Privacy PolicyPrivacy Policy

Nina Atelier is a one-person atelier making bespoke celebration cakes across Washington, D.C., Maryland and Virginia. The business behind it is Nina Atelier, based in Virginia. We are responsible for the personal information described here.

Questions about your information go to hello@byninaatelier.com. You will hear back from the person who makes the cakes.

When you request a commission

The occasion, date, guest count and the venue or delivery address; your name, email and phone number; any allergies and dietary needs; your notes; and the design you made in the studio, with its description and estimate.

Why: to review and price your design, to make and deliver the cake, and to write to you about it. This is the information the commission cannot go ahead without.

When you accept our terms

The version of the terms you accepted, the time, your IP address and the description your browser gives of itself (its user agent).

Why: as a record that you agreed to the terms, should a payment ever be disputed.

When you pay

Stripe tells us that a payment was made, for how much, and gives us its reference for it. We keep a record of each payment and refund. We never receive your full card number. More on this under Payments.

Why: to know where your commission stands, to make refunds, and to keep the accounts and tax records the law requires.

When you send an enquiry

Your name, email and phone number; the event date, occasion, guest count, venue and budget you give; your message; the page, piece or design you wrote from; how you found us (see below); and your IP address and user agent.

Why: to answer you by email, and to protect the form from abuse.

How you found us

When you arrive from a link, your browser keeps a small note for up to 90 days: the campaign tags on that link, the advertising platform’s click reference, the page you landed on, the site that sent you and the day. It holds nothing you type into a form. If you send an enquiry or a request, the note travels with it. If your browser sends Global Privacy Control, the click reference is not kept.

Why: to learn which of our advertisements, posts and searches bring people to us.

Our emails to you

We keep a timeline of your commission (what happened, and when) and the messages we exchange.

Why: so both of us can see where things stand.

What you tell us about allergies and dietary needs can say something about someone’s health, so we handle it with particular care. We use it only to make your cake safely. Only the atelier sees it. It is never used for advertising, and it is never sent to an advertising platform.

Please share only what we need to make the cake: the allergy or need, not the medical history behind it.

Every payment is taken by Stripe on its own secure checkout page, which it hosts. Your card details go straight to Stripe and never pass through our site, and we never see your full card number. Stripe handles payment information under its own privacy policy, including to prevent fraud.

Our forms use Cloudflare Turnstile to tell people from automated software, usually without a puzzle. It looks at signals from your browser. Cloudflare processes them under its privacy policy; we receive only a pass or a fail.

We also count how often a form is sent from one connection, using a one-way scrambled form of the IP address rather than the address itself, and delete those counts after about 24 hours.

We set one small cookie of our own, and only after a payment (the last item below). On your device, our site keeps only:

• your advertising choice, if you make one (see below), until you clear this browser’s site data;
• the note of how you found us, for up to 90 days;
• a note, for the current tab only, that you have begun shaping a design in the studio, so that it is counted once;
• for 10 minutes after you pay a request deposit, a cookie that holds only your commission reference, so that the confirmation page counts the payment once, and only in your browser. It is not set if your browser sends Global Privacy Control. Once the payment is counted, a note for the current tab records it.

Cloudflare, which runs and protects the site, may use strictly necessary cookies or similar signals for security. The advertising code described in the next section uses cookies of its own when it loads.

We are a small studio, and we would rather make cakes than chase anyone around the internet. Still, we do advertise, and we want to be plain about what that involves.

What we use

When you visit byninaatelier.com, we may load small pieces of code from the companies we advertise with, or may advertise with: Meta (Facebook and Instagram), Google (Google Ads and Google Analytics), TikTok and Pinterest. Only those we are advertising with at the time load at all. These are often called pixels or tags. They use cookies and similar technologies, set by us and by them, to recognize a browser over time.

What they collect

The pages you view, the time of your visit, the page that sent you here, your browser and device type, your approximate location as inferred from your IP address, cookie and advertising identifiers, and a few moments we choose to count: opening a portfolio piece, shaping a cake in the design studio, sending an enquiry and placing a deposit. With those moments we may share an estimated value and a random reference number.

We do not send your name, email address, phone number, event date or the details of your enquiry to these companies, and we have switched off the features that would read them from our forms.

Why

To learn which of our advertisements actually bring people to us, so that we spend less and bother fewer people, and to show our work to people who have visited us before or who resemble those who have. Under some state privacy laws, this is called targeted advertising, and sharing data this way may be treated as a sale. The companies above also use what they receive under their own privacy policies, including to serve and measure ads on other sites and apps.

Where we never use them

We do not load advertising code on our private studio pages, on the order and payment pages we send you, or on our servers’ own addresses. Those pages may carry private links, and they stay between us.

Your choices

• Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out, and we do not load any of this advertising code for you. A request or enquiry sent with the signal on is never reported to an advertising platform.
• On our site. Choose “Do not use my information for advertising” here. We will remember your choice in this browser until you clear its stored site data.
• With each company.
  • Meta: in Facebook or Instagram, open Accounts Center, then Ad preferences, and review the activity information from ad partners.
  • Google: visit myadcenter.google.com (Ads Settings). To stop Google Analytics in your browser, use tools.google.com/dlpage/gaoptout.
  • TikTok: in the app, open Settings and privacy, then Ads.
  • Pinterest: open Settings, then Privacy and data, and turn off ads personalization based on activity from other sites.
• Industry tools. optout.aboutads.info and optout.networkadvertising.org let you opt out of many advertisers at once.
• You can also clear or block cookies in your browser. The site will still work.

Children and advertising

Our site is meant for adults planning celebrations. We aim our advertising at people aged 21 and over, and we do not knowingly use information from anyone under 18 for advertising.

We never sell your personal information for money. We share it only with the few companies that help us run the atelier, each for its own part of the work:

• Stripe takes payments and makes refunds.
• Cloudflare hosts the site and its database, protects the forms, and guards the atelier’s private studio pages.
• Resend delivers the emails we send you from hello@byninaatelier.com.
• Advertising platforms receive only what the advertising section describes, and nothing when you have opted out.

Beyond them, we share information only when we must: with our accountant or attorney, with a card issuer if you dispute a payment, or when the law requires it. These companies may process information in the United States and in other countries where they operate.

• Requests that are never paid are deleted after 30 days.
• Commissions and their payment records, including the record of your acceptance of the terms, are kept for tax and accounting for 7 years. After that, the personal details of a finished commission are erased and only the anonymous figures remain. The IP address and browser details recorded when you accepted the terms are cleared 540 days after your event.
• Enquiries are kept for about 2 years, unless they become a commission. The IP address and browser details kept with an enquiry, only to protect the form from abuse, are cleared after 90 days.
• Form counters are deleted after about 24 hours.
• Stripe and our other providers keep their own records for as long as their policies and the law require.

The site is served only over an encrypted connection. Card details are handled by Stripe and never reach us. Each commission page sits behind a long, private link that cannot be guessed, and we can replace it, so that the old one stops working, if you think it has been shared. Our own studio pages are behind Cloudflare Access, and only the atelier can sign in. We never put your details into web addresses or analytics.

No system is perfectly secure. If we ever learn of a breach that affects your information, we will tell you as the law requires.

Write to hello@byninaatelier.com and you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it;
• stop using it for advertising.

We reply personally, usually within two business days, and complete requests within 45 days. To protect you, we may confirm a request through the email address we already have for you. We may need to keep some records, such as payment records, for as long as tax law requires; we will tell you if so. Using these rights never changes the price or the care of your commission.

We honor Global Privacy Control. If your browser sends it, we treat it as a request to opt out of advertising and of any sale or sharing of your information, as described in the advertising section.

If we decline a request and you disagree, tell us and we will look at it again. If you are still not satisfied, you may contact the attorney general of the state where you live.

Some browsers send a “Do Not Track” signal. There is no common standard for what it should mean, so our site does not respond to it differently. We do respond to Global Privacy Control, which is designed for exactly this choice: with it on, no advertising code loads for you.

Our site is not directed at children under 13, and we do not knowingly collect their information. Commissions are made only by people 18 or older. If you believe a child has sent us information, write to us and we will delete it.

When we change this policy, we update the date at the top of this page. If a change affects how we use information we already hold, we will tell you by email before it applies to you.

Nina Atelier, Virginia.

Email hello@byninaatelier.com. Our Terms of Commission explain how a commission works.

This policy was last updated on October 17, 2026.