THE VESPRE — PRIVACY POLICY

Effective Date: 1 August 2026 Last Updated: 1 August 2026

In plain language, before the formalities

This Privacy Policy describes how The Vespre handles your personal information. The detail below is necessary because privacy laws require precision, but the essentials are short:

• We collect what we need to fulfill your orders, communicate about them, and (with your opt-in) tell you about new capsules.
• We do not sell your information. We do not share it for cross-site advertising.
• For allergy and dietary information, we ask for your express, opt-in consent and use it only to fulfill your order safely.
• We work with a small number of trusted vendors — Stripe, Vercel, Sanity, ConvertKit, Plausible — and each is contractually bound to protect your information.
• You may ask us to access, correct, or delete your information at any time by writing to privacy@thevespre.com.

The legal text below controls in any case of conflict with this summary.

1. INTRODUCTION

This Privacy Policy explains how Svetlana Sanders, an individual residing in the State of Texas and conducting business under the assumed name "The Vespre" ("The Vespre," "we," "us," "our") collects, uses, shares, and protects your personal information when you visit our website at https://www.thevespre.com (the "Site"), place an order, join our waitlist, communicate with us, or otherwise engage with our services (collectively, the "Services").

This Privacy Policy applies to personal information collected through the Site, by email, by phone, in person at pop-up events, and through any third-party platform we use to operate the Services. It does not apply to information collected by third parties whose services we link to or use; please refer to those third parties' privacy policies for their practices.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use the Services.

This Privacy Policy is incorporated into and forms part of our [Terms of Service].

2. WHO WE ARE

The Vespre is a sole proprietorship operated by Svetlana Sanders, under an Assumed Name Certificate filed with the Harris County Clerk pursuant to Texas Business & Commerce Code Chapter 71. For purposes of any applicable data protection law that requires identification of a controller or business, the responsible party is:

Svetlana Sanders d/b/a The Vespre 14355 Schiller Road, Houston, TX 77082 Harris County, Texas

Privacy contact: privacy@thevespre.com

The Vespre intends to transition to a Texas limited liability company in 2027. Upon that transition, this Privacy Policy will be updated and the responsible party will become the successor entity.

3. INFORMATION WE COLLECT

We collect personal information in three ways: (i) information you provide directly; (ii) information collected automatically when you use the Services; and (iii) information from third parties.

3.1 Information You Provide Directly

Identity and Contact Information

• Full name
• Email address
• Phone number (optional, for delivery coordination)
• Billing address
• Shipping or delivery address
• Recipient name and address (for gift orders)

Order and Transaction Information

• Order history, including Products purchased, quantities, prices, dates, and fulfillment method
• Customization requests, dietary preferences, and special instructions
• Pickup or delivery preferences
• Gift messages

Payment Information

• Payment method type (e.g., credit card, debit card)
• Cardholder name
• Billing address
• Last four digits of card and card type (retained by The Vespre)
• Full card numbers, expiration dates, and CVV codes are collected and processed directly by Stripe and are not stored on The Vespre's systems.

Wedding and Custom Order Information

• Event date, venue, and contact information
• Design preferences, photographs, and inspiration materials
• Guest count, dietary breakdown, and allergen restrictions
• Vendor contact information (planners, venue coordinators)

Corporate Gifting Information

• Business name, billing contact, billing address
• Recipient lists, including names and delivery addresses
• Personalization instructions, branding requirements
• Net terms references and credit information (where applicable)

Communications

• Messages you send to us through contact forms, email, or other channels
• Customer service inquiries and our responses
• Reviews, testimonials, social media tags, and feedback you submit

Marketing Preferences

• Email opt-in status
• Capsule waitlist registration

3.2 Information Collected Automatically

When you visit the Site, certain information is collected automatically:

Device and Connection Information

• IP address (truncated by our analytics provider; see Section 6)
• Browser type and version
• Operating system and device type
• Screen resolution and timezone
• Referring page
• Pages visited and time spent
• Date and time of access

Cookies and Similar Technologies

• Strictly necessary cookies for cart functionality, session management, and security
• Analytics signals from Plausible Analytics (see Section 6)
• Stripe's required cookies for fraud detection and payment security

3.3 Information from Third Parties

We may receive personal information from:

• Payment processors (Stripe): transaction verification, fraud signals
• Shipping or delivery couriers: delivery status updates
• Social media platforms: where you tag us, follow us, or interact with our content (limited to what those platforms make available based on your settings)
• Wedding vendors and event planners: where they refer you to us or coordinate orders on your behalf
• Public records and the Texas Department of State Health Services: where required for compliance

3.4 Sensitive Personal Information

Certain information that you may provide is classified as sensitive personal information under the Texas Data Privacy and Security Act (Tex. Bus. & Comm. Code § 541), the California Privacy Rights Act, and analogous laws of other states:

• Allergy, dietary, and other health-related information that you provide so we can fulfill your order safely.

We process sensitive personal information only with your express, opt-in consent, obtained at the time you provide the information through a separate consent mechanism on the relevant form or checkout flow. Processing is limited to the purpose for which you provided the information (typically, safe order fulfillment). We do not use sensitive personal information for marketing, profiling, or any purpose beyond what is necessary to fulfill the order to which the information relates.

You may withdraw consent at any time by contacting privacy@thevespre.com; withdrawal will require us to cancel any open order to which the disclosure is material.

We do not knowingly collect other categories of sensitive personal information (such as government identifiers, financial account credentials beyond what is processed by Stripe, biometric data, precise geolocation, racial or ethnic origin, religious beliefs, citizenship or immigration status, sexual orientation, or the contents of mail, email, or text messages).

3.5 Children's Information

The Services are not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. You must be at least 18 to purchase. If we learn that we have collected personal information from a person under 13 in violation of the Children's Online Privacy Protection Act ("COPPA"), we will delete such information promptly. For California residents between the ages of 13 and 16, we do not sell or share personal information for cross-context behavioral advertising; in any event, we do not engage in such practices for any user. If you believe a child has provided personal information to us, please contact privacy@thevespre.com.

4. HOW WE USE YOUR INFORMATION

We use the information described in Section 3 for the following purposes:

4.1 To Provide the Services

• Process, fulfill, and deliver your orders
• Coordinate pickup and delivery, including providing your information to couriers
• Communicate with you about order status, fulfillment, allergen confirmations, and any issues
• Provide customer service and respond to inquiries
• Manage wedding cake and custom order projects, including coordination with venues and planners
• Manage corporate gifting accounts, recipient lists, and billing

4.2 To Process Payments

• Authorize and process payments through Stripe
• Detect and prevent fraud, chargebacks, and unauthorized transactions
• Retain transaction records as required for tax and accounting (see Section 8)

4.3 To Protect Health and Safety

• Process allergen and dietary disclosures (subject to your consent under Section 3.4) to avoid serving you Products to which you are allergic or intolerant
• Communicate food safety information, including TCS handling instructions and any allergen-related notifications
• In the unlikely event of a food safety recall or food-borne illness investigation, contact affected customers as required by law and prudence

4.4 To Communicate With You (Marketing)

• Send capsule announcements, new launch notifications, and editorial communications, only with your express opt-in
• Manage waitlist signups for upcoming capsules

You may opt out of marketing communications at any time via the unsubscribe link in any marketing email or by contacting privacy@thevespre.com. Opt-out does not affect transactional communications necessary to fulfill your orders.

4.5 To Improve the Services

• Analyze aggregated, de-identified usage patterns to improve the Site
• Understand which Products and capsules resonate with our community
• Develop new offerings, capsule themes, and seasonal direction

4.6 For Legal and Compliance Purposes

• Comply with applicable laws, including Texas Cottage Food Law, food safety regulations, tax law, and consumer protection law
• Respond to lawful requests from law enforcement, regulators, and courts
• Establish, exercise, or defend legal claims
• Enforce our Terms of Service and protect our rights and the rights of others

4.7 For Business Transitions

• Facilitate the planned transition from sole proprietorship to a Texas limited liability company in 2027, including transferring records to the successor entity. We will provide notice on the Site and, where reasonably feasible, by email to active customers, at least thirty (30) days before any such transition. If you object to the transfer of your information to a successor entity, you may request deletion of your information before the transition (subject to legal retention obligations) by contacting privacy@thevespre.com;

• In the event of any future business transfer, sale, merger, or reorganization not anticipated at the date of this Policy, transfer your information to the successor, with comparable notice.

We do not use your information for automated decision-making that produces legal or similarly significant effects. We do not use your information to train, fine-tune, or improve any artificial intelligence or machine learning model.

5. WHY WE PROCESS YOUR INFORMATION

We process personal information for the purposes described in Section 4, in compliance with applicable United States and Texas law. We rely on the following grounds:

• To perform our contract with you — to fulfill orders, process payments, and provide the Services you have requested;
• With your express consent — for marketing communications, processing of sensitive allergen and dietary information, and any optional uses for which we ask your permission;
• To comply with our legal obligations — including tax recordkeeping, food safety reporting, and consumer protection law;
• For our legitimate business interests — including operating, improving, and securing the Services, detecting fraud, and managing day-to-day business operations, in each case in a manner that respects your reasonable expectations.

6. COOKIES AND TRACKING TECHNOLOGIES

6.1 What We Use

The Site uses a minimal set of cookies and similar technologies:

Strictly Necessary Cookies

• Cart and checkout session management
• Security and fraud prevention
• Load balancing
• These cookies are essential and cannot be disabled without disabling the Services.

Analytics

• We use Plausible Analytics, a privacy-focused, cookieless analytics service that does not use cookies, does not track users across sites, and does not collect personally identifiable information. Plausible aggregates anonymous data about Site usage.

Payment Processor Cookies

• Stripe sets cookies necessary for payment processing, fraud prevention, and PCI compliance. These cookies are governed by Stripe's privacy policy.

Email Marketing Tracking

• ConvertKit, our email service provider, may include tracking pixels in marketing emails to measure open and click rates. You can disable these by configuring your email client to block remote images by default.

6.2 What We Do Not Use

The Vespre does not currently use:

• Third-party advertising or retargeting cookies
• Social media tracking pixels (Meta Pixel, TikTok Pixel, etc.)
• Cross-site behavioral tracking
• Google Analytics, Adobe Analytics, or similar cookie-based analytics
• Data brokers or audience-enrichment services

If we introduce any such technologies in the future, this Privacy Policy will be updated and, where required by law, your consent will be sought before such technologies are activated.

6.3 Do Not Track and Global Privacy Control

Some browsers transmit a "Do Not Track" or Global Privacy Control ("GPC") signal. Because we do not engage in cross-site tracking or sale of personal information, the practical effect of these signals on our Site is limited. Where applicable law (including California law) treats a GPC signal as an opt-out request, we honor it as such.

7. HOW WE SHARE YOUR INFORMATION

We share your personal information only as described in this Section. We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising.

7.1 Service Providers

We share personal information with service providers who help us operate the Services. Each is engaged under a written agreement that requires the provider to use your information only for the purposes for which we share it, to apply appropriate security measures, and (where applicable) to comply with the "service provider" requirements of the California Privacy Rights Act and analogous laws:

7.2 Gift Recipients and Event Vendors

For gift orders, we share recipient information (name, address, phone) with delivery couriers and may include your gift message with the Product. For wedding and event orders, we share relevant information with venue coordinators, event planners, and other vendors as necessary to complete fulfillment.

7.3 Legal Requirements

We may disclose your information when required by law or in good-faith belief that such disclosure is necessary to:

• Comply with a subpoena, court order, regulatory request, or other legal process;
• Comply with Texas Department of State Health Services requirements, including in connection with any food safety inquiry;
• Enforce our Terms of Service or other agreements;
• Protect the rights, property, or safety of The Vespre, our customers, or others, including in connection with fraud prevention and risk management.

7.4 Business Transitions

In the event of a planned transition from sole proprietorship to a limited liability company, or any future sale, merger, reorganization, dissolution, or asset transfer, your personal information may be transferred to the successor entity. We will provide notice on the Site and, where reasonably feasible, by email at least thirty (30) days before any such transfer that materially affects how your information is handled.

7.5 With Your Consent

We may share your information for purposes not described above with your specific consent.

8. DATA RETENTION

We retain personal information only for as long as is reasonably necessary to fulfill the purposes for which it was collected, to comply with applicable legal obligations, and to defend or pursue legal claims. The general retention periods we apply are summarized below. Where applicable law requires a longer retention period, the longer period controls.

When the retention period expires, we delete, anonymize, or archive the information in a manner that prevents further identifiable use. Where you exercise a right to deletion and the law permits, we will honor your request even before these periods expire.

9. DATA SECURITY

We implement reasonable and appropriate administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, loss, misuse, alteration, and disclosure. These measures include:

• HTTPS / TLS encryption of the Site
• Access controls limiting personal information to those with a legitimate need
• Use of reputable service providers (Stripe, Vercel, Sanity, ConvertKit) that maintain industry-standard security certifications
• Tokenization of payment information by Stripe (so The Vespre never holds full card data)
• Routine review of security practices

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for protecting your own account credentials and for using strong, unique passwords. If you suspect any unauthorized access to your account or information, notify us immediately at privacy@thevespre.com.

In the event of a data breach affecting your personal information, we will notify you and applicable regulators as required by Texas law (including Tex. Bus. & Comm. Code Ch. 521) and other applicable law.

10. YOUR PRIVACY RIGHTS

10.1 Universal Practices

As a matter of internal policy, not as a contractual commitment enforceable by you, The Vespre extends the following practices to all customers regardless of state of residence:

• Reasonable response to requests to access personal information we hold about you;
• Reasonable response to requests to correct inaccurate or incomplete information;
• Reasonable response to requests to delete personal information, subject to legal retention obligations;
• Honoring opt-out of marketing communications.

These voluntary practices are subject to change at our discretion and do not create rights enforceable as a contract. Customers whose statutory rights are described below have enforceable rights under those statutes.

10.2 Texas Residents — TDPSA Rights

Under the Texas Data Privacy and Security Act (Tex. Bus. & Comm. Code Ch. 541), where applicable to The Vespre, Texas residents have statutory rights to:

• Confirm whether we process their personal data and access that data;
• Correct inaccuracies;
• Delete personal data;
• Obtain a portable copy of their personal data;
• Opt out of (i) targeted advertising, (ii) sale of personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

We do not engage in targeted advertising, sale of personal data, or profiling as described above. Texas residents may submit any request under this Section by contacting privacy@thevespre.com.

10.3 California Residents — CCPA / CPRA Rights

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"):

• Right to know the categories and specific pieces of personal information we have collected;
• Right to delete personal information, subject to legal exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information (we do not sell or share within the meaning of the CCPA/CPRA);
• Right to limit use of sensitive personal information (we already limit such use as described in Section 3.4);
• Right to non-discrimination for exercising these rights.

Notice at Collection: The categories of personal information we collect from California residents are described in Section 3 above. We use this information for the purposes described in Section 4. We retain this information for the periods described in Section 8. We do not sell or share personal information for cross-context behavioral advertising.

To exercise CCPA/CPRA rights, contact privacy@thevespre.com.

10.4 Other State Rights

Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Oregon, and others) have statutory rights similar to those described in Sections 10.2 and 10.3. We will respond to verified requests in accordance with the applicable statute.

10.5 How to Exercise Your Rights

To exercise any statutory right, contact privacy@thevespre.com with:

• Your full name, email address used in connection with the Services, and order numbers if applicable;
• A clear description of the right you wish to exercise;
• Sufficient information to allow us to verify your identity. We will request only information reasonably necessary to verify your identity and will not use verification information for any other purpose.

We will respond within the time period required by applicable law, generally within forty-five (45) days. We may decline or limit a request to the extent permitted by law, in which case we will explain the basis.

10.6 Appeals

If we deny a statutory request, you may appeal by replying to our decision email with the subject line "Privacy Request Appeal." We will respond to appeals within sixty (60) days. If you are not satisfied with our appeal response, you may contact your state Attorney General. For Texas residents, the contact is the Office of the Texas Attorney General, Consumer Protection Division.

10.7 Authorized Agents

You may designate an authorized agent to make a request on your behalf. We will require verification of the agent's authority before responding.

11. INTERNATIONAL USERS

The Services are operated from the United States and intended for use in Texas. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States.

The Vespre does not target marketing to, sell to, or solicit business from residents of the European Economic Area, United Kingdom, or other jurisdictions with restrictive cross-border data transfer rules. Incidental access to the Site from such jurisdictions does not subject The Vespre to those jurisdictions' privacy laws unless we deliberately target users there.

12. THIRD-PARTY LINKS

The Site may link to third-party websites, social media platforms, or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party site you visit.

13. SOCIAL MEDIA

When you interact with The Vespre on social media platforms (such as Instagram), the platform's privacy practices govern that interaction. Information you post publicly is, by definition, public. If you tag The Vespre or send us a direct message, we may receive your handle, profile information, and the content of the message; we may use this information to respond to you, to share user-generated content as permitted in our Terms of Service, and as otherwise described in this Privacy Policy.

14. CHANGES TO THIS PRIVACY POLICY

14.1 Non-Material Changes

Non-material changes (clarifications, formatting, contact information updates) take effect upon posting on the Site with an updated "Last Updated" date.

14.2 Material Changes

Material changes — including any change that broadens our collection, use, or sharing of personal information, narrows your rights, or changes retention periods to your detriment — will be:

(a) Posted on the Site at least thirty (30) days before they take effect;

(b) Communicated by email to Customers with active accounts or active orders at least thirty (30) days before the effective date;

(c) Accepted by your affirmative action on the Site at next engagement, where a clickwrap mechanism is presented.

If you do not affirmatively accept a material change, your prior rights remain in effect with respect to information already collected.

15. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact:

The Vespre — Privacy Svetlana Sanders, sole proprietor d/b/a The Vespre 14355 Schiller Road, Houston, TX 77082 Harris County, Texas

Email: privacy@thevespre.com General: hello@thevespre.com

For statutory privacy rights under Texas, California, or other state law, please use the same address; we will route your request to the appropriate process.

This Privacy Policy was last updated on [DATE]. Thank you for trusting The Vespre with your personal information.