1. Covered technologies
“Storage” includes HTTP cookies, session/local storage, IndexedDB, service-worker cache, secure app storage, generated install IDs, authentication tokens, public-key credentials and similar technologies. Mobile clients may use operating-system facilities instead of browser cookies.
| Category | Current use | Typical lifetime/control |
|---|---|---|
| Authentication and security | Session token, username, CSRF/session integrity, sign-in and fraud events | Current session or server expiry; revoked at sign-out, credential/role change or security action |
| Workspace cache | Business profile drafts, catalog, labels, quick replies, preferences and pending sync state | Until synced, cleared, expired or app/site data is removed |
| PWA/offline | Application shell, CSS, scripts, logo and service-worker cache | Versioned cache replaced by updates; removable in browser/app settings |
| Local app lock | PBKDF2-derived PIN verifier and salt; WebAuthn credential ID | Until disabled, site data cleared or app uninstalled; no raw PIN or biometric template |
| Wallet connection | WalletConnect session, chain/account selection, challenge correlation | Connection/provider lifetime; disconnect in wallet and Business client |
| Optional analytics/advertising | None may activate without an updated inventory and legally required choice | Off until valid basis/consent and disclosure |
2. Consent and necessity
Storage strictly necessary to sign in, secure a requested feature, maintain a cart/workspace or deliver an offline PWA may be used without consent where law permits. Non-essential analytics, advertising or cross-site tracking requires the legally appropriate prior choice. Continued browsing, pre-ticked boxes or staff acceptance of Business Terms is not cookie consent.
3. Controls and shared devices
Sign out, disconnect wallets, clear site/app data, remove local biometric credentials, or use browser/OS controls. Clearing necessary storage may remove unsynced drafts, sign users out and disable offline functionality. Businesses must not use persistent sessions on unmanaged/shared devices and must remove access when staff leave.
4. Third parties
A user-directed wallet, app store, map, blockchain explorer or external site may store its own data under its policy. A Business may not add third-party pixels, SDKs or fingerprinting to a Kaltiq storefront. Kaltiq must contractually review any embedded provider and update this notice before activation.
5. Contact
Privacy/DPO questions or consent requests: admin@kaltiq.com.