This Privacy Policy explains what personal data we collect when you use mychilligarden.com, why we collect it, who we share it with and what rights you have. We have tried to keep it short and in plain English.
Who we are
MyChilliGarden (mychilligarden.com) is run by My Chilli Garden, a small family business in Slovenia. We are the controller of the personal data described in this policy. If you have any questions about your data, email us at simon@mychilligarden.com or use our Contact page.
What data we collect and why
Below we explain each part of the site, the data involved and the legal basis we rely on under the General Data Protection Regulation (GDPR). The legal bases we use are your consent, the performance of a contract with you (for example providing your account), and our legitimate interests in running a safe and useful website.
Visiting the site
When you visit any page, our hosting servers automatically record technical information such as your IP address, browser type, the pages you request and the date and time. We use this to deliver the site, fix problems and protect it from abuse. Legal basis: legitimate interests.
To load images faster, Jetpack Site Accelerator serves our images through a content delivery network run by Automattic (addresses such as i0.wp.com). This means Automattic processes your IP address when images load. Legal basis: legitimate interests.
Jetpack Protect helps keep the site secure, for example by blocking suspicious login attempts. To do this it processes IP addresses and login attempt details. Legal basis: legitimate interests.
Comments
If you leave a comment, we collect the name, email address and website you enter, plus your IP address and browser user agent. Your name, website and comment are shown publicly. Your email address is never published.
WordPress may create a hashed (scrambled) version of your email address and send it to the Gravatar service, run by Automattic, to check whether you have a profile picture. If you do, it appears next to your comment. Legal basis: legitimate interests in running a friendly, open comment section.
My Garden accounts
Growers can register for a My Garden account to submit garden stories and manage Chilli Directory listings. For an account we store your username, email address, display name, a securely hashed version of your password, and any profile details you add, such as a short bio, your location and your growing season. Legal basis: contract, because we need this data to provide your account under our Terms and Conditions.
Garden stories
When you submit a garden story, we store the text and photos you send along with your account details. Every story is reviewed before it is published. Published stories are public and show your name as the grower. Legal basis: contract.
Application forms
Our forms “Apply for My Garden” and “Apply for Chilli Directory” ask for your name, email address and a message or listing details. We use this to review your application and reply to you. Legal basis: steps taken at your request before providing a service to you (contract).
Chilli Directory
The Chilli Directory is free. Listings are public and show the business name, location and any contact details the grower chooses to publish. Please only add details you are happy for anyone to see. Legal basis: contract.
Emails from the site
The site sends emails such as account approvals, notifications, form confirmations and (if you opt in) garden follow updates from noreply@mychilligarden.com.
Outgoing mail is sent through WP Mail SMTP using the site’s own mailbox. That mailbox is hosted with our hosting provider (Bluehost).
Legal basis: contract, or legitimate interests where the email simply confirms something you did; for garden follow updates, consent (see below).
Following a garden (email updates)
On a grower’s public garden page you can choose to follow that garden by email.
When you submit the form we store:
- your email address
- which grower (author) you asked to follow
- whether you also opted in to that grower’s other articles (recipes, chilli profiles, behind-the-scenes posts), if that option was shown
- a secure token used only for confirmation, preferences and unsubscribe links
- the time you subscribed and, after you confirm, the time you confirmed
Double opt-in. We email you a confirmation link first. We only send garden updates after you confirm. If you do not confirm within 7 days, we delete the pending subscription.
What you receive. By default we email you when that grower publishes a new public post in the Chilli Garden category. If you tick the optional checkbox (or turn it on later in preferences), we also email you when they publish other public posts. We do not email you when an already-published post is edited.
Unsubscribe. Every follow email includes a one-click unsubscribe link and a link to manage preferences. Unsubscribing deletes your follow record for that garden. You can also email us at simon@mychilligarden.com.
Legal basis: your consent. You can withdraw it at any time by unsubscribing.
We do not sell this data. We use it only to send the updates you asked for and to keep the feature working (for example rate-limiting abuse).
Contacting us
If you email us, we use your email address and message to reply. Legal basis: legitimate interests in answering your questions.
Analytics and statistics
With your consent, given through our cookie banner, we use Google Analytics and Google Tag Manager, added through Site Kit by Google, to understand how visitors use the site. These tools use cookies and process data such as your IP address, device details and the pages you view. You can change your choice at any time. See our Cookie Policy (EU) for details. Legal basis: consent.
We also use Jetpack Stats, run by Automattic, to count visits and see which pages are popular. We use this information in summary form only. Legal basis: legitimate interests.
Google Search Console shows us summary data about how the site appears in Google search results, such as search terms and clicks. It does not give us personal data about individual visitors.
Social media links
Our pages include icons that link to our profiles on X, Instagram, Facebook, Reddit and Pinterest. These are simple links. The social network only receives data about you if you click one and visit their site, where their own privacy policy applies.
We do not currently show ads on the site.
Cookies
We use Complianz to ask for your consent before setting cookies that are not strictly necessary. A full list of the cookies we use, and how to change your choices, is in our Cookie Policy (EU).
Who we share data with
We do not sell your personal data. We share it only with service providers that help us run the site, and only as far as they need it:
- Bluehost: hosting, server logs, and the SMTP mailbox used to send site email (noreply@mychilligarden.com).
- Automattic (Jetpack and Gravatar): site statistics, image delivery, security and profile pictures for comments.
- Google: Google Analytics, Google Tag Manager and Google Search Console, with analytics only used when you consent.
We may also share data if the law requires it, or to protect our rights, our users or the site.
International transfers
Google, Automattic and Bluehost may process personal data outside the European Union, including in the United States. Where this happens, the transfer is protected by appropriate safeguards, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep data
- Comments: kept indefinitely so conversations stay readable, unless you ask us to delete them.
- My Garden accounts and profile details: kept until you delete your account or ask us to delete it.
- Garden stories and directory listings: kept while they are published, or until you ask us to remove them.
- Form submissions and emails: kept for up to 2 years, then deleted.
- Analytics data: kept for the period set in our analytics settings.
- Server logs: kept for a limited period by our hosting provider for security and troubleshooting.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting processing done before you withdrew it.
To use any of these rights, email simon@mychilligarden.com or use our Contact page. We may need to confirm your identity first, and we will reply within one month. You can also change your cookie choices at any time through the cookie banner.
If you think we have not handled your data properly, you can complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), www.ip-rs.si, or to the data protection authority in your own country. We would appreciate the chance to sort things out with you first.
Children
MyChilliGarden is not directed at children under 16. You must be at least 16 years old to create a My Garden account. If you believe a child under 16 has given us personal data, please contact us and we will delete it.
Security
We take reasonable steps to protect your data, including secure HTTPS connections, hashed passwords and security tools such as Jetpack Protect. No website can be completely secure, so please use a strong, unique password for your account.
Changes to this policy
We may update this policy when the site or the law changes. The latest version will always be on this page with the date it was last updated.
Last updated: 29 October 2026