Privacy Policy

DolcePick is a marketplace connecting buyers with home-baked pastry, operated by Ollabot LLC, a US limited liability company (1209 Mountain Road Place Northeast, Albuquerque, NM 87505, United States), which acts as the data controller.

Personal data contact: contact@dolcepick.com

This policy applies to users residing in the European Union (General Data Protection Regulation — GDPR) as well as to other users.

• Account and sign-in: email address, display name (derived from the email), role (buyer or baker), creation date. Sign-in uses a one-time code sent by email — no password is stored.
• Baker profile (optional): bio, specialty, location, profile photo, links to your social networks or website, delivery zones, pickup points.
• Drops and products: photos, descriptions, prices, and quantities you publish as a baker.
• Orders: booked items, quantity, amount, promo code, chosen pickup point or address (+ phone number for delivery), order history and status, pickup QR code.
• Engagement: waitlist sign-ups, likes, baker follows, notifications, reviews, loyalty points.
• Payment: card data is collected and processed only by our payment provider Stripe (embedded payment) — it never passes through our servers. We only keep a reference to the transaction.

• Contract performance: to create and manage your account, book and pay for your orders, arrange pickup or delivery, pay out bakers' earnings (via Stripe Connect), and handle refunds.
• Legitimate interest: to secure the platform and fight fraud and fake accounts (temporary email addresses, bots), improve our services, and provide support.
• Consent: for optional information on your public profile, which you may remove at any time by editing it or deleting your account.
• Legal obligations: retention of transaction and identification data required by applicable regulations (including anti-money-laundering requirements on Stripe's side).

We send no commercial solicitations and never sell your data.

Your data is accessible only to the DolcePick team and to our technical sub-processors, who act solely on our instructions:

• Convex (United States): hosting of platform data and files (photos).
• Cloudflare (United States / global network): website hosting, protection and anti-bot (Turnstile).
• Stripe (United States / European Union): online payments and baker payout accounts (identity verification and bank details, managed by Stripe).
• Resend (United States): sending of transactional emails (sign-in code, order confirmation, notifications).

These providers may process data outside the European Union (mainly in the United States). These transfers are covered by the safeguards provided for by the GDPR (European Commission standard contractual clauses and additional security measures).

• Account and profile: for the lifetime of the account. You can delete it yourself at any time (at the bottom of "My Orders" or your baker space): deletion permanently erases the account and its associated data.
• Orders: kept for the duration of performance and for dispute and refund management, then deleted with the account.
• Sign-in codes: hashed and destroyed after use or expiry (10 minutes).
• On Stripe's side: payment and bank identification data is kept by Stripe according to its own legal obligations (fraud, anti-money-laundering) and cannot always be deleted on simple request.

DolcePick uses no advertising cookies and no third-party audience measurement tools. Only strictly necessary trackers are used to run the service: sign-in session, anti-bot security (Cloudflare Turnstile), and payment (Stripe). No consent is therefore required for their placement; on your first visit, an information banner confirms this. You can manage or block these trackers at any time from your browser settings.

Under the GDPR, you have the following rights:

• Access: to know what data we hold about you and obtain a copy.
• Rectification: to correct your information.
• Erasure: to delete your account and your data (available self-service in the app).
• Restriction and objection to the processing of your data.
• Portability: to receive your data in a readable format, on request.
• Consent withdrawal at any time, for processing based on it.

To exercise these rights, write to contact@dolcepick.com (we reply within one month; proof of identity may be requested). If you reside in the European Union, you may also lodge a complaint with the data protection authority of your country (in France: the CNIL, cnil.fr).

See also: Terms · Legal Notice

The website is served over HTTPS (TLS encryption), sign-in relies on one-time codes, and payment data is processed by Stripe, a PCI DSS certified provider. Access to data is limited to the people who need it to operate the service.

The service is reserved for adults (or persons able to enter into a contract). We do not knowingly collect children's data.

This policy may evolve (new services, regulatory changes). The online version always prevails; affected users will be informed of any significant change.