The Bake Shop Privacy Policy & Terms of Service

Privacy Policy

Effective Date: 10/28/2025
Last Updated: 10/28/2025

Introduction

Welcome to Bakeshop. This Privacy Policy explains how Wesco Industries, operating The Bakeshop ("we," "us," "our," "Bakeshop," or the "App"), collects, uses, shares, and protects your personal information when you use our mobile application.

The Bakeshop is a community-focused bakery in Denison, Iowa, proudly operated by Wesco Industries—an organization dedicated to enhancing inclusivity and supporting individuals with autism and mental disabilities through meaningful employment and community engagement.

We are committed to protecting your privacy and handling your personal information responsibly and in compliance with applicable laws, including the Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), and other relevant privacy regulations.

By using the Bakeshop app, you consent to the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the App.

1. Information We Collect

We collect several types of information to provide and improve our services.

1.1 Information You Provide Directly

Account Registration: When you create an account, you provide:

• Name

• Email address

• Phone number

• Password (encrypted and securely stored)

• Birthdate (optional, for birthday offers)

Order Information: When you place an order, we collect:

• Items ordered

• Order preferences (pickup, drive-thru, or future delivery)

• Order/Pickup time

• Special instructions or notes

Payment Information:

• Payment card details (securely processed and stored by Square, Inc. - we do not store full card information on our servers)

• Billing information associated with your payment method

Communications:

• Feedback, suggestions, or inquiries you submit through the app

• Customer support communications

Guest Checkout:

• For users who order without creating an account, we collect name, phone number, and payment information for order fulfillment only

1.2 Information Collected Automatically

Device Information:

• Device type and model

• Operating system and version

• Unique device identifiers

• Mobile network information

• IP address

App Usage Data:

• Pages or screens viewed

• Time spent on pages

• Menu items browsed

• App interactions and preferences

• Crash reports and performance data

Location Information (with your permission):

• GPS coordinates

• Approximate location based on IP address

• Location data for future geo features

Push Notification Tokens:

• Device-specific tokens required to send you push notifications via Firebase Cloud Messaging

1.3 Information from Third Parties

Square, Inc.: When you create a Bakeshop account, we automatically create linked accounts with Square:

• Square Customer Account: For payment processing

• Square Loyalty Account: For rewards program participation

We synchronize the following information with Square:

• Name, email, phone number, birthday

• Order history and purchase amounts

• Loyalty points balance

• Payment methods saved to your account

Square may collect additional information in accordance with their privacy policy, available at https://squareup.com/legal/privacy.

2. How We Use Your Information

We use your information for the following purposes:

2.1 Order Processing and Fulfillment

• Process and complete your orders

• Communicate order status and pickup/delivery details

• Send order confirmations and receipts

• Handle cancellations and refunds

2.2 Account Management

• Create and maintain your account

• Authenticate your identity

• Manage your saved payment methods

• Track your loyalty rewards points

• Provide customer support

2.3 App Functionality and Improvement

• Personalize your app experience

• Remember your preferences and order history

• Analyze usage patterns to improve the app

• Identify and fix technical issues

• Develop new features and services

2.4 Communications

• Send push notifications about:

  • Order status updates

  • Promotional offers and announcements

  • New menu items

  • Special events

  • Birthday offers (if you provided your birthdate)

  • Location-based offers when near our store

• Respond to your inquiries and support requests

• Send marketing emails/texts

2.5 Legal and Security Purposes

• Comply with legal obligations

• Enforce our Terms of Service

• Prevent fraud and abuse

• Protect the security of our systems

• Resolve disputes

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We only share your information in the following limited circumstances:

3.1 With Service Providers

We share information with trusted third-party service providers who help us operate the App:

Square, Inc.

• Purpose: Payment processing, customer management, loyalty rewards

• Data Shared: Name, email, phone, birthday, order history, payment information, loyalty points

• Privacy Policy: https://squareup.com/legal/privacy

Amazon Web Services (AWS)

• Purpose: Cloud hosting, data storage, authentication services

• Data Shared: All data stored in our database (encrypted in transit and at rest)

• Services Used:

  • AWS Cognito (user authentication)

  • AWS RDS (database)

    • Feedback, Menu, Orders, non-critical user information

  • AWS Lambda (serverless functions)

  • AWS Secrets Manager (credential management)

• Privacy Policy: https://aws.amazon.com/privacy/

Google Firebase

• Purpose: Push notifications, app analytics

• Data Shared: Device tokens, app usage data, crash reports

• Privacy Policy: https://firebase.google.com/support/privacy

3.2 For Legal Reasons

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, search warrants)

• Government or law enforcement requests

• Protection of our rights, property, or safety

• Protection of our users or the public

3.3 Business Transfers

If Wesco Industries or The Bakeshop is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

3.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

4. Data Security

We implement industry-standard security measures to protect your personal information:

4.1 Technical Safeguards

• Encryption: All data transmitted between your device and our servers is encrypted using SSL/TLS

• Secure Storage: Data at rest is encrypted in AWS databases

• Access Controls: Role-based access restrictions limit who can access your data

• Authentication: AWS Cognito provides secure user authentication with encrypted passwords

4.2 Payment Security

• Payment card information is processed and stored by Square, Inc., a PCI DSS Level 1 certified service provider

• We never store full credit card numbers on our servers

• Payment processing uses tokenization (Using Square) to protect your card data

4.3 Organizational Safeguards

• Regular security audits and monitoring

• Employee training on data protection

• Incident response procedures

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

5. Data Retention

5.1 Active Accounts

• Account Information: Retained indefinitely while your account is active

• Order History: Retained indefinitely and synchronized with Square's systems

• Payment Methods: Retained until you remove them from your account

• Loyalty Points: Retained indefinitely as part of Square Loyalty program

5.2 Inactive Accounts

• Accounts remain active indefinitely unless you request deletion

• We may send periodic reminders if you haven't used the app for extended periods

5.3 Guest Orders

• Guest order information is retained for business and legal purposes (e.g., tax records, refunds)

• Guest data is not used for marketing purposes

5.4 Feedback and Communications

• Feedback submissions are retained at our discretion for business improvement

• Customer support communications are retained for quality assurance and training

5.5 Legal Requirements

• Some data may be retained longer if required by law (e.g., tax records, transaction records)

6. Your Privacy Rights and Choices

6.1 Account Access and Updates

You can:

• View and update your account information in the app settings

• Change your name and password at any time

• Change your email, phone number, birthdate, or other profile information upon request

6.2 Push Notifications

You can control push notifications:

• iOS: Settings > Notifications > Bakeshop

• Android: Settings > Apps > Bakeshop > Notifications

• You can also manage notification preferences within the app

6.3 Location Services

You can control location access:

• iOS: Settings > Privacy > Location Services > Bakeshop

• Android: Settings > Apps > Bakeshop > Permissions > Location

• Disabling location services may limit certain features

6.4 Marketing Communications

• Email and text marketing is opt-in only

• You can unsubscribe from marketing emails by clicking the unsubscribe link in any email

• You can unsubscribe from text messages by replying with “STOP” under any text

• Specific types of push notifications can be disabled in-app settings

6.5 Data Access and Portability

You have the right to:

• Request a copy of your personal data

• Export your order history

• Request information about how we use your data

To request access: Email thebakeshop@wescoind.org with "Data Access Request" in the subject line.

6.6 Data Correction

You have the right to:

• Correct inaccurate information in your account

• Update outdated information

To request corrections: Update your profile in the app or email thebakeshop@wescoind.org.

6.7 Data Deletion

You have the right to:

• Delete your account and associated data

• Request removal from our systems

To request deletion: Email thebakeshop@wescoind.org with "Account Deletion Request" in the subject line.

Important Notes on Deletion:

• Order history may be retained for legal/accounting purposes (up to 7 years)

• Square customer and loyalty accounts will also be affected

• Deletion is irreversible and you may lose your loyalty points

• Some backup data may persist temporarily in our systems

• We will respond to deletion requests within 30 days

6.8 California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

Right to Know:

• What personal information we collect

• The categories of sources from which we collect information

• The purposes for which we use your information

• The categories of third parties with whom we share information

Right to Delete:

• Request deletion of your personal information (subject to legal exceptions)

Right to Opt-Out:

• We do not sell your personal information, so there is nothing to opt out of

Right to Non-Discrimination:

• We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at thebakeshop@wescoind.org with "CCPA Request" in the subject line. We will verify your identity before processing your request.

7. Children's Privacy (COPPA Compliance)

The Bakeshop app is designed for users aged 13 and older.

7.1 Users Under 13

• We do not knowingly collect personal information from children under 13 without parental consent

• If we discover we have collected information from a child under 13 without proper consent, we will delete it immediately

• Parents can request deletion of their child's information by contacting thebakeshop@wescoind.org

7.2 Users Ages 13-17

• Users between 13 and 17 should obtain parental permission before using the app

• Parents can review, update, or request deletion of their teen's information by contacting us

7.3 Parental Controls

Parents or guardians who believe their child has provided information without consent should contact us immediately at thebakeshop@wescoind.org.

8. Location-Based Services

8.1 Current Location Use

We currently use location data only when you explicitly enable it:

• To show the distance to our store

• To provide estimated travel times

• For pickup/delivery features

8.2 Future Geo Features

We plan to implement location-based notifications that will:

• Alert you to special offers when you're near our store

• Remind you about rewards when you're nearby

• Provide real-time updates about store hours

Geo features will be entirely optional and you can:

• Opt in or out at any time

• Control through device location settings

• Manage notification preferences in the app

8.3 Location Data Storage

• Location data is processed in real-time

• We do not store precise location history

• Location is only used when the app is active or when you explicitly enable background location

9. Cookies and Tracking Technologies

9.1 Technologies We Use

• Session Management: Secure tokens to keep you logged in

• Analytics: Firebase Analytics to understand app usage

• Crash Reporting: Firebase Crashlytics to identify and fix bugs

• Performance Monitoring: AWS CloudWatch for app performance

9.2 Third-Party Analytics

Firebase (Google) may use cookies and similar technologies. You can learn more at:

• Firebase Privacy: https://firebase.google.com/support/privacy

• Google Analytics Opt-Out: https://tools.google.com/dlpage/gaoptout

10. International Data Transfers

Our services are based in the United States. If you access the app from outside the U.S.:

• Your information will be transferred to and stored in the U.S.

• U.S. privacy laws may differ from those in your country

• By using the app, you consent to this transfer

For EU/UK Users: We do not specifically target users in the European Union or United Kingdom, but if you use our services from these regions, your data may not have the same protections as under GDPR.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in our practices

• Changes in applicable laws

• New features or services

• Feedback from users

11.1 Notice of Changes

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy

• Notify you via push notification or email

• Post a notice in the app

11.2 Your Acceptance

Continued use of the app after changes are posted constitutes your acceptance of the updated Privacy Policy.

11.3 Material Changes

For significant changes affecting your rights, we will:

• Provide at least 30 days' notice

• Require explicit consent before the changes take effect

• Provide clear information about what has changed

12. Third-Party Links

The app may contain links to third-party websites or services, including:

• Square payment pages

• Social media platforms

• Partner websites

We are not responsible for the privacy practices of these third parties. Their data collection and use are governed by their own privacy policies. We encourage you to review the privacy policies of any third-party sites you visit.

13. Do Not Track Signals

Some web browsers have a "Do Not Track" feature. Our app does not currently respond to Do Not Track signals because there is no industry standard for how to respond to such signals.

14. Data Breach Notification

In the unlikely event of a data breach that affects your personal information:

• We will notify you within 72 hours of discovering the breach

• Notification will be sent via email and/or push notification

• We will describe the nature of the breach and steps you should take

• We will report the breach to relevant authorities as required by law

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Wesco Industries - The Bakeshop
Email: thebakeshop@wescoind.org
Phone: (712-263-5552)
Address: 1003 4th Ave S, Denison, IA 51442, United States

Response Time: We will respond to privacy inquiries within 30 days.

16. Dispute Resolution

Privacy-related disputes are subject to the dispute resolution procedures outlined in our Terms of Service, including:

• Informal resolution attempts

• Jurisdiction in Crawford County, Iowa

• Governing law: Iowa state law

17. Accessibility

We are committed to making our privacy practices accessible to everyone. If you need this Privacy Policy in an alternative format or have accessibility concerns, please contact us at thebakeshop@wescoind.org.

18. Your Consent

By using the Bakeshop app, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and sharing of your information as described herein.

If you are under 18, you represent that you have obtained parental or guardian consent to use this app and agree to these privacy practices.

Summary of Key Points

To help you understand our privacy practices quickly, here's a summary:

✅ What We Collect: Name, email, phone number, orders, payment info, device data, birthday, location (optional)
✅ Why We Collect It: Order processing, account management, app improvement, loyalty rewards
✅ Who We Share With: Square (payments/loyalty), AWS (hosting), Firebase (notifications) - We do not sell your data
✅ Your Rights: Access, correct, delete your data; control notifications and location; opt out of marketing
✅ Security: Encrypted transmission and storage, PCI-compliant payment processing
✅ Retention: Indefinitely for active accounts, synced with Square's systems
✅ Children: Age 13+ with parental permission for minors
✅ Contact: thebakeshop@wescoind.org for questions or requests

Last Updated: 10/28/2025
Version: 1.0

Thank you for trusting The Bakeshop with your information. We are committed to protecting your privacy while providing you with the best possible bakery ordering experience.

​