Privacy policy.

Last updated: September 29, 2026

This Privacy Policy explains how Understory Plant LLC ("Understory Plant Co.", "we", "us" or "our") collects, uses, shares and protects personal information when you visit understoryplant.shop (the "Site"), place an order, sign up for our emails or contact us. By using the Site you agree to the practices described in this policy.

1. Who we are

Understory Plant LLC is a Florida limited liability company that grows and sells houseplants, planters and plant care supplies. Our business address is 1812 SW 23rd St #B, Fort Lauderdale, FL 33315, United States. We are responsible for the personal information described in this policy. You can reach us at hello@understoryplant.shop or (561) 865-8956.

2. Information we collect

Information you give us

• Order information: your name, email address, phone number, shipping address, billing address and the products you buy.
• Payment information: card details are entered into and processed by our payment processor, Stripe. We receive only limited payment details from Stripe, such as the card brand, the last four digits, the expiration month and year, the billing ZIP code and whether the payment succeeded. We never receive or store your full card number or security code.
• Communications: messages you send us by email, phone or our contact form, including photos you send for a guarantee claim.
• Email preferences: your email address if you sign up for our newsletter.

Information collected automatically

• Device and usage data: IP address, browser type, device type, pages viewed, referring page and the date and time of your visit, recorded in our hosting provider's standard server logs.
• Bag contents: the items in your bag are stored in your own browser's local storage so they are still there when you come back. This data stays on your device until you check out or clear it.
• Fraud-prevention signals: Stripe may collect device, network and browsing information on checkout pages to detect and prevent fraud, as described in section 4.

Information from others

We receive information from shipping carriers (delivery status and address corrections) and from Stripe (payment outcome and fraud risk assessments).

3. How we use information

• To process, pack, ship and deliver your order, including sending order confirmations, shipping notices and weather-hold notices for live plants.
• To process payments, issue refunds and prevent fraudulent transactions.
• To handle Arrive-Alive guarantee claims, returns and customer service requests.
• To send marketing emails if you have opted in (you can unsubscribe at any time).
• To operate, secure, troubleshoot and improve the Site.
• To meet our legal obligations, including tax, accounting and record-keeping requirements, and to enforce our Terms of Sale.

We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

4. Payments and Stripe

We use Stripe, Inc. ("Stripe") to process card and wallet payments, including Apple Pay. When you pay, your card number, expiration date and security code are sent directly to Stripe over an encrypted (TLS) connection and never pass through or get stored on our servers. Stripe is certified as a PCI DSS Level 1 Service Provider, the highest level of certification in the payments industry.

Stripe uses the payment information it collects to process your transaction and, as an independent controller, for purposes such as fraud prevention, compliance with financial regulations and improving its services. To help detect fraud, Stripe may collect information about the device and browser you use during checkout. Stripe's handling of personal information is described in the Stripe Privacy Policy, and more about its fraud-prevention data use is available at stripe.com/legal/privacy-center.

We keep a record of each transaction (amount, date, items purchased, card brand and last four digits, and the Stripe payment ID) so we can issue refunds, answer billing questions and meet our tax and accounting obligations.

5. How we share information

We share personal information only with the service providers we need to run the store, and only as much as each of them needs:

• Payment processing: Stripe, as described in section 4.
• Shipping: UPS, FedEx and the US Postal Service receive your name, shipping address and phone number to deliver your order.
• Email: our email service provider receives your email address to send order and, if you opted in, marketing emails.
• Hosting and IT: the company that hosts the Site processes server logs on our behalf.
• Legal and safety: we may disclose information if required by law, subpoena or court order, or to protect the rights, property or safety of Understory Plant Co., our customers or others.
• Business transfers: if Understory Plant Co. is sold or merged, customer information may transfer to the new owner, who will remain bound by this policy.

Our service providers may use your information only to perform services for us and are required to protect it.

6. Cookies and similar technologies

The Site uses only technologies that are needed for it to work: browser local storage to remember your bag, and session storage to show your order confirmation. Stripe sets cookies on the checkout page to process payments securely and prevent fraud. We do not use advertising cookies, third-party tracking pixels or cross-site tracking. You can clear local storage and cookies in your browser settings at any time; doing so empties your bag. Because we do not track you across sites, we treat Global Privacy Control signals as a request to opt out of any future sale or sharing and honor them automatically.

7. How long we keep information

• Order and transaction records: seven years, to meet tax and accounting requirements.
• Customer service messages and guarantee photos: two years after the issue is resolved.
• Newsletter email address: until you unsubscribe, plus a suppression record so we don't email you again.
• Server logs: up to 90 days.

8. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and receive a copy of it;
• correct inaccurate personal information;
• delete personal information we hold about you, subject to legal exceptions such as records we must keep for tax purposes;
• opt out of the sale or sharing of personal information and of targeted advertising (we do neither); and
• appeal a decision we make about your request.

To make a request, email hello@understoryplant.shop or call (561) 865-8956. We will verify your request by matching the email address and a recent order detail, and respond within 45 days. You may use an authorized agent; we may ask the agent for proof of your permission. We will not discriminate against you for exercising any of these rights. If we deny your request, you may appeal by replying to our decision; if you are not satisfied with the outcome of the appeal, you may contact your state attorney general.

9. California residents

Under the California Consumer Privacy Act, as amended by the CPRA, California residents have the rights described in section 8. In the preceding 12 months we collected the following categories of personal information:

• Identifiers (name, email, postal address, phone number, IP address);
• Customer records (billing and shipping details, limited payment card information as described in section 4);
• Commercial information (products purchased, order history); and
• Internet activity (server log data).

• Sources: you, your device, Stripe and shipping carriers.
• Purposes: those listed in section 3.
• Disclosed for business purposes to: the service providers listed in section 5.
• Sold or shared: none. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing information of consumers under 16.
• Sensitive personal information: we do not collect or use sensitive personal information to infer characteristics about you.

10. Residents of other US states

Residents of Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia and other states with consumer privacy laws may exercise the rights in section 8 to the extent their state law provides them. Nevada residents may submit a request not to sell covered information, although we do not sell it.

11. Marketing emails

We send marketing emails only if you sign up. Every email includes an unsubscribe link, and you can also email us to opt out. Order confirmations, shipping notices and guarantee correspondence are transactional and are sent even if you unsubscribe from marketing.

12. Security

The Site is served only over HTTPS. Card data is handled by Stripe and never touches our servers. Access to order information is limited to the staff who need it to fulfill orders and help customers, and is protected by unique passwords and two-factor authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach affecting your information, we will notify you as required by law.

13. Children

The Site is intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

14. Visitors outside the United States

We ship only within the United States, and the Site is operated from the United States. If you visit from another country, your information will be processed in the United States, where data protection laws may differ from those in your country.

15. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top, and if the changes are significant we will let customers know by email or with a notice on the Site before they take effect.

16. Contact us

Understory Plant LLC
1812 SW 23rd St #B, Fort Lauderdale, FL 33315
Email: hello@understoryplant.shop
Phone: (561) 865-8956 (Monday to Friday, 9 am to 5 pm Eastern)