Privacy Notice

First version. Placeholder scaffolding, not a legal instrument.

PLACEHOLDER — THIS DOCUMENT STATES NO TERMS AND BINDS NOBODY.

It is engineering scaffolding, seeded so that Pack & Kin Studio's versioning and acceptance machinery can be built, tested and operated before the real text exists. It has not been drafted or reviewed by a lawyer. Nothing in it is a representation, a warranty, a limitation of liability, or a grant or reservation of any right.

The reviewed text will be published as a NEW VERSION of this same document. This version will remain readable at its own permanent address so that any acceptance recorded against it can still be produced.

Privacy Notice

What personal data Pack & Kin holds about the people who hold accounts with us, why, and what they can ask us to do about it.

Scope this document will need to cover:

• The controller/processor split: Pack & Kin is the controller for account holders, and the processor for a store's own customer data.
• Categories of data, sources, and lawful bases.
• Sub-processors, and where data is hosted.
• International transfers.
• Cookies and similar technologies.

SUBJECT RIGHTS ARE NOT RESTATED HERE, AND THAT IS DELIBERATE.

Export, correction and erasure are implemented in the product, and the operating procedure — including how a requester's identity is verified, which is in person against photo identification at the store counter — is documented in 'docs/subject-access.md'. The retention periods and the PII map are in 'docs/data-retention.md'.

This notice must LINK those and must not restate them. A retention period written here that drifts from the one the software actually enforces is worse than no page: it is a published promise the product does not keep.