Where the bakery's data sits, and what we refuse to do with it

The application is served by Vercel from Sydney, and the database lives with Supabase in Sydney, with a backup taken every day. Members' details stay in Australia, except where a provider below handles a message in order to deliver it.

Card numbers never reach Daily Loaf. Paid plans start on a Stripe Checkout page, and changing the card in Billing uses a form hosted by Stripe. All Daily Loaf holds is the pointer to your Stripe customer record and where your subscription stands.

Vonage carries every text, from a customer's joining code to a Hearth campaign, and it is also where your Hearth number comes from. A text may travel through networks outside Australia on its way to a phone. A STOP reply returns the same way and is acted on the moment it lands.

Four kinds of email go through Postmark: your welcome email, your sign-in links, a member's address confirmation and each email campaign. To deliver one, Postmark may handle it outside Australia.

The proof that a member agreed is the code they typed on your join page, and their email stays unused until they click the link we send to it. Opt-outs are logged on the member's record as they happen. For a bakery on Free, the marketing consent is kept with the wording it saw, the moment it was ticked and the address it came from, and a withdrawal is kept in the same way.

We store a hash of your password, never the password itself, and it has to be at least ten characters. Signing in takes either that password or a link we email. Setting a new password signs out every other device and emails your confirmed address. Your password never travels by email from us, not even on the morning you forget it.

It never lets you add a member by hand, and it never texts a number that did not confirm a code. It never shows one bakery another's members, never sells or shares member details for marketing, and never touches your listing on Bakebound.

If you find a security problem, write to hello@bakebound.com.au with what you saw. Someone reads it and answers within one business day, Melbourne time; we would far sooner hear about it from you than from anyone else.