Privacy Policy

Last updated: [[FILL: policy effective date]]

Who we are

Cedar & Cart Demo presents ceramic mugs and linen towels. Its operator is [[FILL: legal entity name]], at [[FILL: registered business address]]. This is a demonstration: the checkout preview creates no order or payment. Please use fictional information when testing it.

Information used by this demo

• Checkout entries: the email and delivery-address fields remain in the browser form. The checkout code prevents submission and does not send or save these entries. It has no order database or payment processor.
• Support: the contact link opens an email application. A message could contain your email address, order number and anything you choose to include. The supplied address, support@cedar-cart.example, is fictional and is not a working support or privacy-request channel.
• Technical information: a hosting provider may record IP addresses, browser information and requested pages to serve and protect the site. Hosting provider and logging arrangements: [[FILL: hosting provider and server-log practices]].
• Optional analytics: if you accept analytics, the homepage loads a Google Analytics test tag from googletagmanager.com. That request reveals technical information such as your IP address and browser details to Google. The tag may send page and usage information and set analytics cookies. The test setup does not establish that a working analytics property receives events.

Cookies and your choice

Google Analytics is the only optional service in this demo. It is blocked until you choose to allow analytics; rejecting it does not prevent use of the store preview. Analytics is limited to the homepage and is not loaded on checkout, contact or policy pages.

The essential preference record, cookie_consent, is saved in this browser's local storage so the site can remember your choice. It contains a version, choice date and necessary/analytics preferences, not checkout details. It is accepted for up to 180 days, then treated as expired on a later visit. It is not sent to a server by the consent controls. Browser settings may clear it earlier; if saving preferences is unavailable, analytics stays blocked.

Cookie preferences lets you change your choice or withdraw analytics consent. Withdrawal saves rejection, attempts to clear accessible Google Analytics cookies and reloads the page to stop the loaded tag. It blocks later analytics loads unless you consent again. It does not erase information already received by Google. Choices apply to this browser and site address; other browsers need their own choice.

Google describes its analytics cookie usage. The cookies actually set, their configured lifetimes and Google's backend retention have not been verified for this test setup.

Use, recipients and retention

Current purposes are displaying the preview, remembering privacy choices, optional homepage measurement and any hosting security logs. Google receives the optional analytics requests; the hosting provider may receive request logs. No payment, fulfillment or email service is connected. USPS and UPS are planned shipping carriers, not active data integrations.

For any future real store, customer information would be needed to fulfill orders and handle inquiries and returns. That processing is not implemented here; its vendors and information flows must be documented before real orders begin. Retention beyond the browser preference described above: [[FILL: privacy retention periods and deletion process for hosting logs, analytics and future support/order records]].

Security

The checkout code does not transmit your entries, but that is not a guarantee of security for your browser or any deployed hosting service. No transmission or storage method is completely secure. A real operator must establish appropriate safeguards before collecting customer information.

Your rights and contact

Where applicable law provides them, you may request access, correction or deletion of personal information and raise concerns about its use. For Canadian visitors, PIPEDA may provide access and correction rights, a way to challenge handling of personal information, and withdrawal of consent subject to legal or contractual restrictions and reasonable notice. See PIPEDA's privacy principles.

If the operator is covered by California's CCPA/CPRA, California residents may have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive information, and exercise rights without discrimination. See the California Attorney General's explanation. No advertising pixel or sale workflow was found in this demo; that finding does not certify Google's account settings or decide the operator's legal obligations.

A real request channel must be provided before launch: [[FILL: working privacy contact and request procedure]]. The existing support page contains only the fictional address. Legal applicability, including any obligations to visitors outside the intended US/Canada market, remains for review.

Changes

Updates will appear on this page with a revised date. Material changes to actual data handling should be explained before they take effect; new optional uses require a fresh choice.