Privacy

Last updated September 2026

Carlsbad Sourdough is a two-person home bakery in Carlsbad, New Mexico, operated by Nupik Wenpach LLC. We bake a small batch of bread each week and sell it for local pickup. This page says what we collect when you order, why we hold it, and what we never do with it.

What we collect

• Your mobile number. Required. It is how we identify you between orders, and how we send the code that proves the number is yours.
• Your name. Required, so we can label your bag and call your name at pickup.
• Your email address. Optional. Plenty of customers never give one.
• Your orders. What you bought, when, what it came to, and any note you left about collecting it.
• Your texting choice. Whether you asked to be texted when a drop opens, the moment you chose, and where the choice was made. We keep this so we can show that a message we sent you was one you asked for.
• A visit count. A random identifier in your browser, the day, and the referring site — never the full address you came from, which can carry what you searched for. It tells us whether an Instagram post brought anybody. It is not tied to your name or your number.
• How you use the site. Page views, clicks, and a replay of what happened on the page while you browsed — never what you typed, which a screen replay would ordinarily show and ours is set not to, and never your name or your number even on the pages that show them to you. Off entirely on the dashboard we run the bakery from.

What we never do

We do not sell, rent, or share your mobile number or your consent to be texted with anyone, for any purpose. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. We do not buy phone numbers, and we do not text a number unless we hold a record of that person asking us to.

We use PostHog, a product analytics tool, to see how the site gets used — never to advertise to you, never to track you across other sites, and never on the dashboard we run the bakery from. It never receives your name or your number: every place this page shows them to you is hidden from what it records. Nobody pays us for access to how you use this site, and nobody is going to.

Who can see it

The two of us who run the bakery, and the companies that host the site and carry the texts — a hosting provider for the site and its database, and a messaging provider that delivers the messages. They handle the data only to provide that service. The analytics tool above sees how the site gets used and nothing more. Bakery accounts are protected by a code texted to a known number.

Texting

Two different things arrive by text. A sign-in code goes to anyone placing an order, because it is how we prove the number belongs to you; it is part of ordering and is not marketing. A drop notice — that ordering has opened, or that your order is ready to collect — goes only to people who ticked the box asking for it. We bake once a week, so expect roughly one to three messages in a week, and none at all in a week we do not bake.

Reply STOP to any message to stop them. Reply HELP for help. Message and data rates may apply. Stopping the texts does not stop you ordering; you can still order on the site.

How long we keep it

Your customer record and order history stay while you are a customer, because your standing in the shop is worked out from what you have ordered. Sign-in codes are stored only as a one-way hash, never as digits anyone could read, and expire in ten minutes. Ask us and we will delete your record.

Reaching us

Message the number that texts you, call (575) 909-1701, or reach us through www.carlsbadsourdough.com. Ask us to show you what we hold, correct it, or delete it, and we will.