Get in touchContact

Privacy Policy

Effective date: October 28, 2026.

Who we are: Coachella Gardening LLC, a California limited liability company doing business as Coachella Gardening, 78680 Highway 111 #1050, La Quinta, CA 92253-2048, [email protected]. The practice is run by its sole member, Karen A. Gilbert. The Site and its systems are administered for the LLC by Kenneth J. Gilbert. No one else has access to your information.

This policy explains what personal information we collect through https://coachellagardening.com and in delivering our services, why we collect it, who helps us process it, how long we keep it, and the choices you have. We are a solo consulting practice in California. We do not sell personal information and we do not share it for cross-context behavioral advertising.

Information we collect

We collect only what each activity needs. Nothing beyond the standard server request data described first below is collected just for visiting a page.

  • Browsing the Site: standard server request data (IP address, browser type, pages requested, timestamps) in short-lived logs, and your cookie choice, kept in your own browser. Used for security, keeping the Site running and remembering your analytics choice.
  • Accepting analytics cookies: Google Analytics 4 usage data (pages viewed, approximate region, device type, a random client identifier), only after you choose Accept (see "Cookies"). Used to understand which pages help people.
  • Visiting a page with a form (every page carries the newsletter form in its footer): Cloudflare's Turnstile bot check loads with the page and runs when you submit. It may process your IP address and browser signals; we never see those signals. Used to block spam and automated abuse.
  • Booking a Quick Consult: your name and email address, the session you chose and its time, the price you agreed to, the PayPal order and payment references, and a booking reference. Used to schedule, confirm and deliver the session and to reconcile payment.
  • Paying: PayPal processes the payment. We receive the payer name and email PayPal provides and a transaction record; we never receive your card or bank details. Used for payment, refunds, disputes and tax records.
  • Requesting a service or workshop: your name, email and phone number; your address (garden services) or city or ZIP (workshops); the service tier and preferred date; what you grow, garden size and sun exposure; your questions and notes; up to six garden photos (Seasonal Plant Turn Over); for workshops the head count, date preferences and experience level; and whether you are interested in planting help. Used to reply, schedule, invoice and prepare for your visit.
  • Completing the intake form after booking: your questions and notes (Quick Consult), or your property address, goals, budget band, problem descriptions, HOA or community name, a permit-screening answer, and photographs of your garden. Used to prepare for your session and your deliverable.
  • Receiving a deliverable: the PDF we prepared for you and a private access token tied to your booking.
  • Booking by email or phone (the accessible fallback, our manual booking page): your name, email and the note you send, then the same booking record as above once confirmed.
  • Contacting us: your name, email address and message. Used to reply.
  • Subscribing to the newsletter: your email address, your confirmation, and delivery and unsubscribe events. Used to send the newsletter you asked for.
  • Leaving a review: this happens on Google's platform under Google's terms; we see what Google shows publicly and store it ourselves only if you later consent in writing to our quoting it.
  • Joining a workshop as a participant (not the host): normally nothing, since the host books for the group. If you give us your email for a care guide or the newsletter, only that.
  • Hiring us for a small planting job: the job summary, your address and the invoice. Used to do the job and keep sales-tax records.

We ask that you not include Social Security numbers, financial account numbers, health information, information about other people, or precise geolocation in free-text fields or photos. We do not knowingly collect sensitive personal information as California law defines it, and we never use personal information to infer characteristics about you.

Photo and file handling

Photographs you upload through the intake form or a service-request form have location (GPS) and other identifying metadata removed when they arrive, before anyone looks at them. If a photo's location data cannot be removed, we delete that photo rather than keep it, and we tell you how to send it again. We store the image content itself to prepare your deliverable.

Photos we take during a visit are taken on the Consultant's secured phone, which backs up to Google Photos. They are used only to prepare your deliverable and are deleted from the phone and the backup when your engagement is complete, unless you have signed our consent form allowing us to publish them; in that case the chosen images are copied to our website's media storage (where location metadata is stripped on upload) and the rest are deleted.

How we use your information

  • To schedule, deliver and follow up on the service you booked, including preparing and delivering your deliverable.
  • To take and reconcile payment through PayPal, issue invoices and refunds, respond to payment disputes, and keep tax and accounting records.
  • To send transactional email about your engagement: booking confirmation, reschedule confirmation, an intake reminder about 48 hours before your session, your deliverable, payment notices, and one request for a review after your session.
  • To send the newsletter if you subscribed (double opt-in; unsubscribe any time).
  • To respond to your messages and privacy requests.
  • To keep the Site secure, prevent abuse, and comply with the law.

We never use your information for cross-context behavioral advertising, profiling, or automated decisions with legal effects.

Cookies

Apart from the functional storage the Site needs to work (your cookie choice, a form draft, a chosen tab, and the security tokens Cloudflare's bot check sets on a form page), the only cookies we set are Google Analytics 4 cookies, and we set them only after you choose Accept on our cookie notice.

  • Analytics cookies are set only after you accept. Before you choose, and if you decline, none are set and no analytics script loads.
  • A Global Privacy Control (GPC) signal counts as a refusal. We do not ask again and do not load analytics, even if you accepted earlier.
  • Your choice is remembered for 12 months in your own browser, then we ask again. We also ask again if the wording or the analytics vendor changes.
  • You can change your mind at any time with "Cookie settings" in the site footer. Withdrawing consent stops analytics immediately and deletes the analytics cookies.
  • The notice never appears on booking-confirmation, intake or deliverable pages, which load no analytics at all.

Analytics and Global Privacy Control

We use Google Analytics 4 for first-party page analytics only, with advertising and ad-personalization signals turned off: Google Signals is off, data sharing with Google is set to the minimum, there are no Google Ads links, and event data is retained by Google for two months. Analytics runs only after you choose Accept on our cookie notice; until then the analytics script does not load and no analytics cookies are set. Google receives the analytics data as our service provider under Google's data-processing terms. Because we do not sell or share personal information, a Global Privacy Control signal has nothing to opt you out of beyond analytics; we honor it anyway, as described under "Cookies". Google describes how it handles this data at google.com/policies/privacy/partners. No other party collects information about your activity across different websites when you use our Site, except that if you choose to play an embedded YouTube video, Google receives the request described under "Video embeds".

Video embeds

Where we embed a YouTube video, it uses YouTube's privacy-enhanced mode (youtube-nocookie.com) and loads only after you click play. Until you click, no request is made to Google, and a notice beside the play button says that playing sends your IP address and device information to Google. If your browser sends a Global Privacy Control signal, we do not embed the video at all; you get a link to watch it on YouTube instead.

Who helps us process your information

We share personal information only with service providers that help us run the practice, each limited to its purpose:

  • PayPal, Inc.: payment processing, invoicing, refunds and disputes. Receives the payer name and email, the amount and the booking reference.
  • Cal.com, Inc.: appointment scheduling for the Quick Consult and the calendar for every session. Receives your name and email, the session time and the booking reference.
  • Zoom Video Communications, Inc.: the video call for a Quick Consult or virtual consult. Calls are not recorded. Receives your name and email for the meeting invitation, and whatever you share on the call.
  • Brevo (Sendinblue SAS): sends our transactional email and the newsletter and reports bounces and complaints. Receives your email address and the content of the messages we send you.
  • DigitalOcean, LLC: hosts the Site and database and provides private object storage for uploaded photos, deliverables and backups, in its San Francisco (United States) region. Holds everything listed above, encrypted in transit.
  • Cloudflare, Inc.: content delivery, security, bot protection on forms, and routing of email sent to [email protected]. Sees request data as traffic passes through, and the email you send us.
  • Google LLC: Google Analytics 4 (only after you accept); our Google Business Profile for reviews; YouTube for embedded video; the mailbox that receives mail sent to [email protected]; and Google Photos, which backs up the Consultant's phone. Receives analytics data if you accept, the content of email you send us, and photos of your garden taken during a visit until your engagement is complete.
  • GitHub, Inc.: runs the scheduled jobs that back up our database and export our PayPal and Cal.com records to our private storage. Has transient access to those records while a job runs; nothing is stored on GitHub.

We may also disclose information if required by law or legal process, to enforce our Terms, to protect someone's safety, or in connection with a transfer of the practice (in which case this policy continues to apply). We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not use third-party advertising or cross-site trackers.

How long we keep information

Retention is enforced by scheduled jobs on the Site, not by hand. Where the law requires a record for longer, we limit its use to that purpose.

  • Intake materials (address, photos, goals, budget, notes) and the deliverables we prepared for you, including their access links: kept 24 months after your session, then deleted, rows and files.
  • Photos we took during your visit (phone and Google Photos backup): kept until your engagement is complete, then deleted unless you consented to publication.
  • Booking contact details (name, email, phone, notes, city): kept 24 months after your session, then removed from the booking record.
  • Booking payment records (amounts, PayPal and Cal.com reference ids, timestamps): kept 7 years for tax and accounting, then the record is deleted.
  • Service and workshop requests, including photos: kept 24 months after you sent them, then deleted. A request that led to a paid invoice keeps its amount and invoice reference for 7 years, with the personal fields anonymized at 24 months.
  • Contact and support messages: retained only as long as needed to respond and keep a reasonable record, and no longer than 24 months, then deleted.
  • Newsletter subscription: kept until you unsubscribe, then marked unsubscribed and kept only as a suppression record so the address can never be re-added to the list by mistake.
  • Cookie choice: 12 months, in your browser, then we ask again.
  • Server request logs: kept only until they rotate, typically days to a few weeks, then overwritten; never used for profiling.
  • Database backups: 30 days, expired automatically.
  • Weekly exports of PayPal and Cal.com records (our own books): 7 years, the same as the payment records they duplicate.
  • Payment-dispute records: until the dispute is closed, then as payment records above.

A deletion request (below) runs these steps early, with the legal exceptions noted there.

Security

Uploaded photos and deliverables live in private object storage, not on the web server, and are reached only through unguessable, expiring links: an intake link works until 14 days after your session, a deliverable link for 12 months after it. Traffic to and from the Site is encrypted (TLS). Access to your information is limited to the Consultant, Karen A. Gilbert, the LLC's sole member, and to Kenneth J. Gilbert, who administers the Site and its systems for the LLC; no one else. Our software never writes the content of your messages, photos or intake answers to its logs; a log may record an email address when a message we sent you bounces, and the IP address of a request that was rate-limited. No method of storage or transmission is perfectly secure, but we take measures appropriate to a practice of this size, and we will notify you as California law requires if a breach affects your information.

Your California privacy rights (CCPA/CPRA)

The California Consumer Privacy Act applies to businesses above certain size thresholds, which we do not meet. We honor its rights anyway. If you are a California resident, you can ask us to:

  • Know and access the categories and specific pieces of personal information we hold about you, where it came from, why we have it, and who we shared it with.
  • Delete personal information we hold about you, subject to the exceptions below.
  • Correct inaccurate personal information.
  • Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but you may still ask and we will confirm it in writing.
  • Limit the use of sensitive personal information. We do not use any to infer characteristics about you, and we will confirm that too.
  • Not be discriminated against for exercising any of these rights.

How to make a request. Use our Contact page, email [email protected], or call (909) 375-4825. Tell us what you want (a copy, a deletion, a correction) and the email address you used with us. How we verify you: we confirm that you control the email address on our records, usually by replying to it; if you contact us another way we match that address plus one more detail of your engagement, such as the session date or the city of the property. An authorized agent may make a request for you with your written authorization and their own verification; we may also confirm directly with you. Timing: we acknowledge promptly and respond within 45 days of receiving your request; if we need longer we tell you why within that time and take up to another 45 days. Requests are free; we may decline or charge a reasonable fee for requests that are manifestly unfounded or repetitive.

What deletion cannot remove. Payment records are kept 7 years for tax purposes. If a payment dispute or a problem with your booking is open, we keep your contact details until it is resolved. If you have a session coming up, we keep your contact details until it has happened so that we can reach you. Consent records for published testimonials or photos are revoked and the content removed, but the record of the consent itself is kept as evidence. Copies held by PayPal, Cal.com, Brevo, Google and our other providers are handled under their own policies; we will tell you how to reach each of them, and we delete or anonymize what we can in their systems.

Children

The Site and our services are for adults and are not directed to children under 16. We do not knowingly collect personal information from children. Workshop participants under 18 attend with a parent or guardian present, and we collect no information about them. If you believe a child has given us information, contact us and we will delete it.

Marketing email

Our newsletter uses double opt-in: you confirm your address before you are added. Every newsletter carries a working one-click unsubscribe link and our postal address, and we honor opt-outs immediately. Transactional messages about a service you booked are separate from the newsletter and are not marketing. We do not send marketing text messages.

Do Not Track and Global Privacy Control

We honor the Global Privacy Control signal as described under "Cookies". We do not respond separately to a browser's older "Do Not Track" header, because our analytics already load only with your consent.

Accessibility

We aim to meet WCAG 2.1 AA. Booking and payment use third-party services (Cal.com for scheduling, PayPal for checkout) whose accessibility we do not fully control; an alternative booking route by email or phone is always available on our manual booking page. To report an accessibility barrier, use the Contact page or see our Accessibility Statement.

Changes to this policy

We may update this policy from time to time. The date at the top shows the current version, and material changes are noted on the Site. If a change would let us use information you already gave us in a materially different way, we will ask you first.

Contact and data-subject requests

Questions about this policy, or a privacy request? Reach us through our Contact page, by email at [email protected], by phone at (909) 375-4825, or by mail at 78680 Highway 111 #1050, La Quinta, CA 92253-2048.