Privacy policy
Last updated 29 August 2026
We take your privacy seriously. This explains what we collect, who we share it with, and what you can tell us to stop doing. We sell only within the United States, so this is written around US privacy law.
What we collect
- Order information — your name, email address, delivery address and, if you give it, your phone number.
- Payment information — handled entirely by Square. Card details are entered into fields hosted by Square and never reach our servers.
- Resale exemption details — if you tell us an order is for resale, we record that and your New York Certificate of Authority number, because we are required to keep it on file.
- Technical data — the IP address a request came from, kept in server logs.
What we do with it
- Take payment, pick your order and get it to you
- Answer your questions and provide support
- Meet our tax record-keeping obligations
- Detect and prevent fraud
Cookies and tracking
This site runs no analytics and no advertising trackers. There is no Google Analytics, no Meta pixel, no advertising network, and nothing that follows you to another website.
These are the only cookies involved:
cw_session— keeps your basket between pages. Set by us, expires when you close your browser.- Square sets its own cookies on the checkout page to process your payment securely and detect fraud.
You can refuse cookies in your browser settings. The session cookie above is the one the site needs, so refusing it mainly means your basket will not survive between pages.
Who we share it with
We do not sell your personal information, and we do not share it for advertising. We share it only with:
- Square — to take your payment and record the sale against our inventory
- Shipping carriers — USPS and other carriers, to deliver the parcel
- Government authorities — where the law requires it, including sales tax records
How long we keep it
Order records are kept for as long as tax and accounting rules require. Resale certificates are kept while they are relied on and for the record-keeping period afterwards. Server logs are kept briefly and then discarded.
Your choices
You can ask us what we hold about you, ask us to correct it, or ask us to delete it — email Suffolkcandy@gmail.com and we will respond. We cannot delete records we are legally required to keep, such as completed order and tax records, and we will tell you if that applies.
Children
This site is not directed at children and we do not knowingly collect information from anyone under 13.
Changes
If this policy changes we will update the date at the top. Material changes will be obvious rather than quiet.