Privacy Policy

Last updated: April 2026

1. Who We Are

CottageLaunch ("made.kitchen") operates a document preparation and website hosting service for cottage food sellers in Los Angeles County, California.

2. What We Collect

Data	Why	Shared with
Name, email, phone	Permit filing, account access, notifications	LA County (on application), Resend (email delivery)
Home address	Required on permit application	LA County, Lob (mailing service), buyer (only after seller confirms payment)
Business name, food products	Permit application, website	LA County, displayed publicly on seller's website
Food photos	Website menu	Cloudflare R2 (hosting), displayed publicly
Payment info	Service fee collection	Stripe (payment processor) — we never see full card numbers
Buyer name and email	Order processing	Seller (to fulfill order)
Page views, UTM data	Analytics, marketing attribution	Not shared externally

3. How We Use Your Data

• Permit filing: Your personal information is used to prepare and submit your LA County CFO registration application
• Website: Your business name, bio, photos, and menu are displayed publicly on your [name].made.kitchen site
• Address reveal: Your home address is sent to buyers ONLY after you manually confirm their Venmo payment — never automatically, never publicly
• Communications: We email you permit status updates, order notifications, and occasional service announcements
• AI processing: Your food photos are analyzed by Anthropic's Claude API for automatic labeling. Photo data is processed per Anthropic's data usage policy and is not used to train AI models.

4. What We Never Do

• Display your home address on your public website
• Sell your personal information to third parties
• Send marketing emails to buyers without their explicit opt-in
• Share buyer emails with anyone other than the seller they ordered from
• Use your data for purposes unrelated to the made.kitchen service

5. Data Retention

Data	Retention
Customer records, permit applications	Indefinitely (legal records, renewal reminders)
Orders	7 years (tax record recommendation)
Magic link tokens	Deleted 24 hours after use
Session cookies	30 days, then auto-deleted
Page view analytics	2 years
API usage logs	Indefinitely (cost tracking)

6. Your Rights (California Residents — CCPA)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information we collect and how it's used
• Delete your personal information (subject to legal retention requirements)
• Opt out of the sale of personal information — we do not sell your data
• Non-discrimination — exercising your rights will not affect your service

To exercise any of these rights, email hello@made.kitchen or text (310) 737-8224. We will respond within 45 days.

7. Cookies

We use functional cookies only:

• Session cookie: Keeps you logged into your dashboard for 30 days. HttpOnly, secure, not accessible to JavaScript.
• Analytics session: Anonymous session ID for page view tracking. No personal information.

We do not use advertising cookies, tracking pixels, or third-party analytics tools.

8. Third-Party Services

• Stripe: Payment processing. See Stripe's Privacy Policy.
• Resend: Email delivery. See Resend's Privacy Policy.
• Lob: Mail delivery for permit applications. See Lob's Privacy Policy.
• Anthropic Claude: AI image analysis and text generation. Processed per API terms, not used for training.
• Cloudflare R2: Image storage and CDN.

9. Security

We protect your data with: HTTPS encryption, secure httpOnly cookies, parameterized database queries, rate limiting on all public endpoints, and environment-variable storage for all API keys. Home addresses are never logged, displayed publicly, or included in API responses to buyers.

10. Changes

We may update this policy. Material changes will be communicated via email at least 30 days before taking effect.

11. Contact

Questions? Email hello@made.kitchen or text (310) 737-8224.