Trust & Security

Belle Bouquets takes reasonable steps to protect customer information, payment-related workflows, and website communications. This Trust & Security page summarizes the safeguards we use and the responsibilities customers should understand.

Security is a shared effort. We work with reputable service providers and avoid collecting more sensitive information than needed for custom floral services.

Published fixed-price product pages link to live, full-page Stripe-hosted Checkout. Custom-quoted work receives a Stripe-hosted payment request only after the written scope and USD total are approved. Card details are entered only on Stripe's hosted page and do not pass through this website, Cloudflare D1, Resend, or Migadu.

Stripe-hosted checkout accepts eligible Visa, Mastercard, American Express, and Discover credit and debit cards in USD. Stripe determines whether a particular card is eligible and displays the methods available for that transaction, customer, and device.

Charges may display the long statement descriptor BELLE BOUQUETS. When a product-specific descriptor is used, the statement may display BELLE* followed by text identifying the product or order. The text after the asterisk varies by charge, and a bank may abbreviate or format descriptor text differently.

Customers should never send full card numbers, card security codes, or bank credentials by ordinary email, contact form message, text message, or social media message. The website rejects contact-form text containing a likely payment card number before the inquiry can be stored or emailed.

PCI DSS applies to card-payment operations. Stripe is a PCI Level 1 service provider, but using Stripe does not by itself certify Belle Bouquets. Belle Bouquets does not claim independent PCI DSS certification or a completed attestation unless and until the applicable validation has been completed.

The full-page Stripe-hosted Checkout architecture is designed to keep electronic cardholder data out of Belle Bouquets systems and may support a reduced-scope validation path such as SAQ A. Belle Bouquets will confirm the applicable validation requirements with Stripe, its acquiring bank, or the relevant payment brand and repeat required validation on the applicable schedule.

The live checkout flow preserves these controls:

• For published fixed-price items, Stripe controls the product, one-item quantity, currency, and USD amount configured in each Payment Link; the browser cannot set or alter those values. A payment request for custom work must match the latest written quotation.
• Customers will be sent to a full-page Stripe-hosted Checkout URL. Belle Bouquets will not add raw card inputs, merchant-hosted card fields, card details in URL parameters, or card details in first-party forms.
• A Stripe-hosted confirmation and customer receipt are informational. Payment and refund status are confirmed against Stripe's transaction records before fulfillment or accounting action is taken.
• Only the minimum non-sensitive transaction metadata needed for fulfillment, support, refunds, accounting, and disputes will be stored. Full card numbers, card security codes, and unredacted payment credentials will not be logged or stored.

The payment workflow is operated with the following safeguards:

• Stripe test and live environments remain separate. Live credentials are kept only in protected operational secret stores or encrypted provider secrets, never in source code, browser code, committed files, email, or ordinary logs.
• Restricted API keys will be used where the required Stripe operations permit them. Dashboard and key access will be limited, protected by multi-factor authentication, reviewed periodically, and rotated after suspected exposure.
• Stripe-hosted transaction records are the payment-status source of truth. Any future webhook integration must verify Stripe signatures, handle duplicate event IDs idempotently, and store only a non-sensitive audit trail.
• The website, dependencies, Cloudflare configuration, Termly integration, and checkout redirect will be patched and change-controlled. Third-party scripts will be reviewed before they can affect the page that starts checkout.
• Belle Bouquets will confirm with Stripe or the acquiring bank whether quarterly Approved Scanning Vendor scans or another validation step applies, record the evidence, and address findings before attestation.
• Checkout availability, product identity, quantity, currency, amount, cancellation disclosures, hosted confirmation, refunds, disputes, and deactivated-link behavior will be reviewed as part of payment operations.

Our current safeguards include:

• Encrypted HTTPS connections for website traffic.
• Limited access to inquiry, proposal, payment-status, and order records.
• Use of reputable hosting, email, payment, form, and business-service providers.
• Fraud-prevention, spam-prevention, and abuse-monitoring controls where appropriate.
• Recordkeeping practices designed to keep business records only as long as reasonably needed.
• Periodic review of website content, forms, dependencies, and service-provider access.

We rely on outside providers for website hosting, email, forms, consent management, security, data storage, customer communications, and Stripe-hosted payment processing.

We choose providers that are appropriate for the type of information involved and require them to use information only as needed to provide services to us, comply with law, or protect security.

If we learn of a potential personal-data incident, we record when it was discovered, investigate its scope, take reasonable containment and recovery steps, preserve relevant evidence, assess risk to affected people, and work with relevant service providers.

Where the GDPR applies and a personal-data breach is likely to create a risk to people's rights and freedoms, our procedure calls for notifying the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness. We document reasons for delay and notify affected people without undue delay where the law requires it. We also follow any shorter or additional notice period that another applicable law requires.

Customers can help by reporting suspicious messages, payment concerns, or website issues promptly.

To help protect your information:

• Use only the official website and verified contact information listed on the site.
• Do not send full payment card numbers, card security codes, passwords, or bank credentials by message.
• Review invoices, payment pages, receipts, and statement descriptors carefully.
• Contact us promptly if you receive a suspicious message claiming to be from Belle Bouquets.
• Keep copies of your proposal, invoice, receipt, and event communications for your records.

No website, payment system, email system, or storage method can be guaranteed perfectly secure. This page describes our security posture but does not create a warranty, insurance promise, or guarantee against every possible issue.

Security practices may change as the website and business tools change.

To report a security or payment-related concern, contact hello@belleoftheballbouquets.com or call +1 (636) 324-1107. For mailed notices, use our operational and customer-service address at 10227 Whitlock Dr, Overland, MO 63114, USA.