*Administrative Notice: This document represents an exploratory draft policy template for operational and organizational planning. It does not constitute formal legal representation, regulatory certification, or binding attorney-client counsel.* ### 1. Administrative Website Privacy Policy Draft #### 1. Information We Collect Lumina Threads collects customer information across three core touchpoints: * **Direct Order Details:** Full name, shipping destination address, billing address, phone number, and order history collected during checkout. * **Payment Processing Data:** Payment card numbers and transaction tokens (processed securely via our third-party payment partner; raw card numbers are never stored on our servers). * **Automated Device Identifiers:** IP address, browser type, device specifications, and interaction data captured automatically when browsing our storefront. #### 2. How We Use Collected Information We utilize collected information strictly for operational administration: * Processing, routing, and fulfilling apparel shipments and order updates. * Delivering optional marketing newsletters and back-in-stock alerts when consent is provided. * Preventing fraudulent transactions and unauthorized storefront abuse. #### 3. Data Retention & Security Customer transaction records are maintained for a standard duration of seven (7) years to satisfy accounting, tax, and inventory audit obligations. We apply TLS 1.3 encryption protocols across all web checkout portals. --- ### 2. Cookie Categorization & Third-Party Disclosure Schedule | Cookie / Processor Category | Service Provider | Purpose & Operational Function | Data Transferred | Opt-Out Availability | | :--- | :--- | :--- | :--- | :---: | | **Strictly Necessary** | Shopify Core | Session persistence, shopping cart state, and security authentication. | Session token, Cart ID | Required for checkout | | **Payment Processing** | Shopify Payments (Stripe) | Tokenized credit card authorization and fraud detection. | Billing address, card token | Required for checkout | | **Analytics & Performance** | Google Analytics 4 | Aggregated page engagement, checkout funnel drop-offs, and visit metrics. | Truncated IP, page views | Browser cookie banner | | **Targeted Advertising** | Meta Pixel | Measuring ad conversion effectiveness and social retargeting. | Hashed email (optional), click IDs | Browser cookie banner | | **Email Communication** | Klaviyo | Cart abandonment follow-up and promotional newsletter delivery. | Email address, purchase history | Unsubscribe link in footer | --- ### 3. Website Terms of Service & Acceptable Use Draft #### 1. Storefront Accounts & Ordering * Users registering customer accounts agree to provide accurate, up-to-date billing information. Lumina Threads reserves the administrative right to cancel or refuse orders suspected of fraudulent reseller activity. * Prices and inventory availability are subject to change without prior notice. In the event an item is listed at an incorrect price due to clerical error, we reserve the right to cancel the unfulfilled order and issue a full refund. #### 2. Returns & Fulfillment Policy * Unworn, unwashed merchandise with original tags attached may be returned within thirty (30) days of confirmed package delivery in accordance with our return guidelines. #### 3. Limitation of Liability & Dispute Resolution * To the fullest extent permitted by applicable law, Lumina Threads shall not be liable for indirect, incidental, or consequential damages resulting from product use or delivery carrier delays. * Any controversy or claim arising out of these terms shall be settled by confidential binding arbitration administered in the State of Delaware. --- ### 4. Data Subject Rights Request (DSR) Administrative Workflow Matrix | Consumer Request Type | Verification Requirement | Internal Resolution SLA | Operational Fulfillment Procedure | | :--- | :--- | :---: | :--- | | **Right to Know / Access** | Email verification code sent to customer account address. | 30 Calendar Days | Export JSON/CSV ledger of order history and stored contact profiles from Shopify admin. | | **Right to Delete (Erasure)** | Two-factor confirmation via verified billing email. | 30 Calendar Days | Trigger Shopify customer redaction API; purge associated profile from Klaviyo list. | | **Do Not Sell / Share (Opt-Out)** | Browser Global Privacy Control (GPC) signal or footer toggle. | 48 Hours | Suppress Meta Pixel tracking cookies and disable commercial retargeting audiences. |