Last updated: October 13, 2026
Who we are
High Water Bonsai LLC is a bonsai nursery in San Antonio, Texas, run by H. Drew Galloway and Martin Martinez. Our website address is https://highwaterbonsai.com. Our main nursery is located at 9106 Harbor View St, San Antonio, TX.
This policy explains what information we collect when you visit our site, buy from us, sign up for a workshop, or join our newsletter, and what we do with it. The short version: we collect what we need to fill your order and stay in touch, and we don’t sell your information to anyone.
What we collect and why
When you place an order. We collect your name, email, phone number, billing address, and shipping address. We use this information to process your order, ship it, send confirmations and tracking updates, and contact you if something goes wrong. If you create an account, we also keep your order history so you can look it up later.
When you pay. Payments are handled by Square. Your card number goes directly to Square and never touches our servers, and we never see or store your full card details. Square’s privacy policy is available at https://squareup.com/us/en/legal/general/privacy.
When you register for a workshop. We collect your name, email, and phone number. We use them to confirm your seat, send reminders, and let you know about schedule changes.
When you join our newsletter. We collect your email address and, if you give it to us, your name. We use them to send news about new trees, workshops, and nursery events. Every email includes an unsubscribe link. Our newsletter is sent through MailPoet, which stores your address on our behalf.
When you contact us. If you email us or use a contact form, we keep the message and your contact information so we can respond.
When you leave a comment. If you comment on a post, we collect what you enter in the comment form, along with your IP address and browser information to help catch spam. A scrambled version of your email address (called a hash) may be sent to Gravatar to check whether you have a profile picture there. Gravatar’s privacy policy is available at https://automattic.com/privacy/. Once your comment is approved, it is public, along with your name and profile picture.
Media
If you upload images to the site, remove any embedded location data (EXIF GPS) first. Anyone who visits the site can download images and pull location data out of them.
Cookies
Cookies are small files your browser stores. We use them to keep the site working.
- Shopping cart cookies remember what’s in your cart while you shop. They expire when your session ends or shortly after.
- Account cookies keep you logged in. They last two days, or two weeks if you check “Remember Me.” Logging out removes them.
- Comment cookies are optional. If you choose to save your name, email, and website for your next comment, those cookies last one year.
- Analytics cookies help us understand which pages people visit so we can improve the site. We use Google Analytics for this.
You can block or delete cookies in your browser settings. If you do, the cart and checkout may not work.
Embedded content from other websites
Some pages may include embedded content from other sites, like Instagram posts or YouTube videos. That content behaves exactly as it would if you visited the other site directly. Those sites may collect data about you, use cookies, and track how you interact with the embedded content, especially if you’re logged in to an account with them.
Who we share your information with
We share your information only as needed to run the business:
- Square, to process payments and keep our in-person and online sales records in sync
- Shipping carriers — specifically USPS, UPS, and FedEx — to deliver your order
- MailPoet, to send email you’ve signed up for
- Our web host, WordPress, which store and protect site data on our behalf
We may also disclose information if required by law, or if needed to protect our rights or prevent fraud.
We do not sell, rent, or trade your personal information.
How long we keep your information
- Order records are kept as long as we need them for taxes, accounting, and warranty or return questions. That’s generally up to seven years.
- Account information is kept until you ask us to delete your account.
- Newsletter addresses are kept until you unsubscribe.
- Comments and their details are kept indefinitely, so we can recognize returning commenters and approve their comments without holding them for review.
If you register an account, you can see, edit, or delete your personal information at any time, except your username. Site administrators can also see and edit that information.
Your choices and rights
You can ask us to:
- Send you a copy of the personal information we hold about you
- Correct anything that’s wrong
- Delete your information
To make any of these requests, email drew@highwaterbonsai.com. We’ll respond within 30 days. We may need to keep some records even after a deletion request, such as order and tax records we’re legally required to retain.
Security
The site uses an encrypted connection (HTTPS), and payment details are handled by Square rather than stored by us. No website is perfectly secure, but we limit access to your information to the people who need it to run the nursery.
Children
Our site isn’t directed at children under 13, and we don’t knowingly collect their personal information. If you believe a child has given us information, contact us, and we’ll delete it.
Changes to this policy
If we update this policy, we’ll post the new version here with a new “last updated” date.
Contact us
High Water Bonsai LLC
drew@highwaterbonsai.com