Privacy policy
Effective date: August 26, 2026
Last updated: August 26, 2026
1. Who we are
Baker Creek Heirloom Seed Co., LLC (“Baker Creek,” “we,” “us,” “our”) is a Missouri limited liability company at 2278 Baker Creek Road, Mansfield, Missouri 65704, United States.
This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to:
- rareseeds.com and any other site we operate
- our retail locations, including the Mansfield seed store and the Petaluma Seed Bank
- our printed catalog and mail-order business
- our email and text-message programs
- our customer service by phone, email, and chat
For the purposes of United States state privacy laws we are the “business” that determines how your information is used. For the purposes of the UK GDPR and the EEA/Norwegian GDPR we are the “controller.”
2. Information we collect
2.1 Information you give us
- Identity and contact information — name, email address, postal address, and phone number.
- Order information — the items you buy, quantities, shipping and billing addresses, gift messages, and any order notes you add.
- Payment information — card and payment details are collected and processed by our payment providers, not by us. We receive a payment token, the card brand, the last four digits, the billing address, and the authorization result. We never receive or store your full card number.
- Account information — your email address. Our accounts are passwordless: we email you a one-time code instead of asking you to create a password, so we do not hold a password for you.
- Catalog requests — the postal address you give us so we can mail you a catalog.
- Text message enrollment — your mobile number and a record of your consent, including when and how you gave it.
- Reviews and submissions — the name, email address, rating, written content, and any photographs you submit with a product review. Please note that our review provider’s own terms give them a broad and continuing licence to publish and reuse review content, which may outlast our use of their service. If you want a review taken down, write to us and we will remove it from our site and ask them to delete it.
- Correspondence — what you write or tell us when you contact customer service, including germination and growing questions.
2.2 Information we collect automatically
- Device and connection data — IP address, browser type, operating system, device type, screen size, and language settings.
- Usage data — the pages and varieties you view, search terms you enter, links you click, what you add to your cart, and the dates and times of those actions.
- Referral data — the site or advertisement that brought you to us.
- Approximate location — a country and region estimated from your IP address, used to show the right currency, shipping options, and cookie choices. We do not collect precise geolocation.
- Cookies and similar technologies — described in our Cookie Policy.
2.3 Information we receive from others
- Payment and fraud providers — authorization results, chargeback notices, and fraud risk signals.
- Shipping carriers — tracking and delivery status.
- Advertising and analytics partners — aggregated campaign performance and, where you have consented, information used to measure advertising.
- Social sign-in — if you choose to sign in using Facebook, we receive the basic profile information you permit. You can ask us to delete information obtained this way at this page.
- Our previous store platform — we recently moved rareseeds.com to a new e-commerce platform. Your existing order history and account details were transferred to the new platform so your records would not be lost. Passwords were not transferred, which is one reason our accounts are now passwordless.
2.4 Sensitive personal information
We do not seek out, collect, or use sensitive personal information as United States state privacy laws define it — precise geolocation, government identifiers, financial account log-ins, racial or ethnic origin, religious beliefs, union membership, health or genetic information, biometric identifiers, sexual orientation, or the contents of your mail, email, or text messages. We do not sell or share it, and we do not use it to infer characteristics about you.
3. How we use your information
| What we use it for | What that involves |
|---|---|
| Filling your order | Taking payment, picking and packing seed, printing labels, arranging delivery, and handling returns, refunds, and replacements. |
| Customer service | Answering questions about orders, shipping restrictions, germination, and growing advice. |
| Sales tax | Calculating the correct sales tax for your address and meeting our filing obligations. |
| Accounting and inventory | Recording the sale in our business systems and keeping stock accurate. |
| Fraud prevention and security | Detecting fraudulent orders, protecting accounts, and keeping the site available. |
| Making the site work | Remembering your cart, keeping you signed in, and showing the right currency and shipping options. |
| Understanding and improving | Seeing which varieties and pages people look for so we can improve the catalog and the site. |
| Marketing | Sending email and, if you have opted in, text messages; mailing our printed catalog; and showing and measuring advertising. |
| Reviews | Publishing your review and responding to it. |
| Legal and compliance | Meeting tax, accounting, and consumer-protection obligations, responding to lawful requests, and resolving disputes. |
3.1 Legal bases, if you are in the UK, the EEA, or Norway
- Performance of a contract — filling your order and running your account.
- Legitimate interests — preventing fraud, keeping the site secure, understanding how it is used, improving what we offer, and mailing our catalog. We balance those interests against your rights, and you can object at any time.
- Consent — non-essential cookies, advertising and analytics, and electronic marketing where the law requires consent. You may withdraw consent at any time, and doing so does not affect what we did before you withdrew it.
- Legal obligation — tax and accounting records, and responding to lawful requests.
4. Who we share your information with
We share personal information with companies that provide services to us. They may use it only to do the work we have asked them to do, and not for their own purposes unless noted below.
| Who | What they receive | Why |
|---|---|---|
| Shopify | Order, account, contact, and browsing information; payment details through Shopify Payments and Shop Pay | Runs our online store, checkout, payments, and point of sale |
| Payment card networks and digital wallets | Payment and billing details, device signals | Authorizing and settling your payment, including Shop Pay, Apple Pay, and Google Pay |
| Avalara | Shipping address and order line items | Calculating sales tax and supporting our tax filings |
| Klaviyo | Name, email address, phone number, text-message consent record, and browsing and purchase activity | Sending the email and text messages you have asked for, and stopping ones you have not |
| Celigo and NetSuite | Order and customer records | Transferring your order into the business system we use to pick, pack, invoice, and support it |
| Product review provider | Reviewer name, email address, review content and any photographs submitted | Collecting, publishing, and moderating reviews. Their terms grant them a continuing licence over review content — see section 2.1. |
| Meta (Facebook and Instagram) | Identifiers and information about pages and products you viewed and purchases you made | Showing and measuring advertising. See section 6. |
| Google (including YouTube) | Identifiers and information about pages and products you viewed and purchases you made | Showing and measuring advertising, and listing our products. See section 6. |
| Shipping carriers | Recipient name, address, phone number, and package details | Delivering your order |
| Recipe provider | Interactions with recipe pages | Running the recipe section of our site |
| Data management tools | Bulk customer and order records | Migrating, exporting, and correcting our own records |
We also disclose personal information:
- to our professional advisers, such as accountants, auditors, and lawyers;
- to a buyer or successor if we sell or reorganize any part of our business, in which case we will tell you before your information becomes subject to a different policy;
- when we are required to by law, or where we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.
We do not exchange your personal information for money.
5. Cookies and similar technologies
We use cookies, pixels, and local storage to run the site, understand how it is used, and support advertising. We group them into Essential, Analytics, and Marketing, and you control the last two.
You can review or change your choices at any time using the Manage Cookies link in our footer. Where the law requires us to obtain consent before setting non-essential cookies, we ask first, and nothing in the Analytics or Marketing groups is turned on until you allow it.
The full list, including how long each cookie lasts, is in our Cookie Policy.
6. Advertising, and what United States law calls “selling” and “sharing”
We work with Meta and Google to show advertising for our seeds and to measure whether it worked. To do that, we let them receive identifiers such as cookie or device identifiers and information about what you looked at and bought on our site.
Some of this happens directly between our systems and theirs rather than through your browser. That means blocking scripts or clearing cookies in your browser will not by itself stop it. Your choices in our cookie dialog and the opt-out described below do apply to it.
We do not receive money for this. But United States state privacy laws are broad, and this activity is what those laws call “sharing” for cross-context behavioral advertising — some states call it a “sale” or “targeted advertising” even when no money changes hands. So we treat it as such, and you can opt out.
6.1 How to opt out
- Turn Marketing off in our cookie dialog, using Manage Cookies in the footer. This applies to the browser you are using.
- Use our Do Not Sell or Share My Personal Information page.
- Send an opt-out preference signal such as Global Privacy Control. We treat a valid GPC signal as a request to opt out of sharing for the browser that sent it, and we do not require you to create an account first.
- Email seeds@rareseeds.com and ask us to opt you out.
We do not knowingly sell or share the personal information of consumers we know to be under 16 years of age.
7. Your choices
- Email — every marketing email has an unsubscribe link. You will still receive messages about orders you have placed.
- Text messages — reply STOP to any message to end them, or HELP for help. Message and data rates may apply. See our mobile terms.
- Printed catalog — email us and we will take you off the mailing list.
- Cookies and advertising — see sections 5 and 6.
- Your account — sign in to review your orders and update your addresses.
8. Your rights
8.1 If you live in a United States state with a privacy law
Depending on where you live, you may have the right to:
- know what personal information we have collected about you, and where it came from;
- get a copy of it, in a portable form;
- have it corrected if it is wrong;
- have it deleted;
- opt out of targeted advertising, and of any sale or sharing of your information;
- limit our use of sensitive personal information — though as explained in section 2.4, we do not use it;
- not be discriminated against for exercising any of these rights. We will not deny you goods, charge you a different price, or give you a lower quality of service because you asked.
To make a request, email seeds@rareseeds.com with the subject line “Privacy Request,” or write to us at the address in section 14. We will ask for enough information to verify who you are, which usually means confirming details of a recent order or the email address on your account. We will not use what you give us for verification for anything else.
We will acknowledge your request promptly and respond within 45 days. If we need more time we will tell you why, and we may take up to 45 additional days. If we deny your request you may appeal by replying to our response with the word “Appeal,” and we will respond to the appeal within the time your state's law allows.
An authorized agent may make a request for you. We will ask for proof that you gave them permission, and we may still ask you to verify your own identity.
8.2 California — Shine the Light
California residents may ask us once a year for a list of the categories of personal information we disclosed to third parties for their own direct marketing purposes, and who those third parties were. Email us with the subject line “Shine the Light Request.”
8.3 Nevada
Nevada residents may tell us not to sell their personal information. As noted, we do not exchange personal information for money, but you may still submit a request to seeds@rareseeds.com.
8.4 If you are in the UK, the EEA, or Norway
You have the right to ask us to give you access to your personal information; to correct it; to erase it; to restrict how we use it; to give you a copy in a portable form; and to object to our using it, including for direct marketing. Where we rely on your consent, you may withdraw it at any time.
We will respond within one month, and will tell you if we need longer. If you are unhappy with how we have handled your information you may complain to your data protection authority — the Information Commissioner's Office in the United Kingdom, or Datatilsynet in Norway.
9. How long we keep information
| What | How long | Why |
|---|---|---|
| Order and transaction records | 7 years after the order | Tax, accounting, and warranty or dispute claims |
| Account records | While your account is active, then 3 years | So you can see your own order history |
| Marketing lists | Until you unsubscribe | To send what you asked for |
| Unsubscribe and opt-out records | Indefinitely | We keep a suppression record so we can honor your opt-out and not contact you again |
| Customer service correspondence | 3 years | Handling follow-up questions and claims |
| Reviews | Until you ask us to remove them | They are published content. We remove a review from our site promptly on request and ask our provider to delete it, but their licence terms mean we cannot guarantee erasure from their own systems. |
| Site analytics | Up to 14 months | Comparing seasons year over year |
Where we no longer need information to identify you, we may keep it in an aggregated or de-identified form that cannot reasonably be linked back to you.
10. How we protect information
Our store and checkout run on Shopify, which maintains PCI DSS Level 1 certification for payment processing. Traffic to our site is encrypted in transit. We limit who on our team can see customer records, and we require our service providers to protect the information we give them.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your information and the law requires us to tell you, we will.
11. Where your information goes
We are based in the United States, and our systems and service providers are principally located there. If you are in the United Kingdom, the EEA, or Norway, your information will be transferred to the United States. Where those transfers require a safeguard, we and our providers rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another mechanism the law permits.
12. Children
Our site is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, email us and we will delete it.
13. Other sites
Our site links to sites we do not run — social media, gardening resources, and our partners. This policy does not cover them, and we are not responsible for what they do with your information.
14. Changes, and how to reach us
If we change this policy we will update the date at the top. If the change is significant we will tell you more directly, for example by email or a notice on the site.
Questions, requests, or complaints:
Baker Creek Heirloom Seed Co., LLC
2278 Baker Creek Road
Mansfield, Missouri 65704
United States
seeds@rareseeds.com
Customer care: 8:00 a.m. to 4:00 p.m. Central Time, Monday through Friday. Closed weekends and major holidays.
