Privacy Policy

Cookie preferences – Necessary / Analytics / Advertising

We use a consent layer with three categories:

• Necessary (always on): cart (basco-cart-v1), wishlist (basco-wishlist-v1), coupon, consent (basco-consent-v1), admin session (httpOnly). No opt-out – required for store function.
• Analytics (opt-in): Google Analytics 4 – loads only if NEXT_PUBLIC_GA_MEASUREMENT_ID is configured in deployment env AND you explicitly enable Analytics in preferences. No tracking without consent. See analytics component src/components/analytics/GoogleAnalytics.tsx.
• Advertising (opt-in): Google AdSense – AdSlot component does NOT load/render real ad unless client ID NEXT_PUBLIC_ADSENSE_CLIENT_ID AND slot ID configured AND you enable Advertising consent. Otherwise no ad request is made; safe placeholder only in development. See src/components/ads/AdSlot.tsx.

You can change choices anytime via the banner or this button. Consent is persisted locally, not on server.

Google integrations – privacy respecting

• Google Analytics: Loads gtag.js only after consent. Requires NEXT_PUBLIC_GA_MEASUREMENT_ID (format G-XXXXXXXXXX) set in Vercel/Cloudflare Pages env. No data sent without consent. IP anonymization enabled. See README for verification and consent requirements.
• Google AdSense: AdSlot requires NEXT_PUBLIC_ADSENSE_CLIENT_ID (ca-pub-...) + slot ID + advertising consent. Real ad script pagead2.googlesyndication.com only injected after consent. In production without config, component renders nothing to avoid policy violation. In development, shows dashed placeholder explaining missing config. Requires approved AdSense account and domain approval (ads.txt). See README AdSense policy/approval prerequisites.
• Search Console verification: Driven by server env GOOGLE_SITE_VERIFICATION (meta content token only). Implemented via generateMetadata() in src/app/layout.tsx – adds google-site-verification meta tag only if configured. No Google API call from app.

What we collect (demo)

Currently Basco Sports runs mostly client-side with localStorage for cart/wishlist/consent. Newsletter form shows alert only, no email delivery. Contact form does not send email – integration point documented in README. No personal data sent to server except admin login (server-side, httpOnly cookie) when admin env configured.

Hermes Connector – Generic Custom API

Future integration for custom backend / fulfillment / ERP. Configurable via env:

• HERMES_ENABLED=true/false – feature flag
• HERMES_BASE_URL – base URL of your Hermes API (e.g., https://api.hermes.example.com)
• HERMES_API_KEY – server-only secret, never exposed to client, stored in deployment env

Implementation point: src/lib/hermes-client.ts (to be created when service defined). No external API call in demo. Never log key, never expose in UI.

Future live implementation

• When live, we will collect email, shipping address and payment metadata via Stripe – never raw card numbers. Payments remain demo-only until Stripe env configured.
• Data stored in GDPR-compliant DB (e.g., Supabase EU). Retention 2 years.
• Rights: access, deletion, portability – contact privacy@bascosports.demo (demo address).
• Admin: requires env-provided ADMIN_EMAIL + salted ADMIN_PASSWORD_HASH (bcrypt) + ADMIN_SESSION_SECRET, httpOnly signed cookie, 8h expiry. See README Admin Hardening.