry contact details may be used to respond about your request; this is not consent to SMS marketing.
  • OpenStreetMap, Nominatim and the public OSRM routing service: map requests, address searches and selected coordinates are sent for maps, address lookup and delivery-distance estimates.
  • Images and fonts: product, category and event reference photos and fonts are served from this website (Cloudflare Pages), not Google Fonts or Unsplash.
  • Delivery/service providers receive the minimum contact, location and event details needed to carry out your requested order or service. Card payments are currently disabled. We do not collect or store card numbers; bank-transfer references are stored with orders.

Providers may process data outside Pakistan under their own terms and privacy policies. We do not sell personal information. This site does not install session-replay, keystroke-recording or Google Analytics scripts.

Retention and deletion

We keep operational records while needed to provide the requested services and manage enquiries, orders, security and any applicable recordkeeping obligations. Contact us about access, correction or removal of records not tied to an account. We have not set a universal automatic retention period.

Customers can use My Account → Delete my account and data. This removes the login, sessions, profile (including age_confirmed_at and terms_version), order history, and newsletter/enquiry records matching the account email from the live application. Customers cannot upload files. Deletion is refused for staff accounts or accounts with legacy stored files until staff arrange safe file removal. External WhatsApp/Google records and service-provider backups are not erased by this control; contact those providers or us as appropriate. Backups follow the providers' retention cycles.

Contact

For privacy or children's-data concerns, call or WhatsApp +92 300 5564122 or visit Crown Garden, I-8 Markaz, Islamabad, Pakistan. Hours: daily 8:00 AM to midnight (Pakistan time).

Contact us

CROWN GARDEN. Flower, Cakes & Gift — i vista plaza, Street 8, I-8 Markaz, Islamabad 46000, Pakistan (Located in Vista). Open daily 8:00 AM – 12:00 AM (midnight). Phone / WhatsApp: +92 300 5564122.