Skip to main content
Legal Disclosure

Privacy Policy

Last Updated: June 19, 2026

At Astroforma, we respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy describes how we collect, use, and safeguard your information when you visit our website, register a collector account, or purchase specimens.

1. Privacy by Design & Data Minimization

Pseudonymous Analytics Commitment

We believe in protecting your online identity. We configure our third-party analytics integrations using a privacy-by-design approach. We do not transmit your real name or email address to our visitor analytics database (PostHog). Logged-in users are identified strictly by their database reference keys (alphanumeric IDs), and guest checkout email addresses are cryptographically hashed using SHA-256 before being registered in analytics.

2. Information We Collect

Depending on how you interact with Astroforma, we may collect two types of information:

A. Information You Provide Directly

  • Account Details: Name, email address, and passwords when you register as a collector.
  • Order Details: Shipping address, phone number, and transaction context when purchasing a specimen.
  • Waitlist Subscriptions: Your email address if you request to be notified when out-of-stock items return.

B. Automatically Collected Data

When you browse our storefront, we collect anonymous usage data to verify checkout performance and identify which cultivars command the highest collector demand. This includes:

  • Pages and plants viewed, wishlist interactions, and cart additions.
  • Pseudonymous traits such as collector level, user role (e.g. customer vs. admin), and browser parameters (screen size, device type).
  • Network parameters (such as country location derived from IP addresses).

3. Cookies and Local Storage

We use cookies and local storage to run our storefront securely. These cookies fall into two categories:

  • Strictly Necessary: Used for NextAuth login session tokens, CSRF protection, and storing temporary cart reservation holds. These are essential for the site to function and cannot be disabled.
  • Analytics & Replay: Set by PostHog to remember session behaviors, click pathways, and prevent duplicated metrics. You can clear or reject these cookies at any time via your browser settings.

4. Sharing with Third Parties

We do not sell, rent, or trade your personal data. We share information only with trusted service providers to run our operations:

  • PayPal: Processes secure transaction payments. We do not store or capture credit card numbers on our servers.
  • PostHog: Processes pseudonymous site usage metrics and UI interaction flows to help us improve user experience.
  • Cloudinary: Serves dynamic, high-resolution specimen photography.

5. Your Privacy Rights

Depending on your location (such as the EU or California), you have rights regarding your personal data under the GDPR or CPRA:

  • Access & Correction: The right to view or correct the personal data we hold about you.
  • Deletion: The right to request that we delete your account and personal details (subject to legal billing retention requirements).
  • Opt-Out: The right to clear analytics cookies or adjust browser tracking preferences.

To exercise any of these rights, please contact us using the details below.

6. Contact Information

If you have any questions about this Privacy Policy or how we handle your information, please contact us at:

Astroforma Cactus Co.
Email: support@astroforma.com