Privacy policy

Last updated March 2, 2026

Who is responsible for your data

The data controller is MLJ, SASU, a French simplified joint stock company registered under SIREN 934 769 837, publisher of TieredOrders. The person accountable for this policy is Jimenez Julien, publication director. You can reach him at jimenezjulien42@gmail.com with any question, request or complaint about personal data, and he answers those messages himself.

What the request form collects

The form on the home page of this site collects exactly the following fields and nothing else: name, your full name; email, your work email address; company, your bakery name; role, your role in the shop, chosen from a list; request, what you are asking for, chosen from a list; size, roughly how many custom cakes you take in a week, chosen from a list; message, your own description of how custom orders work in your shop; and consent, a checkbox recording that you agreed to be contacted.

The form also carries three hidden technical fields, form-name, subject and recipient, which route the message to the right inbox, plus one anti spam field named bot-field that stays empty for a human visitor. When a submission is delivered, the hosting platform records the date and time of the submission and the IP address it came from, as a security measure against automated abuse.

We do not ask for a postal address, a phone number, payment details or any special category of data. Please do not paste customer names, dietary records or payment information from your own bakery into the message field. If you send such details by mistake, tell us and the message will be deleted.

Why we process it, and on what legal basis

The single purpose is to answer your request: to reply to a question, to prepare a walkthrough of the product, to quote a plan, or to arrange an onboarding call. Under the EU General Data Protection Regulation the legal basis is your consent, given by ticking the consent box, together with our legitimate interest in responding to a business enquiry that you started. These submissions are never used to build advertising audiences, are never enriched from third party databases, and are never sold or rented.

If you later open a subscription, the information you gave in the form is used to set up your account, and the processing is then based on the performance of the contract between your business and MLJ, SASU.

Who processes and stores submissions

Form submissions are processed and stored by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, United States, through the Netlify Forms feature, acting as our processor under a data processing agreement. A copy of each submission is forwarded by email to jimenezjulien42@gmail.com so that a person reads it. No other company receives the content of your message.

How long we keep it

An enquiry that does not lead to an account is kept for 24 months from the date of the last exchange, then deleted from the Netlify Forms store and from the mailbox. If your enquiry leads to a subscription, the record is kept for the life of the account and for three years after it closes, so that we can answer questions about what was agreed. Accounting records connected to a paid subscription are kept for ten years, as French commercial law requires.

Cookies and analytics

This site sets no advertising cookie, no analytics cookie and no social network pixel. There is no third party analytics script on any page here. The two typefaces are loaded from Google Fonts, which receives the request needed to serve the font files. Because no tracking cookie is set, no consent banner is shown, and none is required.

International transfers

MLJ, SASU is established in France, and both the hosting and the form processing run on infrastructure operated by Netlify, Inc. in the United States. Transfers of personal data from the European Economic Area to the United States are covered by the European Commission standard contractual clauses included in the agreement with Netlify, together with the technical measures that platform applies, including encryption in transit. If you are in the United States, your data stays with a United States processor and a French controller.

Your rights in the United States

If you live in California, Colorado, Connecticut, Utah or Virginia, state privacy law gives you the right to know what personal information is held about you, to obtain a copy of it, to have it corrected and to have it deleted. You may also opt out of the sale or sharing of personal information for targeted advertising. We do not sell or share personal information for advertising, so there is nothing to opt out of, but the right stands and we will confirm that in writing if you ask. California residents may also ask about the categories of information collected and the purpose of collection, and may name an authorized agent to act for them. Nobody is treated differently for exercising a privacy right.

Your rights in the European Union and the United Kingdom

Where the General Data Protection Regulation applies, you have the right of access, rectification, erasure, restriction of processing, portability and objection, and the right to withdraw a consent you have given at any time without affecting the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with a supervisory authority, which in France is the CNIL.

How to exercise your rights

Write to jimenezjulien42@gmail.com from the address you used on the form, say clearly what you want, and you will have an answer within 30 days. If a request is complicated we will say so inside those 30 days and take at most 60 more. There is no charge for a reasonable request. If we cannot identify you from what you send, we will ask one additional question rather than demanding an identity document.

Security

The site is served over HTTPS, submissions travel encrypted, and access to the mailbox and to the form store is protected by strong authentication. Only Jimenez Julien reads incoming enquiries. Product data belonging to subscribing bakeries lives in a separate, access controlled system, described in the terms of service and in the answers on the home page.

Children

TieredOrders is a business tool sold to bakeries, and this site is not directed to children. We do not knowingly collect personal information from anyone under 16 years of age, and we have no reason to receive any. If you believe a child has sent information through the form, write to us and it will be deleted promptly.

Changes to this policy

When this policy changes, the date at the top of the page changes with it, and a short note of what changed is added to this section. Material changes that affect how enquiries are handled are also announced by email to anyone whose enquiry is still open. This version replaces every earlier version.