Privacy Policy

Who we are and scope

Haske World is operated by THEINVALUE LLC. This policy applies to haskeworld.com, customer accounts, purchases, returns, Haske Lab, and communications with Haske World. It does not govern a third party's own website or service.

Information we collect

Depending on how you use Haske World, we may collect the following categories of information:

• Contact and identity information: name, email address, phone number, billing address, shipping address, and the information you include in a support or privacy request.
• Account and security information: account email, securely hashed password, email-verification status, session and security tokens, sign-in activity, and password-recovery information. Haske World does not store your password in readable form.
• Order and commercial information: products, quantities, price, discounts, tax, order status, transaction identifiers, delivery and tracking information, return reasons, return comments, refund status, and related customer-service records.
• Payment information: Stripe collects and processes payment-card and billing information. Haske World receives transaction details and payment references but does not receive or store the full payment-card number.
• Device, network, and usage information: IP address, browser and device details, operating system, referring page, pages viewed, approximate location derived from IP address, timestamps, diagnostic logs, security events, and interactions with products or checkout. Optional analytics information is collected only when analytics is allowed.
• Haske Lab information: a locally stored product-concept vote, lighting preference, purchase-interest selection, and date of the vote. If you choose to email an idea, Haske World receives the idea, your email address, and any other information you place in that email.

How information is collected

We collect information directly from you when you create an account, place an order, request a return, contact us, or email a Haske Lab idea. We collect limited information automatically through essential cookies, browser storage, server and security logs, and—only with your permission—Google Analytics. We also receive information from service providers involved in your transaction, such as Stripe and shipping carriers.

How we use information

• Create, authenticate, protect, and support optional customer accounts.
• Process payments; reserve inventory; fulfill, ship, track, return, and refund orders; and send service messages.
• Respond to product, support, legal, and privacy questions.
• Detect fraud, abuse, unauthorized access, technical failures, and security incidents.
• Maintain tax, accounting, transaction, and other records required for legitimate business and legal purposes.
• Understand storefront and product interest and improve Haske World when you allow analytics.
• Protect customers and Haske World's rights and comply with law.

Cookies and browser storage

Haske World separates storage needed for the site to work from optional analytics. Essential storage remains available when analytics is declined.

• haske_customer: an essential, first-party, HttpOnly session cookie used to keep a customer signed in. In production it is sent only over HTTPS and uses SameSite=Lax. It has a maximum lifetime of 30 days, and the server treats a session as inactive after 7 days without use.
• haske_admin: an essential, first-party, HttpOnly security cookie restricted to administrative access. It uses SameSite=Strict, lasts no more than 8 hours, and has a 30-minute inactivity limit.
• haskeCart and haskeCartSelection: local browser storage that remembers cart contents and which items are selected. It remains until checkout removes the purchased items, you remove them, or you clear site data.
• haskePendingCheckoutItems: temporary local browser storage used to reconcile the cart after Stripe Checkout. It is removed after a completed checkout, or when you clear site data.
• haske-lab-vote-v1: local browser storage used to keep one Haske Lab vote on that browser. The site treats the stored vote as expired after 12 months.
• haskePrivacyChoice: local browser storage that remembers whether you allowed optional analytics. The choice expires after 180 days, after which the site asks again.
• haskePurchaseTracked: if analytics is allowed, a local duplicate-prevention marker containing an order identifier and timestamp may be kept for up to about 13 months. It is removed when analytics is turned off through Privacy choices.
• _ga and _ga_<container-id>: optional first-party cookies created by Google Analytics to distinguish browsers and maintain session state. Haske World configures these cookies for up to 180 days. They are not set by Haske World unless you allow analytics.

The site does not currently use browser sessionStorage. Your browser may let you view, block, or delete cookies and local storage. Blocking essential storage may prevent sign-in, cart, checkout, or account functions from working correctly.

Review cookie settings

Google Analytics and third-party collection

Google Analytics 4 is optional. The Google tag is not loaded until you select “Allow analytics.” When allowed, Google may receive page URLs and titles, product interactions, cart and checkout events, purchase details such as order identifier and value, browser and device information, IP-derived approximate location, and cookie identifiers. Haske World does not intentionally send names, email addresses, full mailing addresses, phone numbers, or payment-card numbers to Google Analytics.

Haske World configures the tag with Google signals and advertising-personalization signals disabled. Analytics is used for store measurement, not cross-context behavioral advertising. The Google Analytics property controls retention of user-level and event-level records; Haske World's retention policy is to select a period no longer than 14 months. Aggregated reports may remain available longer.

Google may collect information when its Analytics tag is allowed, and Google Fonts receives ordinary network request information when your browser retrieves the site's fonts. Stripe, Cloudflare, Render, Resend, and shipping carriers may also collect information through their services under their own notices.

Browser privacy signals

Haske World recognizes Global Privacy Control (GPC). When the browser sends a GPC signal, the site keeps optional analytics off and removes Haske World-accessible Google Analytics cookies and duplicate-prevention markers. Because analytics is already off until you affirmatively allow it, a legacy “Do Not Track” signal does not cause an additional change. You can revisit your selection at any time through the “Privacy choices” control displayed on public pages.

Service providers and other disclosures

We disclose information only as reasonably necessary for the purposes described above to categories of recipients that include:

• Payments and fraud prevention: Stripe.
• Hosting, databases, routing, security, and logs: Render, PostgreSQL infrastructure, and Cloudflare.
• Transactional email and email routing: Resend and Cloudflare, along with the mailbox provider used to receive your message.
• Analytics, if allowed: Google Analytics.
• Order delivery and returns: postal and shipping carriers and fulfillment providers selected for the order.
• Professional and legal support: accountants, insurers, attorneys, regulators, courts, and authorities where reasonably necessary.
• Business transactions: a buyer, successor, or adviser in connection with a proposed or completed financing, sale, merger, reorganization, or transfer, subject to appropriate protections.

Haske World does not knowingly sell personal information for money or use personal information for cross-context behavioral advertising. If these practices change, we will update this policy and provide any legally required choice before the change applies.

Retention

We use the following retention approach unless a longer period is reasonably necessary for a dispute, legal hold, fraud prevention, safety, or another legal obligation:

• Customer account records remain until the account is deleted or the account is otherwise closed.
• Customer sessions have a 30-day maximum and become invalid after 7 days of inactivity. Email-verification and customer password-reset links expire after 60 minutes.
• Order, payment-reference, fulfillment, tax, return, and refund records are generally retained for up to 7 years after the transaction or matter is completed.
• Support messages, privacy-request records, and emailed Haske Lab ideas are generally retained for up to 3 years after the last interaction.
• Browser-storage and analytics periods are described above. Hosting and security providers may retain logs under their service settings and legal obligations; Haske World limits its use of those logs to operational, fraud-prevention, and security purposes.

Account deletion and privacy requests

You can update your account name or delete your customer account from the Account page. Account deletion removes the customer profile, password hash, verification and reset tokens, and customer sessions. It does not automatically erase transaction, tax, payment-reference, fulfillment, return, refund, fraud-prevention, or support records that must or may reasonably be retained. The customer identifier on retained orders and returns is detached where the system supports it.

You may also ask Haske World to provide access to, correct, or delete personal information associated with you. Email support@haskeworld.com with “Privacy request” in the subject and describe the request. Do not send a password or full payment-card number. We may ask for information reasonably necessary to verify identity and protect the account. We will respond within the period required by applicable law and explain when an exception prevents part of a request.

These choices are offered as part of Haske World's privacy practices. Additional rights may apply depending on where you live and whether the relevant law applies to Haske World. We will not retaliate against a person for making a good-faith privacy request.

Security

Haske World uses measures designed to protect information, including HTTPS, restricted administrative access, hashed passwords and session tokens, HttpOnly and SameSite cookies, request-origin and anti-forgery checks, rate limiting, and limited public access to application files. No system can guarantee absolute security. If you believe an account or transaction is at risk, contact us promptly.

Children

Haske World is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child provided personal information, contact us so we can review and take appropriate action.

Changes to this policy

We may update this policy as the store, providers, and legal requirements change. We will post the revised policy here, change the effective date, and provide a more prominent notice when a change is material and applicable law requires it.

Contact

Privacy questions and requests may be sent to support@haskeworld.com or mailed to:

Haske World
9580 Oak Avenue Pkwy, Suite 7 PMB 286
Folsom, CA 95630

This is a mailing and returns address, not a retail storefront.