Privacy Policy

Last updated: November 2, 2026

This policy explains how Kacha Maton collects and uses information when you browse our candle catalog, submit an order request, or connect your order to our Facebook Messenger conversation. Kacha Maton is responsible for the customer information held in this ordering system.

Information we collect

• Order information: your name, an optional phone number, optional notes, selected candles, sizes, quantities, prices, and order total. We also record the Refund & Return Policy version you accepted at checkout and the time of acceptance. We generate an order identifier, order number, creation date, and order status.
• Order handling information: we may record fulfillment status, a shipping carrier and tracking number, private administration notes, and the time of the latest update to manage your order. These administration notes are kept separately from notes you submit.
• Messenger connection information: when Messenger provides an order referral, our system receives your Page-scoped Messenger user identifier and the referral identifying your order. We store the identifier, connection status, and any order-related messaging error details.
• Communications: information you choose to share with our business in Messenger, such as pickup or delivery arrangements, is handled through that service. Our order database does not automatically archive your full Messenger conversation.
• Shipping estimates: when the optional USPS calculator is enabled, we collect your destination ZIP code and selected USPS service, and save the calculated postage, package information, and shipping quote with the order. USPS receives origin/destination ZIP codes and package weights and dimensions to return postage estimates. We use a browser cookie to associate your quote with your order and a salted hash of your IP address to limit quote requests.
• Scratch-off promotions: we store a salted hash derived from your IP address and browser user agent to enforce the scratch cooldown. We also store scratch results, prize terms, expiry dates, and the order on which a prize is redeemed. A browser cookie identifies your saved scratch result.
• Visitor analytics: we use a keyed, pseudonymous identifier derived from your connecting IP address to count visits and selected button clicks. We store that identifier, event type, time and date, whether the catalog or coming-soon page was showing, and approximate country, region, and city supplied by Cloudflare. We do not save raw IP addresses, precise coordinates, full browsing URLs, or referrers in these analytics records. IP-based counts can combine people on a shared network and can change when someone uses a VPN or changes connections.
• Technical information: our hosting and messaging providers may process information such as IP addresses, browser information, and request logs to deliver and protect their services. Our application does not store raw IP addresses in its order or visitor analytics records.

You can browse without submitting an order. A name and at least one valid candle selection are needed to create an order; a phone number and notes are optional. Please do not include passwords, payment card details, or sensitive personal information in the order form.

How we use your information

We use this information to record and review your order, calculate its total using our catalog prices, send an order confirmation, answer questions, arrange payment and pickup or delivery, and resolve order or messaging problems. For candles with a custom request form, we also collect your requested scent, selected size, and any additional instructions. These details are stored with the order and included in its Messenger confirmation to help us fulfill your request. We also use visitor analytics to understand traffic locations and which storefront buttons receive clicks. The current ordering system does not use this information for advertising profiles or automated marketing.

How ordering through Messenger works

When you select “Continue to Facebook Messenger,” your order is saved first, even if you do not complete the Messenger conversation. You are then redirected to Meta's Messenger service with a referral containing your order identifier.

After you start or interact with the conversation and Messenger supplies the supported referral information, our system links your Messenger identifier to your order and attempts to send a confirmation. That confirmation includes order details and may include the phone number and notes you provided. This information is therefore also processed by Meta and visible in the conversation with our business.

The website does not request your Facebook password, friends list, or access to unrelated private conversations. Facebook and Messenger handle information under Meta's Privacy Policy.

Storage and sharing

Our website and server functions run on Cloudflare. Order, catalog, and visitor analytics records are stored in Cloudflare D1, and catalog images uploaded by our administrators are stored in Cloudflare R2. See Cloudflare's Privacy Policy for information about its practices.

Order records are accessible through a protected administration service to people with our administrator credentials. We share order information with service providers as described here to operate the catalog and Messenger workflow. This application has no feature for selling customer information or sharing it with advertising networks. Information may also be disclosed where required by applicable law or to address fraud, security incidents, or legal claims.

When shipping estimates are enabled, we send ZIP codes and package measurements to USPS to calculate rates. This feature does not send USPS your name, phone number, Messenger information, or payment credentials, and does not purchase labels. See the USPS Privacy Policy.

Our service providers may process information in countries other than your own.

Cookies, analytics, and your cart

The catalog sets an HttpOnly cookie named km_scratch to retrieve your scratch-off result and redeem a winning prize once. It lasts for the longer of the configured scratch cooldown or prize validity period (up to 365 days). Clearing this cookie or changing browsers can prevent recovery of an unused prize. When USPS shipping is enabled, an HttpOnly cookie named km_shipping associates your quote with this browser for up to one day. It does not contain a mailing address or payment information. Our own visitor analytics do not set cookies or use browser local storage, and no third-party analytics or advertising tracker is included. We skip analytics when a supported Global Privacy Control or Do Not Track opt-out is indicated. Browser blockers, network failures, and bot filtering can also reduce recorded counts. Your selected cart items are held temporarily in the current page's memory and reset when you reload or leave the page. Once you submit an order, its saved record remains separate from the cart. Cloudflare and Meta may use their own technologies under their respective policies.

Payments

This website records order requests and does not process payments or collect payment card details. Payment arrangements are discussed separately through our business conversation. Any external payment service used has its own privacy practices.

Retention and security

Visitor analytics events, pseudonymous visitor records, and duplicate-counting records are kept for up to 90 days and cleaned during new counted activity or administration report requests. An administrator can exclude their current IP identifier from future counts; that exclusion stays until removed and does not erase earlier counts. The analytics dashboard is protected by the Admin Key. It shows location summaries and counts rather than raw visitor IP addresses.

Saved orders, including their shipping summaries, and Messenger identifiers remain until manually removed. Shipping quotes expire after five minutes and rate-cache entries after two minutes. Expired cache entries, unused shipping quotes older than one day, and old rate-limit identities are removed opportunistically when new quotes are calculated. We use these records for order handling, customer support, and any applicable recordkeeping obligations. You may request deletion as described below.

Administrator operations require an access key, and Messenger credentials are configured on the server rather than included in the public page. No method of storage or transmission can be guaranteed completely secure.

Your choices and data deletion requests

To ask about your information, request a copy or correction, or request deletion of your order information and linked Messenger identifier, contact Kacha Maton on Messenger. State “Privacy request” or “Data deletion request” and include your order number if available. If you do not know the number, provide the name used for the order and its approximate date. Do not send passwords or payment details.

Requests are handled manually. We may ask for information reasonably needed to verify that the record belongs to you. Depending on where you live, you may have additional rights under applicable privacy law. Where information must be retained for a legal obligation or an unresolved order or dispute, we will explain the reason in our response.

Deleting an order from our database does not automatically delete messages or records held by Meta or other providers. Use the relevant provider's privacy tools to manage that information. Leaving Messenger or deleting a conversation does not automatically remove the order stored by Kacha Maton.

Children's privacy

This catalog and ordering service is intended for a general audience and is not directed to children under 13. If you believe a child has submitted personal information, contact us so we can review and remove it as appropriate.

Changes and contact

Kacha Maton reserves the right to change, update, or replace this Privacy Policy at any time, subject to applicable law. Revisions will be posted on this page with an updated date and take effect when posted unless a later effective date is stated. Please review this page periodically to stay informed about our information practices.

For material changes, we will provide any additional notice and obtain any consent required by applicable law before applying the changes. An update to this page alone does not authorize a materially different use or disclosure of previously collected personal information where notice or consent is required. Nothing in this policy limits privacy rights that cannot be excluded under applicable law.

For privacy questions, message Kacha Maton.