Privacy Policy and advertising tracking disclosure architecture

1. Effective Date & Scope

This privacy policy takes effect on October 27, 2026. It establishes how Onlycases collects, records, retains, and secures technical information and contact submissions across the digital catalog available at onlycases.click.

2. Data Controller Identification

The data controller responsible for the processing operations governed by this document is:

Onlycases
400 South LaSalle Street, Chicago, Illinois 60605, Chicago, Illinois, United States
Telephone: +1 (340) 808-3456
Email: office@onlycases.click
Web domain: onlycases.click

Onlycases operates as an inquiry-only physical smartphone accessories catalog. No consumer cart, checkout processing, or direct electronic payment transactions occur on this domain.

3. Categories of Data Collected

We collect only the specific data categories necessary to process commercial catalog inquiries and evaluate paid advertising campaigns:

• Inquiry Form Data: When you complete an intake request on silo931.php, our system records your name, business phone number, corporate email address, delivery destination address, inquiry classification kind, freeform inquiry notes, and specific catalog component specification.
• Technical Transmission Telemetry: Every form submission automatically captures your network IP address, browser user-agent string, referring landing URL, the precise unix timestamp when the form page rendered, and the timestamp when the form submission completed.
• Support Chat Desk Telemetry: Conversations conducted through the binabe1.php desk store message body text, optional contact identifiers, and an anonymous session token saved within browser local storage.
• Advertising Click Identifiers: Inbound URL parameters delivered via live ad platforms, specifically gclid, msclkid, and fbclid.
• Consent State Records: Your affirmative choice or decline decision recorded in your browser under the key site_consent_v2.

No user account registration, passwords, credit card credentials, or payment account tokens are processed or stored on this website.

4. Purposes of Data Processing

Data collected by Onlycases is processed strictly for the following defined business objectives:

• Generating non-binding commercial quotations for protective cases, tempered glass, and phone accessories.
• Verifying smartphone model tolerances and dimensional fitment compatibility before batch dispatch.
• Preventing automated submission spam through server-side timestamp verification and hidden honeypot validation.
• Measuring commercial campaign conversion performance on Google Ads, Microsoft Advertising, and Meta Ads.
• Maintaining server security, defending against denial-of-service attempts, and auditing intake logs.

5. Legal Bases for Processing

Under statutory US privacy regulations and European data protection frameworks, we process each category of data on explicit legal bases:

• Consent: Storing ad cookies and tracking campaign attribution via Google Consent Mode v2 requires your explicit, affirmative consent given via the consent banner.
• Contractual Preparation: Processing your name, phone, email, and component specifications submitted via silo931.php is necessary to respond to your direct request for quote preparation prior to issuing a commercial invoice.
• Legitimate Interest: Processing server IP logs and submission render timestamps to maintain website infrastructure integrity, combat fraudulent inquiries, and secure internal systems.

6. Advertising Platforms & Click Identifiers

Onlycases operates active paid advertising campaigns. This site receives live paid traffic from google ads, microsoft advertising, and Meta Ads.

When a visitor arrives via a paid campaign, the following tracking click identifiers are appended to the URL:

• gclid: Google Click Identifier, utilized by Google Ads to evaluate keyword effectiveness and attribute catalog quote inquiries.
• msclkid: Microsoft Advertising Click Identifier, utilized by Microsoft Advertising to attribute ad interactions across the Bing search network.
• fbclid: Meta Click Identifier, utilized by Meta Ads to measure click performance across Facebook and Instagram properties.

Neither Google, Microsoft, nor Meta has reviewed, approved, or verified this website or its component catalog offerings.

7. Google Consent Mode v2 Implementation

We implement Google consent mode v2 strictly. By default, before any interaction with our consent banner, the following four consent variables remain held in an affirmative denied state:

• ad_storage='denied': Disables local storage and cookies used for advertising attribution.
• ad_user_data='denied': Prevents sending user behavioral data to advertising endpoints for advertising purposes.
• ad_personalization='denied': Disables personalized audience remarketing and ad targeting.
• analytics_storage='denied': Blocks non-essential telemetry cookies and visitor session analytics.

These four variables transition to granted only if you explicitly click “Accept Storage”. If you click “Decline” or adjust your preferences, all four parameters are immediately reset to denied.

8. Third-Party Data Processors

We share data only with verified technical infrastructure providers and advertising platforms operating under strict data processing agreements:

• Google Ireland Ltd / Google LLC: Operates Google Ads conversion tracking and tag infrastructure. Subject to Google privacy policies.
• Microsoft Ireland Operations Ltd: Operates Microsoft Advertising conversion measurement. Handling is governed by the Microsoft Privacy Statement available at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Measures advertising referrals where Meta ad campaigns are routed to our catalog.
• Hosting & Mail Infrastructure: Our web hosting server in North America and our SMTP mail routing service that delivers commercial catalog inquiries directly to office@onlycases.click.

9. Cross-Border Data Transfers

Onlycases operates from Chicago, Illinois, within the United States. Inquiries originating outside the United States, including visitors connecting from the European Economic Area (EEA) or the United Kingdom, involve direct transmission of data into our US-based infrastructure.

Such international transfers are performed under standard contractual clauses (SCCs) and statutory adequacy frameworks that safeguard personal telemetry to equivalent standards.

10. Data Retention Schedules

We do not retain information indefinitely. Personal and technical data records are purged according to defined schedules:

• Inquiry Submissions & Commercial Emails: Retained for 18 months from the date of submission to maintain procurement history and commercial invoice records.
• Support Chat Transcripts: Retained for 18 months to provide follow-up documentation on technical specifications.
• Server Access Logs & IP Addresses: Automatically overwritten and permanently expunged after 30 days.
• Consent Choice Persistence: Stored within browser local memory for 6 months, after which the consent prompt is re-displayed.
• Data Subject Access Requests (DSAR): Formal privacy requests receive a verified written response within 10 days.

11. Information Security Safeguards

All electronic communications between your client device and our catalog server are encrypted using Transport Layer Security (TLS 1.3). Access to inquiry intake databases is restricted through authenticated SSH keys, firewall isolation, and perimeter rate-limiting.

Physical intake verification and quality benches in our Chicago facility are managed under strict chain-of-custody protocols led by Alina Koval.

12. European Rights (GDPR)

Visitors accessing our catalog from the European Economic Area or the United Kingdom benefit from statutory protections under the gdpr:

• Right of Access: You may request confirmation of whether Onlycases processes your personal data and obtain a copy.
• Right to Rectification: You may correct inaccurate or incomplete delivery or contact details.
• Right to Erasure (Right to be Forgotten): You may demand deletion of your submitted contact records subject to statutory tax record retention.
• Right to Restriction: You may restrict the processing of your data while an objection is evaluated.
• Right to Data Portability: You may request your inquiry data in a structured, machine-readable JSON or CSV format.
• Right to Object: You may object at any time to processing based on legitimate interests or direct advertising.
• Right to Withdraw Consent: You may revoke affirmative cookie consent at any moment via our consent preferences controller.

13. US State Privacy Rights & CCPA Disclosures

Pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa / CPRA), as well as consumer data privacy statutes in Illinois, Virginia, Colorado, and other states:

• Right to Know & Access: You have the right to request disclosure of the categories and specific pieces of personal information collected.
• Right to Delete: You have the right to request deletion of personal information collected from you.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• No Sale or Sharing: Onlycases does not sell your personal information for monetary consideration. We do not share personal information with third parties for cross-context behavioral advertising without affirmative consent.
• Non-Discrimination: We do not alter catalog pricing tiers ($15–$60), lead times, or service quality based on your exercise of statutory privacy rights.

14. Global Privacy Control (GPC)

Onlycases respects automated browser opt-out signals. If your browser transmits the global privacy control (Sec-GPC) header, our site automatically interprets this signal as a universal request to decline advertising cookies and personal data sharing.

When a GPC signal is detected, Consent Mode v2 variables are automatically set to denied without prompting you with a secondary modal.

15. Protection of Children

Onlycases provides commercial smartphone hardware components and protective cases to business procurement managers, technicians, and adult consumers. Our catalog is not directed to individuals under 18 years of age.

We do not knowingly collect, record, or solicit personal information from children under 16 years of age. If we discover that personal data from a minor has been submitted, it is immediately deleted from our intake databases.

16. Supervisory Authority Complaints

If you believe our data processing operations infringe applicable privacy legislation, you have the right to lodge a formal complaint with a competent supervisory authority:

• In Illinois: The Office of the Illinois Attorney General, Consumer Protection Division.
• In California: The California Privacy Protection Agency (CPPA) or the California Attorney General.
• In the European Union: The Data Protection Authority located in your member state of habitual residence.

17. Data Subject Access Request (DSAR) Protocol

To exercise your statutory rights regarding access, deletion, correction, or portability of your information, submit your written request to our dedicated privacy desk:

Data Request Intake Desk
Email: office@onlycases.click
Postal Address: Onlycases, 400 South LaSalle Street, Chicago, Illinois 60605, United States
Phone: +1 (340) 808-3456

Please specify your name, the email address used when submitting an inquiry, and the exact right you wish to exercise. In compliance with statutory timelines, we will acknowledge and resolve verified requests within 10 days without charge.

Accessibility Statement

Onlycases is committed to digital accessibility. We construct all catalog layouts in conformance with Web Content Accessibility Guidelines (WCAG) 2.1 Level AA standards.

Our Swiss International Grid features zero-radius elements, high-contrast typography exceeding a 9.3:1 ratio for secondary text and 15.2:1 for primary copy, visible keyboard focus indicators, touch targets exceeding 44 pixels, and semantic HTML5 landmarks throughout.

If you encounter accessibility barriers on onlycases.click, please notify our technical team at office@onlycases.click for immediate remediation.

18. Modifications to this Policy

We may revise this privacy policy to reflect technical enhancements, changes in advertising platform requirements, or statutory revisions. Any modifications will be posted directly to this page with an updated effective date header.

Continued interaction with onlycases.click after modifications take effect constitutes acknowledgment of the revised privacy disclosures.

19. Direct Privacy Contact

For questions, legal notices, or inquiries regarding our tracking disclosures and data protection protocols, contact our Chicago procurement and legal office directly: