Cookies and local storage

1.1. The Platform stores the following categories:

• protected Better Auth session cookies for sign-in and prevention of forged requests;
• a cookie or local interface-language setting;
• localStorage for the selected company, retail outlet or Supplier;
• localStorage for the basket and user drafts on a particular device;
• a service PWA cache for loading static resources and offline resilience of the shell.

1.2. Actual register of cookies and browser storage:

• aluber_locale — cookie; surfaces: website, buyer, supplier; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: language code: ru, kk or en; purpose: retain the selected interface language; basis: before writing: separate demonstrable consent or a precisely documented exception under Article 9 of the Law; choosing a setting is not, by itself, a legal basis; time of writing: when the language is changed; retention: 365 days or until deleted by the user; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• [__Secure-]better-auth.session_token, [__Secure-]better-auth.dont_remember (only for a “do not remember” session), [__Secure-]better-auth.session_data[.N] (only if cookie cache is enabled), [__Secure-]better-auth.account_data[.N] (only if account cookie is enabled) — cookie; surfaces: buyer, supplier; owner: aluber Operator; self-hosted Better Auth; fields: signed session token, “do not remember” mode flag, short-lived signed session cache, if enabled; purpose: sign-in, maintenance and protection of the user session; basis: approved complete pre-consent map: separate consent before the first request or a precisely documented exception under Article 9 of the Law; time of writing: after successful sign-in and when the session is refreshed; retention: session token: up to 7 days or until sign-out; short-lived cache: up to 5 minutes, if enabled; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• [__Secure-]aluber-admin.session_token, [__Secure-]aluber-admin.dont_remember (only for a “do not remember” session), [__Secure-]aluber-admin.session_data[.N] (only if cookie cache is enabled), [__Secure-]aluber-admin.account_data[.N] (only if account cookie is enabled) — cookie; surfaces: admin; owner: aluber Operator; self-hosted Better Auth; fields: signed administrative-session token, “do not remember” mode flag, short-lived signed session cache, if enabled; purpose: sign-in, maintenance and protection of the administrative session; basis: approved complete admin pre-consent map: a separate employee/admin basis or a precisely documented exception under Article 9 of the Law linked to the current Policy; time of writing: after successful administrator sign-in and when the session is refreshed; retention: session token: up to 7 days or until sign-out; short-lived cache: up to 5 minutes, if enabled; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• aluber.context — localStorage; surfaces: buyer; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: user ID, company ID, name and status, retail-outlet ID, name and status, city; purpose: restore the selected purchasing context on this device; basis: initial association of the user ID only under the approved complete pre-consent map; subsequent content under separate demonstrable consent to the current revision or a precisely documented exception under Article 9 of the Law; time of writing: after successful sign-in: an empty association with the user ID; then after a company or retail outlet is selected; retention: until sign-out, user change, context reset or manual clearing; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• aluber.supplier — localStorage; surfaces: supplier; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: user ID, Supplier ID, name and status, city; purpose: restore the selected Supplier account on this device; basis: initial association of the user ID only under the approved complete pre-consent map; subsequent content under separate demonstrable consent to the current revision or a precisely documented exception under Article 9 of the Law; time of writing: after successful sign-in: an empty association with the user ID; then after the Supplier account is selected; retention: until sign-out, user change, context reset or manual clearing; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• aluber.cart — localStorage; surfaces: buyer; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: user and purchasing-context ID, offer and product ID, name, SKU, unit, price, quantity and Order restrictions; purpose: retain the basket and restore it after the page is refreshed; basis: initial association of the user ID only under the approved complete pre-consent map; subsequent content under separate demonstrable consent to the current revision or a precisely documented exception under Article 9 of the Law; time of writing: after successful sign-in: an empty association with the user ID; then when a basket item is added, changed or removed; retention: until the basket is placed or cleared, sign-out or user change; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• aluber-paste-order — sessionStorage; surfaces: buyer; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: user ID, pasted Order text, identified candidates, selected quantities and user decisions; purpose: avoid losing analysis of the pasted Order when navigating to the catalogue or refreshing the page; basis: initial association of the user ID only under the approved complete pre-consent map; subsequent content under separate demonstrable consent to the current revision or a precisely documented exception under Article 9 of the Law; time of writing: after successful sign-in: an empty association with the user ID; then when the Order text is entered and analysed; retention: until the tab is closed, items are successfully added to the basket, sign-out or manual clearing; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• aluber.chat.recent-searches:* — localStorage; surfaces: buyer, supplier; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: user and selected company or Supplier ID in the scope key, counterparty ID and display name, time added to history; purpose: display recently selected chat-search results; basis: separate demonstrable consent to the current revision; after withdrawal, only a precisely documented exception under Article 9 of the Law; time of writing: when a counterparty is selected from search results; retention: 30 days after the last addition; an expired record is deleted when chat is next opened, on sign-out or on manual clearing; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• aluber.notification-sound — localStorage; surfaces: buyer, supplier; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: sound enabled flag, selected sound variant: chime, ping or pop; purpose: retain the notification-sound preference on this device; basis: separate demonstrable consent to the current revision; after withdrawal, only a precisely documented exception under Article 9 of the Law; time of writing: only when the user changes the sound preference; retention: until the preference is changed or the user deletes the site data; recipients: aluber Operator; cross-border transfer: depends on the device location: the local record is not transferred to a separate recipient, but a device outside Kazakhstan requires separate classification of the cross-border flow
• aluber-static-v1 — cacheStorage; surfaces: buyer; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: hashed JS/CSS files, icons and manifest; no HTML, API or auth; purpose: accelerate PWA loading and allow the shell to use static resources; basis: not applicable to the current composition: the cache contains only public static files without personal data; time of writing: on the first request for a permitted static resource; retention: until the next service-worker version is activated or manual clearing; recipients: aluber Operator; cross-border transfer: not applicable to the current composition without personal data; changing the composition requires a new assessment
• aluber-static-v1 — cacheStorage; surfaces: supplier; owner: aluber Operator (particulars are stated in the “About the Operator” section); fields: hashed JS/CSS files, icons and manifest; no HTML, API or auth; purpose: accelerate PWA loading and allow the shell to use static resources; basis: not applicable to the current composition: the cache contains only public static files without personal data; time of writing: on the first request for a permitted static resource; retention: until the next service-worker version is activated or manual clearing; recipients: aluber Operator; cross-border transfer: not applicable to the current composition without personal data; changing the composition requires a new assessment

2.1. Session and security cookies are necessary for the service requested by the user and are not used for advertising. Disabling them generally makes authentication and protected operations impossible.

2.2. The technical necessity of a cookie is not an independent exception to the Law of the Republic of Kazakhstan on Personal Data and Their Protection. Before recording an identifier or associated log, the Operator documents a specific Article 9 basis or obtains demonstrable consent; without a basis, optional recording and further storage do not occur.

2.3. Until consent is obtained, a public page operates in minimal mode: it does not load optional analytics or advertising, create a visitor profile or store a persistent identifier. Unavoidable network data are not included in a long-term log without a separately approved purpose, basis and period.

2.4. Local settings are not transferred by themselves but become accessible to scripts from the same origin. Do not use a shared device without signing out.

3.1. Until separately enabled and documented, the Platform does not set optional advertising or behavioural cookies.

3.2. Server-side or client-side error monitoring may be enabled only after provider details are completed in the Policy, the processing location is reviewed and removal of personal data from events is configured.

3.3. If optional analytics are introduced, an “accept” or “reject” choice will be shown before loading, settings may be changed, and rejection will not restrict core functions.

4.1. On sign-out from a Buyer or Supplier account, the Platform automatically deletes all managed user records in localStorage and sessionStorage and terminates session HttpOnly cookies through the authentication service. The selected language is retained separately.

4.2. The “Clear device data” action is available in the Buyer profile and Supplier settings. It removes the stored context, basket, pasted-Order draft, recent chat searches and static PWA cache. The account, Orders, documents and other server data are not deleted.

4.3. Exact names, fields, purposes, bases, times of writing, retention periods, recipients and cross-border-transfer information are stated in the actual register above. Changing the register requires a new revision of this Notice and a new canonical SHA-256.

4.4. A user may also delete cookies and site data using browser controls. Clearing data on a shared device does not replace signing out.

5.1. Questions about cookies and data: webberdyev@gmail.com. General support: webberdyev@gmail.com.