Privacy Policy

Concrete Flower Collective Effective Date: September 4, 2026

1. Overview

This Privacy Policy explains how Harper-Glantz, LLC, doing business as Concrete Flower Collective (“CFC,” “we,” “us,” or “our”), collects, uses, shares, and protects information when you visit www.concreteflowercollective.com (the “Site”) or otherwise interact with us online. It applies to visitors in the United States, the European Union, the United Kingdom, and elsewhere.

By using the Site, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Site.

2. Information We Collect

Information you provide directly.

  • Contact form: name, email address, phone number, company name, industry, and any message you submit.

  • Newsletter signup: email address, and name if you provide it.

We do not collect payment or billing information through the Site. Client payments are made directly by ACH bank transfer or through accounting tools such as QuickBooks, outside the Site, and are subject to those providers’ own privacy practices.

We do not knowingly collect Social Security numbers, financial account numbers, government ID numbers, or other sensitive personal information through the Site.

Information collected automatically.

  • Google Analytics (GA4) — pages visited, time on site, referring and exit pages, approximate location derived from IP address, device and browser type.

  • Squarespace Analytics — similar site-usage data, collected by our website host and platform provider, Squarespace.

See Section 4 for how you can control this.

3. How We Use Information

We use the information we collect to respond to inquiries submitted through the contact form; send newsletter and marketing communications to those who opt in; understand how visitors use the Site so we can improve it; maintain the security and proper functioning of the Site; and comply with our legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Every marketing email we send includes a working unsubscribe link, and we honor opt-out requests promptly, consistent with the CAN-SPAM Act.

4. Cookies and Similar Technologies

The Site uses cookies grouped into two categories:

  • Essential cookies — required for the Site to function and cannot be disabled.

  • Analytics cookies — Google Analytics and Squarespace Analytics, used only with your consent.

When you first visit the Site, a cookie banner lets you Accept All, Decline All, or manage your preferences by category. Analytics cookies stay off until you actively accept them — this opt-in approach applies to every visitor, regardless of location, so it satisfies both U.S. and EU/UK requirements. You can change your preference at any time using the “Cookie Preferences” link in the Site footer.

We honor the Global Privacy Control (GPC) signal and similar browser-based opt-out signals as a request to decline non-essential cookies.

5. Legal Bases for Processing (EU/UK Visitors)

If you are located in the European Union or United Kingdom, we process your personal data on the following legal bases under the GDPR/UK GDPR:

  • Consent — for analytics cookies and marketing emails, which you may withdraw at any time.

  • Legitimate interests — for responding to inquiries and operating the Site securely.

  • Contract — where processing is necessary to take steps you request toward our providing services to you.

6. How We Share Information

We share information only with the service providers who help us operate the Site and our business:

  • Squarespace (website hosting and analytics)

  • Google (Google Analytics)

  • Our email providers Squarespace Email Campaigns, and Mailchimp. 

  • Our accounting and ACH payment providers, for client engagements only — not data collected through the Site

These providers may only use your information to perform services on our behalf. We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

Google's and Squarespace's use of information collected through their tools is governed by their own privacy policies, available at policies.google.com/privacy and squarespace.com/privacy, respectively.

We may also disclose information if required by law, or to protect our rights, property, or safety, or the rights, property, or safety of others.

7. International Data Transfers

CFC is based in the United States. If you are located outside the U.S., your information will be transferred to and processed in the United States, which may not have the same data protection laws as your home country. Where required, we rely on appropriate safeguards — such as standard contractual clauses used by our service providers — for these transfers.

8. Data Retention

We retain contact form submissions for 24 months following our last interaction with you, and newsletter subscriptions for as long as you remain subscribed, unless you request earlier deletion. In all cases, we may retain information longer where necessary to comply with legal obligations or maintain business records. Analytics data is retained according to Google Analytics’ and Squarespace’s standard retention settings.

9. Your Privacy Rights

California residents.

Regardless of whether California privacy statutes such as the CCPA apply to CFC based on revenue or data-volume thresholds, we voluntarily provide California residents the right to request to know what personal information we have collected about you, and to request its correction or deletion. We do not sell your personal information for money and do not share it for cross-context behavioral advertising, so no opt-out is necessary for those activities. We honor Global Privacy Control (GPC) signals as described in Section 4.

For purposes of California law, including the California Online Privacy Protection Act (CalOPPA), the categories of personal information we collect are: (a) identifiers (name, email address, phone number, IP address); (b) internet or other electronic network activity information (pages visited, time on site, referring pages, browser and device type); and (c) professional or employment-related information (company name, industry). These categories are shared only with the service providers identified in Section 6.

Under California's “Shine the Light” law, California residents may request information once a year about any personal information we've shared with third parties for their own direct marketing purposes. Because we do not share personal information for third-party direct marketing, there is nothing to disclose under this law, but you're welcome to request confirmation.

Residents of other U.S. states.

If you live in a state with its own comprehensive privacy law (for example, Virginia, Colorado, Connecticut, or Utah, and others as they take effect), you generally have similar rights: to confirm whether we process your personal information, to access or obtain a copy of it, to correct inaccuracies, to request deletion, and to opt out of its use for targeted advertising, sale, or certain profiling — none of which we currently do. If we deny a request, you may have the right to appeal; contact us and we'll tell you how. As CFC works with clients across the U.S., we intend to honor requests consistent with the law of the state you're in even where a given right isn't independently required in California.

EU/UK residents.

Under the GDPR/UK GDPR, you have the right to access, correct, delete, or restrict our use of your personal data; to receive a copy of your data in a portable format; to object to processing; and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at hi@concreteflowercollective.com. We may need to verify your identity before responding, and we will respond within the time required by the law that applies to your request.

10. Children’s Privacy

The Site is not directed to children under 16, and we do not knowingly collect personal information from children.

11. Data Security

We use reasonable administrative and technical safeguards to protect the information we collect, including relying on the security measures of our service providers (Squarespace, Google). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Third-Party Links

The Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The Effective Date above reflects the most recent revision. Material changes will be reflected on this page, and we will notify subscribers by email when we make material changes to how personal information is processed.

14. Contact Us

Harper-Glantz, LLC dba Concrete Flower Collective PO Box 11, Santa Cruz, CA 95062-9998 hi@concreteflowercollective.com