Privacy & browser storage

01 — Responsible business and scope

The owner has identified the business operating GENATSVALE as Like a King Inc. Its exact registered style, registration country or state, registration number and business address have not been verified for this project. Development is attributed to davidio.dev. That attribution does not identify a customer support address, establish a jurisdiction or make the developer the seller of clothing. A working contact route and any legally required representative details must be published before the business begins trading through this service.

This draft covers the GENATSVALE website, its local shopping features and the payment infrastructure implemented for possible later activation. It also identifies additional processing that would arise from contact forms, a private customer management area, analytics or optional model assistance. Their inclusion here does not claim that each feature is currently enabled. The final notice must identify the actual operator and purposes for the particular deployed domain rather than rely on descriptions from another Like a King project.

02 — Browsing and information you choose to provide

The shopping preview lets you browse a catalog, choose product variants, compare imagery, save favourites and prepare a bag. A bag is a local selection rather than an order. No account is required for those activities. Checkout is disabled by default and cannot become available simply because an item has been added to a bag. A production connection, approved product and variant map, durable order storage, tested paid notifications and approved operational policies are separate requirements.

You control what you type into search, the assistant or any subsequently enabled contact form. Keep messages relevant to the request. Do not include card details, passwords, identification documents, health information or another person’s private information in free text. Information required to answer an enquiry must be distinguished from optional information at the point of collection. The final form notice must explain what happens if a required field is omitted and how the business will respond.

03 — Bag, favourites and language preference

The optional companion stores the local-storage preference genatsvale.companion.hidden only when you choose to hide it. This preference controls whether the companion is shown in this browser. The companion makes no separate network or model-provider requests and keeps no independent chat history or session identifier; its assistant control opens the existing guarded shopping assistant.

The preview stores shopping selections in this browser using local storage. The application keys are genatsvale:bag:v1, genatsvale:wishlist:v1 and genatsvale:locale:v1. Their values can include product identifiers, selected colours, sizes, quantities and a language code. They support the features you select; the stored selections are not themselves a payment instruction or a reservation. A person using the same browser profile may be able to see them, so use browser controls appropriately on a shared device.

These local selections have no automatic expiry in the current interface. Remove saved items through the relevant shopping control or clear this site’s stored data in your browser. Clearing data can remove favourites, the bag and the selected language together. Each browser profile and device maintains its own selections. Local storage access and applicable consent or exceptions must be assessed for the actual markets served; describing information as local does not by itself remove obligations relating to storage technologies.

Selecting a language also sets the first-party genatsvale_locale cookie, containing only the selected language code for up to one year (365 days). The implementation uses this strictly necessary preference cookie to provide the language you request and route visits without a language prefix; it is not used for advertising or cross-site profiling. It applies across this website, uses SameSite=Lax and is marked Secure on HTTPS. Change the language through the language control or clear the cookie in browser site-data settings. This cookie’s expiry is separate from the local-storage preferences described above; the final notice still requires the storage-law assessment appropriate to the actual markets.

04 — Installation and offline copies

The production website includes progressive web app support. If you choose to install it, your browser may save an icon and open the site in an application-style window. Installation is not an account registration, a paid subscription or permission for marketing. The implementation does not request push notifications or place background orders. The browser decides whether an installation prompt is available; choosing not to install does not prevent ordinary browsing through the website.

A service worker can save public page responses, compiled interface assets, local fonts and approved product imagery to make repeat visits and some offline browsing possible. It excludes API and MCP requests and does not intentionally cache private administrative responses or payment processing. Cached pages can be older than the current online catalog. Browser site-data controls can remove these copies and the worker. Uninstalling an app icon does not necessarily clear every browser storage area, so check those controls separately.

05 — Technical requests and infrastructure

Serving the site requires requests between your device and the infrastructure delivering it. Those requests can expose technical information such as an IP address, requested path, browser headers, response status and request time to the relevant server or network provider. The production plan identifies BOX3 and Coolify as the intended deployment environment, but that alone does not establish a hosting legal entity, processing country, log retention period or every service involved in delivering a page.

Before public operation, the business must document the actual host, reverse proxy, database, backup service and any content delivery or security provider. Technical logs should have defined operational and security purposes, restricted access and an approved retention period. Sensitive message text, payment signatures, credentials and complete request bodies must not be copied into ordinary access logs. This draft does not make an unsupported claim that browsing creates no server data or that all infrastructure records are anonymous.

06 — Contact forms and customer support

A contact form is intended to provide a direct way to ask the business about products, an order or a privacy request. Where that form is enabled, the displayed fields and their purposes must be stated accurately. A reply address and the message may be needed to answer you; optional name, topic or order reference fields must be marked accordingly. A form must not ask you to submit payment credentials, government identification or unrelated sensitive details to obtain routine support.

Sending a support enquiry does not automatically sign you up to advertising or a newsletter. The business must identify who monitors the form, how a successful submission is acknowledged and how a customer can retain a record. A confirmation that a message was received is not approval of a return, acceptance of an order or a promise of an unverified response time. The final privacy notice must identify the form’s actual storage, delivery services and retention before enquiries are collected.

07 — Private customer management and founder access

Google sign-in is optional. When you choose an available Google sign-in option, the requested permissions are limited to openid, email and profile. Google may return its issuer-validated subject identifier, name, email address and profile image; the account service uses these to identify or link your requested account. It does not request access to Gmail or Google Drive. Any Google access or refresh tokens retained by the account service are encrypted in the server database. Linking Google to an existing account requires your explicit action while signed in with a fresh session; matching email addresses do not automatically merge accounts. You can review or revoke the linked application in your Google Account connection settings. Revoking Google access does not by itself delete information already held by GENATSVALE; account-data requests remain subject to the request process described in this draft notice.

If you choose to create an account, the account service stores your email address, display name, a password hash rather than a readable password where password registration is used, and session records in the server database. A first-party authentication cookie maintains the sign-in you request. In the HTTPS production configuration it is Secure, HttpOnly and SameSite=Lax; server sessions have a seven-day validity period and may refresh after one day of continued use. Session records also include the IP address and browser user-agent, and database rate-limit counters help prevent abuse. Email-and-password registration does not send email-verification messages; the email address entered through that method has not been verified as belonging to that person. Signing out or revoking a session ends the corresponding access. Account and session data are used for account access, security and the account features you request, not automatic marketing enrollment.

The planned private customer management area is intended to help authorised staff review enquiries and operational records. It must not be accessible through a public catalog endpoint. Administrative authentication, session expiry and role checks must protect each read and change, rather than rely on an unlinked URL. Information available to staff should be limited to what is needed for the request or transaction, with access reviewed when staff responsibilities change.

A private dashboard is still processing of customer information. The final data inventory must distinguish contact messages, order references, payment status, fulfillment status and aggregate business reports, and explain any relationships between them. It must also identify audit records for administrative activity and the people or service providers who can access backups. A new dashboard does not authorise repurposing support messages as marketing leads or using customer text to train a model without a separate, appropriate assessment and notice.

08 — Analytics, advertising and marketing choices

No analytics collection is active in this release. The account and language cookies and local shopping/companion preferences described above support requested functions; their presence does not mean an analytics service is enabled.

The initial preview did not include advertising pixels, behavioural advertising or a newsletter. A private analytics dashboard is now a planned addition and requires a separate implementation review. Its final notice must list the events collected, identifiers used, whether complete IP addresses or message contents are retained, storage location, retention and available choices. Calling a tool first party, self hosted or private does not establish that it processes no personal information or that consent is never required.

The business must assess the rules that apply to the actual storage and access technologies before analytics is enabled. Where consent is required, collection must wait for an appropriate choice and withdrawal must be effective. Essential shopping controls must not be presented as consent to unrelated advertising. No marketing subscription is created by installing the app, saving a favourite, asking the assistant, making an enquiry or receiving an order response. Any future marketing programme needs its own clear collection and unsubscribe process.

09 — Catalog search and optional model assistance

Catalog search can match your words to locally available product data without using a remote generative model. The shopping assistant can also return factual catalog guidance when an external model is unavailable. Optional external assistance is a separately configured feature. The intended primary provider is OpenRouter with an eligible free model; a paid OpenAI API backup must remain separately disabled unless explicitly configured and authorised. A model described as free is not a promise about availability, accuracy, privacy or future provider pricing.

When external assistance is enabled, relevant message text and selected catalog context may be sent to the configured provider to generate a reply. The actual model, downstream provider, processing locations, retention and available data controls must be checked and explained before that processing begins. Request and anonymous-session caps limit use but do not establish a verified personal identity. Do not send sensitive information through the assistant. It cannot independently verify stock, approve a refund, enter a purchase contract or replace the final product and policy information.

10 — Languages and administrative translation

Customer-facing language versions are included with the website. Selecting a language changes the displayed copy and can save the selected language locally; it does not itself transmit your conversation, shopping selections or browsing history to a live translation API. The interface languages do not establish your residence, nationality, shipping eligibility or the law applicable to a purchase. Product names and Georgian cultural references may remain in their original form where that helps preserve their meaning.

An optional Google translation connector is intended for controlled administrative work rather than a public customer translation endpoint. Its key must remain on the server or in an administrative command-line environment. Before an administrator submits text to an external service, the business must check what the text contains and the relevant provider terms. Customer enquiries, payment records and other personal information must not be copied into a translation job merely because the connector is available. Final legal translations require review for meaning and consistency.

11 — Conditional payments and order references

The implemented payment integration is disabled by default. If approved Checkout is later enabled, it redirects you to Stripe-hosted payment pages rather than asking the storefront to collect complete card details. Stripe will process the information required by its payment interface and its own applicable notices. The business must identify the actual Stripe relationship and the data returned for transaction support before launch. A return to this website after payment is not, by itself, confirmation that a payment succeeded.

The local payment ledger is designed to retain minimal order, Checkout Session, PaymentIntent and event identifiers, approved product variants, quantities, expected amounts, timestamps and payment or manual fulfillment status. It does not store card details, customer email, delivery address or the raw webhook body. Reference identifiers can still relate to an individual through the payment provider and require protection. The final notice must explain access, legally required transaction retention and how order-related requests are handled before this infrastructure accepts real purchases.

12 — Fulfillment and other recipients

The existing brand has used print-on-demand production, and Printful is the intended fulfillment service being evaluated for the redesigned collection. A preview image or product proposal does not mean a fulfillment order has been sent. The implemented paid webhook only stages an order for manual review. It does not automatically buy, confirm or release an order to Printful. Final garment variants, production files, shipping countries and customer data flows remain operational approval requirements.

If an order is later fulfilled through a production partner or carrier, the information necessary to make and deliver it may need to be shared with those services. The final notice must identify the actual recipients or clear categories and their roles, as well as transfers and safeguards where required. Provider access must serve the stated transaction purpose. The business must also assess disclosures required for legal obligations or genuine security incidents, rather than insert an unlimited permission to share customer information for any reason.

13 — Retention, deletion and international processing

Local bag, favourite and language selections remain until changed or cleared, while browser-managed caches can be removed or replaced by the browser or service worker. The production business has not yet approved a complete server retention schedule. That schedule must separately address contact enquiries, administrative audit records, security logs, payment references, fulfillment records and backups. A single invented period would not accurately describe those different purposes or any recordkeeping obligations applicable to the actual seller.

Deletion requests must be assessed against the records held and any applicable duties to retain them. Deleting a local bag does not erase an independently existing payment provider record; removing a dashboard entry may not immediately remove a protected backup. Where information is processed outside a relevant jurisdiction, the final notice must describe the actual countries or transfer arrangements and required safeguards. This draft does not claim that every provider processes only within one country or that cross-border safeguards are already in place.

14 — Security and limits of the service

The implementation separates browser-facing catalog data from server credentials and requires verified signatures before a paid notification can stage an order. Production security also depends on deployment configuration, updates, backups, administrative authentication, access control and incident response. Those measures need operational verification. No website can promise that every transmission or storage system will remain completely secure, and this draft does not use that uncertainty to remove rights or responsibilities imposed by applicable law.

Protect the device and browser profile you use, and avoid entering private information on a shared or untrusted device. If a message appears to request a password, card security code or secret key in ordinary support text, do not provide it. The business must establish a monitored way to report suspected misuse and a process for assessing incidents and making legally required notices. It must not describe a scanner result, a badge or installation as a guarantee of security or a substitute for those measures.

15 — Requests, choices and complaints

Depending on the applicable law and information involved, you may have rights to obtain information, access a copy, correct inaccuracies, request erasure, restrict or object to processing, or receive certain information in a portable form. Where processing relies on consent, the business must explain how to withdraw it. These rights have conditions and exceptions; their exact application must be assessed for the confirmed service and markets. This draft does not select a legal basis merely by listing possible rights.

Use the functioning contact route once published to identify the request and relevant context without sending unnecessary sensitive evidence. Any identity check should be proportionate to the request and the information actually held. A complaint can also be made to a competent data protection authority where applicable. The final notice must supply the appropriate contact details and authority information. A form designed for convenience cannot be the only route if the applicable law requires additional business or electronic contact disclosures.

16 — Young visitors, linked services and updates

The preview is a general fashion catalog and does not provide a dedicated children’s account or knowingly invite children to submit sensitive information. The intended customer ages and any purchase eligibility rules need to be settled before transactions are enabled. An unverified age statement cannot replace an assessment of the audience and features. Where a parent, guardian or another person raises a concern about submitted information, the business must review the actual records and applicable requirements through its confirmed request process.

External websites and payment or production services have their own notices. Their presence in this draft is not a claim that they are currently receiving every visitor’s data. This notice must be updated when functionality or processing changes, with a clear date and appropriate communication for material changes. Historic transactions and requests may require reference to the version in effect at the relevant time. The detailed readiness record remains a working document until the owner has confirmed the missing facts and the deployed behavior.