Privacy Notice

Version 1.1 · Issued 21 August 2026

ALANKOR is an India-based fashion brand. This Privacy Notice explains how ALANKOR handles personal data submitted through this Coming Soon website: what is collected, why, for how long, and how to have it removed.

It describes this website only. It does not describe a shop, because this website is not one. Nothing is sold here, there is no checkout, there are no payments, there are no orders and there is no customer account.

1. Who is responsible

Brand and operator: ALANKOR
Country: India
Website: https://alankor.com
Contact, privacy requests and grievances: The ALANKOR contact page

ALANKOR decides why and how the personal data described here is handled, and is answerable for it. Google provides the hosting, compute and storage as a service provider acting on ALANKOR's instructions. That does not move responsibility away from ALANKOR.

2. What this website handles

Chapter I notification signup

If you enter your email address and submit the form, a record is created holding exactly the following and nothing else:

your email address, lower cased and trimmed
the date and time consent was recorded, set by the server
the identifier of the consent wording you were shown
the exact consent wording itself, copied from the server, not from your browser
the date the record was created and the date it was last changed
the source, which is the fixed value coming-soon
the status, which is subscribed until you withdraw
the date after which the record is deleted automatically, described in section 5

Your name, phone number, date of birth, postal address, gender, marketing preferences and IP address are not asked for and are not stored on this record. The record is filed under a one way hash of your address, so the address itself never appears in a database path.

The contact page

If you use the contact page, a record is created holding the email address you give so ALANKOR can reply, the subject you pick from the list, the message you write, the date it arrived, and the date after which it is deleted automatically. Nothing else. Your name is not asked for. Write only what you need to.

Abuse control

To stop the forms being used to flood the service, a short lived counter is kept. It is filed under a one way hash derived from the requesting IP address combined with a fixed internal string, and it holds only a request count and the time the counting window started. The IP address itself is not stored, and no email address is stored with it. The counter is set to expire after about twenty four hours and is then deleted automatically.

Delivering the website

Firebase Hosting and the related Google infrastructure process technical request information such as IP address, user agent, time and requested path in order to serve and protect the website. ALANKOR does not build visitor profiles from this.

Choices and preferences kept in your browser

A first party cookie records whether you chose Necessary Only or accepted Analytics. A small local value records that the opening sequence has already played, so a return visit uses the shorter one. Neither contains your name, your email address or any other direct identifier. Both are listed in full in the Cookie Notice.

Analytics

Google Analytics 4 does not load, and no analytics request leaves your browser, unless you choose Accept Analytics. If you do, the measurement is limited to five events: a page view, the opening sequence completing, the Notify Me control being used, a signup starting, and a signup succeeding.

Your email address is not sent to Google Analytics, and neither is any hash or identifier derived from it. No user identifier is set. Advertising storage, advertising personalisation, Google signals and ad personalisation signals are switched off and stay off whatever you choose.

The legal pages on this website, including the one you are reading, load no script at all. They set nothing and measure nothing.

3. Why

The only purposes are:

to send one notification when Chapter I opens
to keep a record of the consent that permits it
to protect the signup and contact routes from automated abuse
to remember your privacy choice and your opening preference
to measure basic use of this page, and only after you accept Analytics

What you send through the contact page is used only to:

receive and respond to general enquiries
receive privacy requests
receive requests to withdraw consent
receive deletion requests
receive grievances

The two are kept apart. Contact messages are stored separately from the Chapter I list. An address you give on the contact page is never added to the notification list, is never used for marketing, and the two stores are never combined or used for one another's purposes.

The Chapter I list is not a newsletter list. It is not used for offers, promotions, partner marketing or advertising personalisation, and it will not be quietly turned into any of those. A continuing mailing programme would need fresh consent, asked for separately and honestly.

4. Consent and withdrawal

The signup is based on your consent, given by submitting the form under the wording shown beside it.

You can withdraw at any time before the notification is sent, using the contact page and choosing the withdrawal option. Use the address you signed up with, so the right record can be found. Withdrawal is as easy as signing up was, and no reason is needed. On withdrawal the record is deleted or marked withdrawn, and either way the notification is not sent to you.

Your analytics choice can be changed at any time using the Cookies control in the footer of the home page. Turning Analytics off also clears the Google Analytics cookies from your browser straight away.

5. How long it is kept

Signup record: Kept until the Chapter I notification is sent, unless you withdraw first. Deleted within 30 days after that notification is sent. If Chapter I has not opened within 24 months of signup, the record is deleted unless a fresh lawful basis and appropriate notice or consent applies. That 24 month limit is also enforced automatically by the storage system, so a record cannot outlive its purpose because someone forgot.
Contact message: The clock starts when the message is dealt with, not when it arrives, so an unanswered request cannot expire before anyone has read it. Once a general enquiry is closed it is deleted automatically 12 months later. Once a privacy, withdrawal or deletion request is closed, the message text and your address are dropped straight away and only the record that a request of that kind was handled, and when, is kept; that record is deleted automatically 24 months later.
Abuse control counter: About 24 hours, then deleted automatically.
Cookie choice: Up to 180 days, then you are asked again.
Opening preference: Held in your browser until you clear your browser storage.
Analytics: Held by Google Analytics for the shortest retention period that ALANKOR's actual measurement needs allow.

6. Where it is processed

The signup and contact endpoints run in Google Cloud region europe-west1, in Belgium. Records are stored in a Cloud Firestore database located in the eur3 European Union multi region. Firebase Hosting serves the website from Google's global network.

Your browser has no access to these databases in either direction. The security rules deny every client read and every client write on every path, and only the endpoints themselves can write a record.

7. Processing outside India

ALANKOR is based in India and uses service providers that operate internationally, so the personal data described above is processed outside India, as set out in section 6.

Storing it in the European Union is an architectural choice made by ALANKOR. It is not presented here as something Indian law requires. Where the Central Government restricts transfers of personal data to a particular country or territory, ALANKOR will follow that restriction.

8. Your rights

Under the law in force and applicable to you, you may be able to:

ask what personal data about you is held and what is done with it
ask for it to be corrected or completed
ask for it to be erased
withdraw consent
raise a grievance and have it answered

Use the contact page, from the address you used, so the record can be located. ALANKOR will not ask you for identity documents unless they are genuinely necessary to verify a request. Because the only identifier held is your email address, proving control of that address is normally enough.

9. Grievances

If you are unhappy with how personal data has been handled here, use the contact page and choose the privacy option.

ALANKOR aims to review and respond to privacy and grievance requests within 30 days, or sooner where applicable law requires.

10. Children

This website is not aimed at children and does not knowingly collect data from them. No age information is requested. If you believe a child's data has been submitted here, use the contact page and it will be removed.

11. Security

the whole website is served over HTTPS, with strict transport security
the signup and contact routes are processed on the same origin, so there is no cross origin surface
input is validated on the server, not only in the browser
the browser has no database access at all; security rules deny every client read and write
both routes are rate limited
a restrictive Content Security Policy governs what the page may load
consent wording is held by the server and versioned, so a stored record cannot be forged from the browser
as little data is collected as the purpose allows

No internet service can promise absolute security, and this notice does not.

12. If something goes wrong

If personal data held here is or may have been accessed, disclosed, altered, lost or destroyed without authorisation, ALANKOR will contain the incident, investigate it, record what happened, and make whatever notifications the law in force and applicable at the time requires, to the people affected and to any authority entitled to be told.

13. Cookies and browser storage

Every cookie and every stored browser value used on this website is listed in the Cookie Notice.

14. The law this notice works to

ALANKOR is an India-based fashion brand, and Indian law is the primary basis for how personal data is handled here.

The law in force for this today is the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Those Rules require a body corporate that collects personal information to publish a privacy policy setting out what is collected, the purpose, who it is disclosed to, and the security practices followed. This notice is that policy.

Those Rules draw a line between personal information and a defined, closed list of sensitive personal data or information, which is passwords, financial information, health, sexual orientation, medical records and biometric information. This website collects none of those. It collects an email address, and on the contact page a message you choose to write. Several of the stricter duties in those Rules are written for that sensitive list and so do not apply to what is collected here. ALANKOR applies the substance of them anyway, because it is the right standard and because it is what the next law will require.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have been enacted and notified, and most of their substantive obligations are scheduled to commence on 13 May 2027. ALANKOR is building to that standard now rather than waiting for that date. That is a choice about how to build, not a claim that obligations which have not commenced already bind ALANKOR, and not a claim that any authority has reviewed or certified this website.

This website can be reached from outside India. Where the law of another country genuinely applies to a particular visitor, ALANKOR will deal with that on its own terms. Indian law being the primary basis here is not a claim that it is the only law that can ever apply to a publicly reachable website.

15. Changes

This notice will be updated when the website, the law or the way data is handled changes. The version number and issue date at the top show which text you are reading.

16. Contact

Brand and operator: ALANKOR
Country: India
Website: https://alankor.com
Contact, privacy requests and grievances: The ALANKOR contact page