Privacy Notice

Who is responsible

The person or company responsible for this website (the data controller) is Theodora Chatila. You can get in touch at hello@empressflower.com.

Mailing list signups

When you join the mailing list we store the email address you type in, the date and time you agreed, the exact wording you agreed to, and which page you signed up from. We use this only to send occasional updates about Empress Flower.

Email delivery provider: MailerLite.
Legal basis: Consent.
How long it is kept: Until the subscriber withdraws consent or the mailing list is discontinued; retain only the minimum suppression record needed to respect unsubscribes.
Unsubscribing: every email includes an unsubscribe link, and you can also ask us to remove you at hello@empressflower.com.

Community board comments

If you post on the community board we store your chosen nickname, your comment, the date, and the number of likes it receives. Comments are reviewed automatically before they appear. Please do not include real names, contact details or links.

Visitor ID. Your browser is given a random identifier which is saved in your browser's local storage under ef-visitor-id. It contains no personal details. It lets us count your likes once, remember your nickname (ef-username), apply rate limits, and stop repeated attempts to post unsuitable content.
Moderation records. When a comment is refused we keep the refused text, the reason and the visitor ID, so that repeated attempts can be blocked. These records are kept for 12 months.

Hosting and other providers

Website hosting: Lovable.
Database and authentication: Lovable Cloud, which uses Supabase’s open-source infrastructure for database, storage, authentication and server functions. The public website does not currently provide user accounts.
Comment moderation service: Comment text is processed server-side through Lovable’s AI service using Google’s Gemini 3.6 Flash model. This is used only to determine whether a comment is suitable for publication. Lovable retains limited technical information about each request for operational purposes. Full request and response storage is disabled. Lovable’s AI debugging feature is enabled to help identify problems with the comment-moderation system. Lovable may retain the full comment text sent for moderation and the AI model’s response for up to 90 days. These records may be accessed by the site operator and Lovable’s project agent for debugging and improving the moderation process. Lovable automatically removes stored secrets from these records. The records are not used for marketing.
Analytics: Lovable Project Analytics. It measures aggregate information such as visitors, page views, visit duration, referral source, device type and approximate country. Lovable states that it does not create individual visitor profiles or follow visitors across separate visits.
International transfers: Some service providers may process information outside the United Kingdom. Where this occurs, transfers are protected using an applicable UK adequacy regulation or approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Lovable confirms that its built-in analytics is aggregate and does not profile visitors across visits.

Children

The website and community features are intended for adults, including parents and carers. Children may view the site with adult supervision, but should not submit information.

Your rights

You can ask for a copy of your information, ask us to correct it, or ask us to delete it. Write to hello@empressflower.com. You can also complain to your local data protection authority.

Changes

If this notice changes we will update this page. Last reviewed: September 2026.