Privacy Policy

1. Scope

This Privacy Policy applies to the official website of the Polynesian Kingdom of Atooi at kingdomofatooi.com and any subdomain operated by the Kingdom. It does not apply to third-party websites linked from this site, whose privacy practices are governed by their own policies.

2. Information you submit through forms

• The contact form — your name, your email address, the type of inquiry you choose, the details asked for that type (such as your organisation, publication, the nature of your request and any deadline) and your message. A general inquiry asks for your name, your email address and your message only, and is recorded with a note that no type was selected. The entry is stored in the Kingdom's database with a reference number and can be read only by signed-in administrators. No copy is emailed and no acknowledgement email is sent; the page shows what was recorded and the reference you may quote.
• The archive access request form — your name, your email address, your organisation, your role or title, your country, your affiliation, the purpose of the request, your statement of intent, and the record you are asking about, carried from the page you came from. It is stored with a reference number, can be read only by signed-in administrators, and is prepared internally and sent onward only by an administrator, by hand.
• The misuse report form — the document concerned, where you saw it, your description, any file you attach (held in private storage), any contact details you choose to give, your browser type, and your network address with its last part removed. The report is stored, is never published, and can be read only by administrators. A receipt number is shown on screen; no email is sent.

No other public form on this site writes to the Kingdom's database.

3. The research guide

When you use the automated research guide, your question and the guide's answer are stored together with a session identifier, your browser type and your network address with its last part removed. To produce the answer, your question, the earlier messages in that conversation and excerpts of published pages are sent to an AI service (the Lovable AI Gateway, which uses a Google Gemini model). Your network address and browser details are not sent to that service. Stored conversations can be read only by the Kingdom's senior administrators.

4. Translation

Translated text is served from the Kingdom's own store of translations. Where a translation does not yet exist, the page text — not anything about you — is sent to the same AI service to translate it. Your language choice is kept in your browser.

5. Visitor measurement

The site records page visits. For each visit it stores the pages viewed and the time spent on them, the page that referred you, your browser and device type, screen size, language and time zone, any campaign tags in the address, and page-loading performance measurements. It also stores your network address with its last part removed. We also store a fingerprint derived from your full network address. The same address produces the same fingerprint, allowing visits to be linked over time. This information is not anonymous. When an address is seen for the first time, it is sent from the Kingdom's server to a location service (ipapi.co), and the country, region, city, approximate coordinates and internet provider it returns are stored with the visitor record. A random visitor identifier is kept in your browser's storage until you clear it. Administration screens are not measured. This information is used to understand how the site is used and to detect abuse, and can be read only by the Kingdom's administrators and staff.

6. Administrative accounts

For administrators of the site, an email address and sign-in credentials are handled by the backend platform, and administrative actions are logged with the account, the action, the browser type and the masked network address.

7. Cookies and browser storage

The site sets one cookie, which remembers the layout of the administrative interface for seven days and does nothing for ordinary visitors. Otherwise the site uses your browser's own storage rather than cookies:

• needed for the site to work: the entry gate for the site, and sign-in tokens for administrators;
• your preferences: language, audio on or off, whether you have dismissed an announcement, whether the seal animation has played, and a basket for the supporters' store where it is offered;
• measurement: the visitor identifier described above and, for the length of your visit, a session identifier and campaign tags;
• performance: a cache of translated text.

No advertising or third-party tracking cookies are set by the Kingdom.

8. Services and resources provided by others

To display pages, your browser connects directly to some third parties, which receive your network address and browser details: Google Fonts (typefaces); OpenStreetMap and CARTO (map tiles on the atlas and representation map, which also learn which area of the map you view); and YouTube in its privacy-enhanced mode where a video is embedded. On the Kingdom's side, the site is hosted by Lovable and runs on the Supabase platform provided through Lovable Cloud, which stores the database, files and sign-ins and runs the site's functions; the AI service described above generates guide answers and translations; and ipapi.co performs the location lookup. Each of these providers handles the data it receives under its own terms, which the Kingdom does not control. The Kingdom does not sell, rent or trade personal information. The Kingdom may disclose information where it considers this required by law or necessary to protect the safety of people or the integrity of its records.

9. Logs kept by providers

Beyond the records described above, the hosting and backend platforms keep their own technical logs of requests, function runs and sign-ins, as do the third parties listed. The Kingdom cannot read or delete most of these logs and does not control how long they are kept.

10. Retention

Form submissions and guide conversations are retained as part of the institutional record of the Kingdom. No automatic deletion schedule runs on them; they are removed only when an administrator deletes them.

Visitor measurement records, including the location data described above, are scheduled for deletion after 365 days, and administrative action logs after 180 days, by a daily task.

11. Your rights

You may ask for access to, correction of, or deletion of personal information held about you through the secure inquiry form, quoting the reference number shown when your original submission was recorded, or describing the visit concerned. Such requests are read in the Office's internal records system; no automatic acknowledgement is sent, and any reply is written by an administrator. The Kingdom will act on such requests in good faith, subject to its institutional record-keeping obligations.

12. Children

The website is not directed to children under thirteen years of age and the Kingdom does not knowingly collect personal information from children.

13. Changes to this Policy

This Policy may be revised from time to time. The date at the head of this page indicates the most recent revision.

14. Contact

Questions concerning this Privacy Policy may be directed to the secure inquiry form on the contact page.