Privacy notice

Website delivery

Our websites are hosted by Vercel. Delivering and securing a page involves technical request data, including your IP address, browser information, requested URL and time of access. Cloudflare provides domain and DNS services. Service providers may process data in Switzerland, the EEA, the United States or other countries. Their privacy information describes their processing and transfer safeguards.

Optional Google Analytics

We use Google Analytics 4 only after you choose “Allow analytics”. You can use the website without accepting. Before acceptance, our integration does not load Google’s tag or send analytics requests. Analytics helps us understand visits and improve the websites.

When allowed, Google receives page-view and technical browser/device information, cookie identifiers and your IP address as part of the connection. Query strings and fragments are removed from page locations; only the referring website’s origin is sent. We do not send names, email addresses or user IDs. Advertising personalization, Google Signals and enhanced measurement are disabled in our configuration. Google may process information internationally, including in the United States.

Your choice and storage

Your analytics choice is stored locally in your browser for 180 days and applies separately on each website. If you agree, first-party _ga cookies identify a browser and session; the configured cookie lifetime is 180 days without automatic renewal. Deleting browser storage resets the choice. Use “Analytics preferences” in the homepage footer to withdraw. Withdrawal stops future measurement, clears this site’s analytics cookies and reloads the page. It does not automatically erase information already processed by Google.

The page URL determines the language. Using the language switch does not create an additional language cookie or tracking identifier.

Videos and external links

Bakery videos are loaded from YouTube only when you choose to play one. Loading the player shares technical connection information with Google/YouTube and is separate from your analytics choice. Video thumbnails and illustration assets are served locally. Links to YouTube, Pinterest, TikTok and X take you to their services and privacy notices. Motion preferences may be stored locally to remember your choice.

Contact form and spam prevention

The central MILMERE contact form uses your name, email address, selected project, contact reason and message to respond to your enquiry. When sending is available, messages are transmitted through Resend to hello@milmere.com. No attachments or automatic reply emails are used. Form contents are not sent to Google Analytics; the contact page does not load analytics.

When the protected form is available, Cloudflare Turnstile checks browser and technical connection signals to prevent automated abuse. Server-side validation and single-use tokens help reject invalid or repeated submissions. Security checks do not depend on analytics consent. If these services are unavailable, sending is blocked; you can still email us directly. Resend and Cloudflare may process information internationally. The general contact form does not keep a separate message database; correspondence is handled in our email systems.

Facepainting contact confirmation

Facepainting information is available separately from the online enquiry function. When that function is unavailable, no enquiry is sent and no verification code is requested. It is not enabled by choosing another language.

An adult confirms their email address with a code before submitting a facepainting enquiry. A second contact detail is not automatically verified. SMS confirmation is currently disabled. This process does not reserve an appointment. No individual child names, dates of birth, health information or photos are requested.

When you request a code, Vercel processes the contact details and Resend sends the confirmation email. Cloudflare Turnstile processes browser and connection signals to prevent abuse. The complete enquiry is sent through Resend to hello@milmere.com only when you explicitly submit it after confirmation. These providers may process information internationally; their privacy information is linked below.

The Neon database stores pseudonymous verification values, expiry times, attempt and request counters, confirmation state and delivery identifiers. Our verification tables do not store names, readable contact details, IP addresses, readable codes or enquiry text. A necessary secure session cookie links the confirmation to your browser and expires after 40 minutes. Codes are valid for 10 minutes; confirmation permits submission for 30 minutes.

Expired verification records become eligible for deletion 24 hours after expiry. The application removes eligible records when a new code is requested; a daily cleanup is also planned for public operation. Expired request limits and old cooldown entries are removed during cleanup. Email correspondence and provider delivery logs are separate from this database cleanup; correspondence is retained as described under Email and your rights.

Email and your rights

If you email us, we use your information to handle the enquiry and retain it as needed for that purpose and applicable obligations. Depending on applicable law, you may request access, correction, deletion or restriction of personal information, object to processing, withdraw consent or complain to a competent data-protection authority. Contact hello@milmere.com. Please do not include sensitive information unnecessarily.

Service-provider privacy information

Vercel Cloudflare How Google uses data Google privacy Cloudflare Turnstile privacy Resend privacy Neon