Verdarium is a plant catalogue and terrarium planner. You can use all of it without an account, and we try to collect as little as we can. This notice explains what we do collect, why, and what you can do about it.
It covers verdarium.green and The Care Window newsletter. How cookies work on the site is covered in more detail in the cookie policy.
Who is responsible for your data
The controller of your personal data is:
Jacek Dabkiewicz
35 West Lodge Avenue, W3 9SE, London, United Kingdom
Email: privacy@verdarium.green
Verdarium is a small, independent project and has not appointed a Data Protection Officer, as it is not required to. Write to the address above with any privacy question or request.
Summary
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Technical request data (IP address, browser, page requested) | Serving the site and keeping it secure | Legitimate interests | A short period in hosting logs |
| Anonymous performance measurements | Keeping pages fast | Legitimate interests | Aggregated; not linked to you |
| Google Analytics data | Understanding which pages and plants are useful | Your consent | 14 months |
| Newsletter subscription (email address and sign-up details) | Sending The Care Window | Your consent | Until you unsubscribe |
| Emails you send us | Replying to you | Legitimate interests | As long as the conversation needs, then up to 2 years |
What we collect and why
When you browse the site
Hosting and security. The site runs on Vercel. Every request your browser makes includes technical information: your IP address, browser and operating system, the page you asked for, the referring page and the time. Vercel processes this to deliver the page and to protect the site against abuse, and keeps it in short-lived logs. Our legal basis is our legitimate interest in running a working, secure website (GDPR Art. 6(1)(f)).
Performance measurement. We use Vercel Speed Insights to measure how quickly pages load (Core Web Vitals). It records page timings together with the page path, device type, browser and country. It does not use cookies and does not identify you. Our legal basis is our legitimate interest in a fast site.
Analytics, with your consent. If you accept analytics cookies in the banner, we use Google Analytics 4, loaded through Google Tag Manager. It tells us which pages people visit, how they arrived, and how they use features such as the terrarium planner (for example, which theme and vessel size was picked, or which plant card was opened). Google Analytics sets cookies to recognise repeat visits and collects device, browser and approximate location data (country or city, derived from your IP address). Google Analytics 4 does not log or store IP addresses. We do not use Google Analytics for advertising, have not enabled Google signals, and do not link it to any advertising product. Our legal basis is your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time from Privacy preferences in the site footer.
If you decline analytics. We use Google Consent Mode. When analytics cookies are declined, the Google tag still loads but sets no analytics cookies and sends no identifiers. It sends basic signals instead, such as that a page was viewed or an action was taken. Google uses these, without identifying you, to estimate overall usage. Your browser's request to Google still reveals your IP address to Google, as any request to a server does.
Your cookie choice. We store your banner choice in a small cookie so we don't ask again on every page. See the cookie policy for the full list.
Things we don't do. The fonts and images on the site come from our own hosting, not third-party font or image services. There are no advertising trackers, social media pixels or embedded social feeds. Links to Instagram are plain links: Instagram receives nothing from us unless you click through.
When you subscribe to The Care Window
The newsletter is sent through Buttondown. When you subscribe, we pass Buttondown:
- your email address;
- the IP address your sign-up came from, which Buttondown uses to spot spam and fake sign-ups and to estimate your country;
- which sign-up form you used (for example the home page or a journal article);
- if you subscribed from the terrarium planner to receive your plant list, the planner page address, which encodes the plants and settings you picked.
Every sign-up is confirmed by email (double opt-in): nothing is sent until you click the link in the confirmation email. Buttondown screens new sign-ups for signs of abuse. Some are held for us to review by hand before the confirmation goes out, and some (such as disposable email addresses) are refused.
Buttondown records whether each issue is opened and which links are clicked, so we can see which kinds of content readers find useful.
Our legal basis is your consent (GDPR Art. 6(1)(a)). Each email has a one-click unsubscribe link. When you unsubscribe, Buttondown keeps your address marked as unsubscribed so you are never emailed again by mistake. If you'd rather it be deleted completely, write to us.
When you email us
If you write to us, we use your email address and what you send us to reply. Our legal basis is our legitimate interest in answering you. We delete the correspondence when it is no longer needed, and at the latest two years after the conversation ends.
Who we share it with
We don't sell your personal data, and we don't share it with anyone for advertising. It is processed for us by these service providers, each under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting, security logs, performance measurement | United States, with a global edge network |
| Google Ireland Limited / Google LLC | Analytics (only with your consent) | EU and United States |
| Buttondown, LLC | Newsletter sign-up and delivery | United States |
| Private Email | Our email inbox | United States |
We may also disclose data where the law requires it, or to protect our rights in a legal dispute.
Transfers outside the UK and EEA
Some of these providers are based in the United States. Where they are certified under the EU–US Data Privacy Framework (and its UK extension), transfers rely on that framework. Otherwise, they rely on the European Commission's Standard Contractual Clauses and the UK addendum, built into each provider's data processing terms. You can ask us for a copy of the relevant safeguards.
Your rights
If you are in the UK, the EEA or Switzerland, you have the right to:
- access the personal data we hold about you and get a copy;
- correct it if it is wrong;
- delete it;
- restrict how we use it;
- receive it in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting anything done before you withdrew. For analytics, use Privacy preferences in the footer. For the newsletter, use the unsubscribe link in any issue.
To use any of these rights, email privacy@verdarium.green. We will reply within one month. We may ask you to confirm you control the email address in question before acting on a request.
You also have the right to complain to a data protection authority. You can contact the authority where you live or work, or our lead authority: the UK Information Commissioner's Office (ico.org.uk). We would be grateful for the chance to sort it out with you first.
If you are in the United States
California (CalOPPA) and other states. The categories of personal information we collect, the purposes, and the third parties we share it with are described above. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act and similar state laws.
Your choices. You can ask to see, correct or delete your personal information by emailing privacy@verdarium.green. You can unsubscribe from the newsletter at any time and decline analytics cookies in Privacy preferences.
Do Not Track and Global Privacy Control. There is no agreed standard for the Do Not Track browser signal, and the site doesn't change its behaviour in response to it. Analytics cookies are only set if you accept them in the banner.
Children
Verdarium is a general-audience site and isn't directed at children. We don't knowingly collect personal information from children under 13, and the newsletter is for people aged 16 and over. If you think a child has signed up, contact us and we will delete the subscription.
Security
The site is served only over HTTPS, and access to the services we use is protected with strong, unique passwords and two-factor authentication. No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority where the law requires it.
Changes to this notice
We will update this notice when what we collect changes, for example when user accounts arrive. The date at the top shows when it last changed. If a change affects what you have consented to, we will ask again through the cookie banner or by email.