Privacy policy

LUMAN, LLC, a Florida limited liability company doing business as LeafLine Landscapes is the business responsible for the personal information described here. We are a plant retailer selling to addresses in Florida.

This policy covers the site and our order, delivery and support operations. It does not cover a third-party site you reach from a link here, or a partner nursery's own handling of information you give it directly.

Information you give us:

• Email address. Required for every order — it is how we send your confirmation, your delivery date and anything to do with the guarantee. It is also the key that attaches a guest order to an account you create later.
• Delivery details: full name, street address, city, state, ZIP code and phone number, plus any note you leave for the driver.
• Order contents and totals, any promotional code used, and whether you added the planting service.
• Account information, if you create one: email address, and optionally a name, phone number and saved addresses.
• Wishlist items and back-in-stock notification requests.
• Trade account applications: contact name, business name and phone number.
• Mailing list signups: your email address, and which part of the site you signed up from.
• Whatever you write to us in a support email, a review or a form.

Information collected automatically. Our hosting provider records ordinary server request logs — IP address, browser and device type, the pages requested, timestamps, and the referring page — for security, abuse prevention and diagnosing faults. We do not build profiles from them.

Information from others. Our payment processor tells us whether a payment succeeded, and returns a payment reference, the card brand and the last four digits. Our email provider tells us whether a message was delivered, bounced or was marked as spam.

WE DO NOT COLLECT YOUR FULL CARD NUMBER, SECURITY CODE OR BANK ACCOUNT DETAILS — THOSE GO STRAIGHT TO STRIPE AND NEVER REACH OUR SERVERS. WE DO NOT COLLECT SOCIAL SECURITY OR GOVERNMENT ID NUMBERS, PRECISE GEOLOCATION, BIOMETRIC DATA, HEALTH DATA, RACE, RELIGION, SEXUAL ORIENTATION, UNION MEMBERSHIP OR ANY OTHER SENSITIVE CATEGORY OF PERSONAL INFORMATION. WE DO NOT ASK FOR THEM, AND YOU SHOULD NOT SEND THEM TO US.

We use personal information only for the purposes below, and we do not use it for a materially different purpose without telling you first:

• Taking, confirming and fulfilling your order, and taking payment for it.
• Buying your plants from the nursery that holds them, and arranging delivery.
• Contacting you about a delivery date and window, and letting the driver reach you on the day.
• Handling guarantee claims, refunds, replacements and support requests.
• Operating an account for you, including attaching your past guest orders to it when you sign in.
• Reviewing and administering trade accounts, and calculating a trade tier from your rolling purchase volume.
• Preventing and investigating fraud, payment abuse, and misuse of the site or of promotions.
• Keeping the site working, secure and diagnosable.
• Meeting our tax, accounting, consumer protection and other legal obligations.
• Sending marketing email — but only if you asked for it.

Strictly necessary cookies. These are the only cookies this site sets, and it does not work without them:

• A session cookie that keeps you signed in to your account, plus the short-lived security cookies that make the sign-in link work safely.
• A separate session cookie for staff signed in to the admin area. It is never set for customers.

Stored on your device, not sent to us as a cookie. Your cart contents and the delivery ZIP code you entered are kept in your browser's local storage so they survive a reload. They stay on your device. Clearing your browsing data for this site removes them.

There are no advertising, analytics, personalization or social media cookies on this site — so there is no consent banner to click through, and no tracking to turn off.

Because we neither sell nor share personal information for advertising, a Global Privacy Control or Do Not Track signal from your browser has nothing to act on here. We honor such signals to the extent they apply to us.

We do not sell personal information, and we do not rent, trade or hand it to anyone for their own marketing. We share the minimum necessary with the following, each of which is bound to use it only to provide its service to us:

• Stripe — payment processing and fraud screening. Your card details go directly to Stripe and are governed by Stripe's own privacy policy.
• Resend — sending sign-in links, order confirmations, delivery notices and marketing email.
• Vercel — hosting, content delivery, image storage and server logs.
• Our managed Postgres provider — the database holding accounts, orders and catalog data.
• Partner nurseries, our drivers and delivery contractors — the recipient name, delivery address, phone number and order contents needed to grow, pick and deliver your order, and nothing more.

We also disclose personal information where we are legally required to, or where it is reasonably necessary to: comply with a law, subpoena, warrant or court order; enforce our terms; investigate suspected fraud or abuse; or protect the rights, property or safety of our customers, our staff or the public.

If the business is sold, merged, reorganized or transfers substantially all of its assets, customer information may transfer as part of that transaction. We will post notice on this page before your information becomes subject to a materially different policy.

• Order records, including the delivery address snapshotted onto the order: kept while the guarantee runs, and afterwards for as long as tax, accounting and limitation periods require — at least three years, and longer where an audit, dispute or claim is open.
• Account information: kept while your account is open. Ask us to close it and we delete or anonymize what we are not required to keep.
• Mailing list: until you unsubscribe, after which we keep only a suppression record so we do not email you again by mistake.
• Back-in-stock requests: until we notify you, or twelve months, whichever comes first.
• Support correspondence: up to three years.
• Server logs: retained by our hosting provider on a short rolling window, for security and diagnostics.

Some of these you can do yourself, immediately:

• Marketing email: use the unsubscribe link in any marketing message, or write to us.
• Delivery texts: reply STOP. Note that this removes the way the driver reaches you on the day.
• Account details and saved addresses: view and change them on your account page.
• Cart and saved ZIP code: clear your browser's data for this site.

Whoever you are and wherever you live, we will honor a request to access the personal information we hold about you, correct it, delete it, or receive a portable copy of it. We do not require you to be a resident of any particular state to ask.

There are limits. We may keep information we need to complete an order you have placed, honor the guarantee, detect and prevent fraud, resolve a dispute, or comply with a legal obligation such as retaining tax records. Where we cannot delete something, we will tell you which of these applies.

California residents. Under the CCPA as amended by the CPRA you have the right to know what we collect and why, to access it, to correct it, to delete it, to a portable copy, to opt out of sale or of sharing for cross-context behavioral advertising, and to limit the use of sensitive personal information. We do not sell or share personal information, and we do not collect sensitive personal information, so there is nothing to opt out of or to limit — but the other rights apply and we will honor them. We will not discriminate against you for exercising any of them: no different pricing, no degraded service, no refused orders. An authorized agent may make a request for you, with written proof of authorization.

Florida residents. The Florida Digital Bill of Rights applies to controllers above a revenue threshold we are well below, so it does not impose obligations on us. We honor access, correction, deletion and portability requests from Florida residents regardless.

How to make a request. Write to us using the details at the end of this policy, saying what you want. We will verify that the request is really yours — usually by confirming control of the email address on the account or the order, and we may ask for details of a recent order. We will not create an account, or ask for extra identification, just to process a request. We respond within 45 days; where a request is complex we may take one further 45 days, and will tell you why. If we refuse a request in whole or part, we will explain why, and you may appeal by replying to that response. We will decide the appeal within 45 days and, if we still refuse, tell you how to complain to the Florida Attorney General.

Traffic to and from this site is encrypted in transit. The database sits behind access controls and is not reachable from the public internet. Card details never touch our servers. Sign-in is by one-time email link rather than a password, so there is no password of yours for us to store or for an attacker to steal.

No system is perfectly secure, and we cannot guarantee absolute security. Protect the email account your sign-in links go to, since access to it is access to your orders. If you believe your account or your order has been compromised, tell us immediately.

This site is meant for adults and is not directed to children. We do not knowingly collect personal information from anyone under 13, and ordering requires you to be 18 or over. If you believe a child has given us personal information, write to us and we will delete it.

We may update this policy. The effective date at the top changes when we do, and we will describe any material change on this page. Continuing to use the site after a change means you accept the updated policy.

Questions about this policy, and requests to access, correct, delete or export your information, go to: