This notice describes the configuration reviewed for Toadstool & Tonic at toadstoolandtonic.com on October 8, 2026. Questions and privacy requests can be sent to [email protected].
Information collected by store features
WordPress and WooCommerce operate this store. Account registration and guest checkout are enabled. If you use these features, the store receives the account, contact, billing, shipping and order information you provide. This information supports account access, orders, delivery and customer support.
The support form asks for your name, email address, topic, optional order number and message. It sends these details through WordPress’s mail function. To limit repeated submissions, the form uses keyed hashes of the submitting IP address and email address with counters that expire after 15 minutes. Expired transient records may remain until database cleanup. A form submission is not proof of mailbox delivery.
The age gate records a browser confirmation that you selected “21 or older”; it does not ask for your date of birth or an identity document. This browser flag is not an identity verification record.
Configured providers and external links
The site is hosted on WP Engine and its responses pass through Cloudflare’s delivery and security services. Loading the site sends network and request information, including an IP address, browser information and requested URLs, to these services. WordPress, WooCommerce and Rank Math provide the store and search-metadata functions visible on the site.
No payment gateway is currently enabled in the reviewed WooCommerce configuration. This notice does not identify an active card-payment processor. Payment-provider details must be added when a provider is configured.
Support messages use WordPress mail. The owner identifies Gmail (Google) as the receiving support-mailbox provider; the outbound mail relay, account type, routing and mailbox retention have not yet been confirmed. Product-reference pages and lab PDFs link to external manufacturer, retailer and document-hosting sites. Following those links sends a request to the destination, whose privacy terms apply there.
Cookies and browser storage
- Age confirmation: the
everspores_age_verifiedcookie lasts 30 days. Theeverspores_age_verified_until_v2local-storage entry holds a 30-day expiry timestamp; an expired entry is removed when the site checks it again. The legacy technical names do not identify a separate company. - Order attribution: WooCommerce order attribution is enabled. Its Sourcebuster
sbjs_*cookies record information such as referring and entry pages, campaign parameters, session page counts and browser information. The configured session duration is 30 minutes; other attribution cookies are session scoped. When an order is submitted, attribution fields can be saved with the order. This feature is separate from WooCommerce usage sharing, which is currently disabled. - Cart and account features: WooCommerce can use
woocommerce_cart_hash,woocommerce_items_in_cartandwp_woocommerce_session_*cookies when a cart/session is created. WordPress uses cookies for sign-in and authentication when those features are used. Exact configured cart and account retention periods remain under review. - Cloudflare security: the reviewed site response sets
__cf_bm, a bot-management cookie with a 30-minute expiry. Cloudflare may refresh it as you use the site. - Emoji support: WordPress can use the
wpEmojiSettingsSupportssession-storage entry to cache browser emoji-support checks. - Motion: the current forest animations read your browser/system reduced-motion preference. The reviewed theme does not save a separate motion-preference entry in browser storage.
You can inspect, block or clear cookies and storage in your browser. Blocking them can affect sign-in, carts or the age gate. The age decision is not consent to unrelated tracking. The review has not established the audience jurisdictions or any additional consent requirements; the owner must resolve those facts. No tracking setting or consent mechanism was changed during this review.
Retention and privacy requests
The age-check and support rate-limit durations are described above. Retention schedules for order and account records, support mail, hosting/security logs and backups have not yet been confirmed. This notice does not promise an unverified deletion schedule or claim that transaction records are retained for a particular legal period.
WooCommerce’s reviewed options to remove order/download data through personal-data erasure requests and to allow bulk removal of personal data are disabled. A request therefore must not be assumed to erase these records automatically.
Email [email protected] to request access, correction or deletion, or to ask about retention. Identify the type of request and the account or order it concerns. The owner’s identity-check, request-recording and fulfillment process remains to be confirmed; no automatic fulfillment or response deadline is promised here.
Facts awaiting owner confirmation
The owner has identified Gmail as the receiving mailbox provider. The owner must still confirm mailbox monitoring and outbound mail routing, who handles requests, applicable retention and deletion schedules, any shipping-provider data integrations, and the audience jurisdictions and resulting privacy requirements. This notice will need updating when those facts or configured providers change.
Configuration reviewed and notice updated October 8, 2026.