Privacy Policy

What Cedar & Breath collects, why, who else can see it, and what you can tell us to do about it. Written in plain language because a privacy policy nobody can read is not a disclosure.

Last updated October 27, 2026.

Who we are

Cedar & Breath operates the website at cedarandbreath.info. We are a small independent business in the United States, and this site is intended for adults in the United States. Our postal address, email address and telephone number are at the bottom of this page and on the contact page.

The short version

We collect your email address if you give it to us, and ordinary technical information that any web server records.
We do not sell your personal information for money.
Third-party advertising on this site may involve sharing identifiers with Google for advertising purposes, which some state laws classify as "sharing" or as a "sale". You can opt out, and we honour the Global Privacy Control signal automatically.
You can ask us what we hold, ask us to correct it, and ask us to delete it. We will do it.

What we collect

Information you type in. Your name, email address and anything you write in the message field when you use the contact form. If you give a telephone number, we keep that too. If you sign up for our email list, we keep the address and the date you signed up, which is our record that you asked.
Order information. If you buy something, we keep the email address you gave for delivery, what you bought, when, and the amount. We never see or store your card number. Payment is taken on the payment provider's own page and all we receive back is a confirmation that it succeeded and a reference number.
Technical information. Our web host records standard server log data for every visit: the IP address, the time, the page requested, the referring page and the browser's user-agent string. This is ordinary and happens on essentially every website. We use it to keep the site working and to spot abuse.
Your cookie choice. Stored in your own browser, not on our server. See the Cookie Policy.

We do not ask for and do not want your date of birth, your physical address beyond what a payment provider needs, your government identification numbers, or any information about your health.

Why we collect it

Each of these has one purpose and we do not reuse it for another:

To answer you when you write to us.
To deliver what you bought and to fix it if delivery fails.
To send the email list you signed up for, and nothing else.
To keep the site running, secure and free of abuse.
To meet our legal and accounting obligations, which is why order records are kept longer than anything else.

Advertising, and how Google is involved

This site carries third-party display advertising. When advertising is active, Google and its partners may use cookies or similar technologies to serve ads and to measure them, and may use information about your visits to this and other sites to show you ads.

Google's own description of this is published at How Google uses information from sites or apps that use our services, and we encourage you to read it, because it is more complete about Google's processing than we can be.

You can turn off personalized advertising from Google at Google Ad Settings, and you can opt out of personalized advertising from many other companies at optout.aboutads.info and optout.networkadvertising.org. Turning personalization off does not remove advertising; it makes the advertising you see less specific to you.

We do not run our own analytics, we do not use social media tracking pixels, and we do not operate any advertising pixel of our own.

Who else sees your information

A short list, and it is the whole list:

Our web host, which stores the site and its server logs.
Our email provider, which carries messages to and from us and sends the email list.
Our payment provider, which processes payments on its own pages under its own privacy policy.
Google and its advertising partners, as described above, when advertising is active.
Anyone we are legally required to disclose to, such as in response to a valid legal process.

We do not sell your personal information for money to anybody. We do not rent or trade email lists. If the business were ever sold or merged, personal information could transfer as part of it, and we would say so here before it happened.

How long we keep things

Contact form messages: 24 months, then deleted.
Email list: until you unsubscribe, plus 30 days.
Order records: 7 years, because tax rules require it.
Server logs: 90 days.
Your cookie choice: 12 months in your browser, or until you clear it.

Your rights

Depending on where you live in the United States, you may have some or all of the following rights. We extend all of them to every US visitor, because maintaining different rules per state would be more work than simply honouring the strongest version for everyone.

To know what categories of personal information we have collected, where it came from, why we collected it, and who we disclosed it to.
To access the specific pieces of personal information we hold about you.
To correct anything inaccurate.
To delete what we hold, except where we are legally required to keep it, such as order records for tax.
To data portability, which means receiving it in a readable format.
To opt out of targeted advertising and of the sale or sharing of your personal information.
To limit the use of sensitive personal information. We do not collect any, so there is nothing to limit.
Not to be discriminated against for exercising any of these rights. We will not charge you more, give you less, or refuse to serve you.
To appeal if we refuse a request. Reply to our refusal and a different person will review it and respond within 45 days.

To make a request, email classes@cedarandbreath.info with "Privacy request" in the subject line, or use the contact form. We respond within 45 calendar days and may extend by a further 45 days where the law allows, in which case we will tell you why before the first period runs out. You do not need an account, because there are no accounts.

We verify requests by replying to the email address the information is associated with. If you are making a request on someone else's behalf, tell us that in the message and we will ask for written authorization.

Global Privacy Control

We honour the Global Privacy Control signal. If your browser or a browser extension sends Sec-GPC: 1, or exposes navigator.globalPrivacyControl as true, we treat that as a valid opt-out of sale and sharing, record the opt-out immediately and do not show you the cookie banner at all. We publish a machine-readable statement of this at /.well-known/gpc.json. There is more at Your Privacy Choices.

Children

This site is intended for adults in the United States. It is not directed to children under 13, we do not knowingly collect personal information from children under 13, and nothing on the site is designed to appeal to them. If you believe a child under 13 has given us personal information, write to classes@cedarandbreath.info and we will delete it promptly and confirm to you that it is gone.

Security

The site is served over HTTPS. Access to the mailbox and the order records is limited to the people who run the business and is protected by multi-factor authentication. We keep as little as possible, which is the only security measure that cannot fail. No method of transmission or storage is completely secure, and we do not claim otherwise.

Changes to this policy

If we change this policy we update the date at the top. If a change materially affects how we handle personal information already collected, we will say so prominently on the site for at least 30 days, and where we have your email address and the change is significant, we will email you.

How to reach us

Questions about this policy, or a request you would like us to act on:

Cedar & Breath
17 Pearl Street, Suite 2B
Burlington, VT 05401
United States
Email: classes@cedarandbreath.info
Telephone: (802) 555‑0156
Monday to Saturday, 8am to 6pm Eastern Time