Privacy Policy
WeBonsai ("we", "us" or "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect through webonsai.com (the "Site"), why we collect it, how we use and protect it, and the rights you have. WeBonsai is based in Catanzaro, Italy, and is the data controller for the personal data described here.
1. Information we collect
- Order and contact details that you provide when you place an order, contact us or subscribe to our newsletter: your name, email address, shipping and billing address, and phone number.
- Payment information. Card payments are processed securely by our payment provider, Stripe. We do not receive or store your full card details.
- Usage data. With your consent, we collect anonymised information about how the Site is used through analytics cookies, described in the Cookies and analytics section below.
2. How we use your information
- To process, fulfil and deliver your orders and to provide customer support.
- To communicate with you about your orders and, where you have opted in, to send occasional updates. You can unsubscribe at any time.
- To operate, secure and improve the Site.
- To meet our legal, accounting and tax obligations.
3. Legal bases
We process your data to perform our contract with you when you order, to comply with legal obligations such as invoicing and tax, and on the basis of your consent (newsletter and analytics) or our legitimate interest in running and improving the Site.
4. Sharing your information
We share your data only with the providers who help us run the business: our payment processor (Stripe), the shipping carriers who deliver your order, our hosting provider, and our analytics provider (Microsoft Clarity, and only if you accept analytics cookies). We never sell your personal data. Where a provider processes data outside the EU, appropriate safeguards are in place.
5. Data retention
We keep your personal data only for as long as necessary to fulfil your order and to meet our legal and tax obligations, after which it is deleted or anonymised.
6. Your rights
Under the GDPR you have the right to access, correct, delete or restrict the processing of your personal data, to object to processing, and to data portability. Where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, contact us at rob@webonsai.com. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
7. Cookies
Details of the cookies and analytics we use, and how to accept or decline them, are set out in the Cookies and analytics section below.
8. Contact
WeBonsai
Catanzaro, Italy
rob@webonsai.com
+393476327800
Cookies, analytics and advertising
Analytics
We use Microsoft Clarity and Google Analytics to see how visitors use this website. Clarity collects usage data through cookies and similar technologies and may record your session (pages viewed, clicks, scrolling and mouse movement) in pseudonymised form. Google Analytics collects aggregate statistics about visits and traffic. We use this only to find problems and improve the site.
Advertising
We also use the Meta Pixel and the Google Ads tag. They record visits to our pages and things you do here: viewing a product, adding it to the cart, starting checkout, completing a purchase, and using our Pot Matcher (uploading a photo, seeing a preview, clicking a pot). The photo itself and your tree's measurements are never sent. This tells us which of our ads lead to visits and orders, and lets us show our ads to people who might be interested.
Our server also sends the same events straight to Meta (the Conversions API), so they are counted reliably. For a completed order this includes your email address, country and postcode in hashed form, meaning scrambled so they can't be turned back into the original. Meta uses them to match the order to an ad you saw. If you came to us through an ad, we also remember which one for the rest of your visit and store it with your order.
Your choice
All of this happens only if you accept in our cookie banner. If you decline, Clarity, Google Analytics, the Meta Pixel and Google Ads are not loaded at all, no analytics or advertising cookies are set, and our server sends nothing to Meta. You can change or withdraw your choice at any time via "Cookie settings" in the footer. The legal basis is your consent (Art. 6(1)(a) GDPR and the ePrivacy rules of your country).
Declining doesn't affect the storage the site needs to work, such as the contents of your cart.
Who receives the data
Microsoft processes the Clarity data, and Google processes the Google Analytics and Google Ads data, each as a separate controller. For the Meta Pixel and the Conversions API, we and Meta Platforms Ireland Ltd. are joint controllers for collecting the data and passing it to Meta. What Meta does with it afterwards is Meta's sole responsibility. Microsoft, Google and Meta may transfer data to the United States under the EU-US Data Privacy Framework. We never sell your data. For details, see the privacy policies of Microsoft, Google and Meta.
Cookies and storage we use
| Name | Provider | Purpose | Consent needed | Lifetime |
|---|---|---|---|---|
wb_consent | WeBonsai | Remembers your cookie choice | No (essential) | 1 year |
wb_cart_v1 | WeBonsai | Keeps your cart (local storage) | No (essential) | Until cleared |
wb_attribution | WeBonsai | Which ad you came from, for your order (session storage) | Yes | Until you close the tab |
_clck | Microsoft Clarity | Recognises your browser across visits | Yes | 1 year |
_clsk | Microsoft Clarity | Links page views into one session | Yes | 1 day |
_ga | Google Analytics | Tells visitors apart for statistics | Yes | 2 years |
_ga_* | Google Analytics | Keeps session state for statistics | Yes | 2 years |
_gcl_au | Google Ads | Measures which Google ads lead to visits and orders | Yes | 90 days |
_fbp | Meta | Recognises your browser so Meta can measure and show ads | Yes | 90 days |
_fbc | Meta | Stores the ID of the Facebook or Instagram ad you clicked | Yes | 90 days |