Cookie Policy

Last Updated: October 12, 2026

1. What This Policy Covers

This policy explains the cookies and similar browser storage (local storage and session storage) that Area 13 uses, why we use them, and how you control them. Area 13 is operated by AREA 13 DEVELOPMENT Company For Trading (CR 7055365667), which is the controller of the personal data this storage involves under the Personal Data Protection Law (PDPL). The complete list of every item we store, with its purpose and how long it lasts, is at the end of this page. This policy should be read with our Privacy Policy.

2. Categories

We group everything we store into four categories:

Strictly necessary — keeps you signed in, keeps your cart and checkout intact, protects your account against forged requests, and remembers the choices you make yourself — your privacy choices, your site language, and your display currency. The site cannot work without these, so they cannot be switched off. We rely on the performance of our contract with you and our legitimate interest in a secure service.
Functional — optional conveniences beyond the choices you make yourself. Nothing in this category is in use today.
Analytics and diagnostics — measures how the site is used and helps us diagnose errors. Session replay, when enabled, masks text and blocks images before anything leaves your browser.
Marketing — measures and personalises advertising.

Functional, analytics, and marketing storage is used only with your consent, and nothing in those categories runs until you allow it.

3. Your Choices

When you first visit, a banner asks for your choice. You can accept all categories, reject all optional categories, or choose category by category. You can change or withdraw your choice at any time from Privacy choices in the site footer — withdrawing is as easy as agreeing, and it takes effect immediately. We keep a record of the choice you made, and of the version of this notice you were shown, as proof of your consent.

If your browser sends a Global Privacy Control signal, we treat it as a refusal of the optional categories.

4. Third-Party Storage

Some items are set by service providers we rely on:

Stripe (card payments) sets strictly necessary cookies used to prevent fraud when you pay by card.
Google Analytics and Sentry (error diagnostics) are loaded only if you allow the analytics category.

These providers may process data outside Saudi Arabia. We transfer data to them in line with the PDPL and its Regulation on Personal Data Transfer outside the Kingdom, as described in our Privacy Policy.

5. Browser Controls

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop sign-in, the cart, and checkout from working.

6. Contact Us

If you have questions about this policy:

Email: privacy@areathirteen.com
Phone: +966 56 04 100 13

7. Updates to This Policy

We update this policy whenever we change what we store. The list below is generated from the same register that controls what the site is allowed to store, so it always matches the site.

Strictly necessary

sessionid
Identifies your signed-in session so your account, cart and checkout persist between page loads.
Provider
Area 13
Duration
14 days
Stored as
Cookie
csrftoken
Security token that proves a form or request came from this site, blocking cross-site request forgery.
Provider
Area 13
Duration
Until you close your browser
Stored as
Cookie
trusted_device
Remembers that you chose to trust this device, so two-factor verification is not re-requested on it.
Provider
Area 13
Duration
30 days
Stored as
Cookie
beta_access
Records that you presented a valid invitation token for the restricted beta, so the access gate lets you through.
Provider
Area 13
Duration
30 days
Stored as
Cookie
env_access
The staging/testing equivalent of beta_access — records that you cleared the environment access gate.
Provider
Area 13
Duration
30 days
Stored as
Cookie
maint_bypass
Lets staff holding the bypass key reach the site while maintenance mode is on.
Provider
Area 13
Duration
12 hours
Stored as
Cookie
checkout-state
Holds your in-progress checkout (selected address, current step, draft order) so a reload does not lose it.
Provider
Area 13
Duration
Until you clear your browser data
Stored as
Local storage
area13.buildo.conversation
Keeps your support chat transcript for the current browsing session so the conversation survives navigation.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
area13.vendorTutorial.board / area13.vendorTutorial.open
Keeps the practice data of the dashboard tutorial you are taking, and whether it is open, so a reload or a pause resumes the course where you left it.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
vendor-application-draft:<user>
Autosaves your in-progress vendor application so you can resume where you left off. Your password, IBAN, national ID and uploaded files are never stored here.
Provider
Area 13
Duration
Until you clear your browser data
Stored as
Local storage
vendor-application-draft-session
Random identifier that ties an in-progress vendor application to your visit, so a draft left on a shared computer is not shown to the next person.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
a13.pendingTwoFactor
Carries your pending two-step sign-in challenge from the Google sign-in return page to the sign-in page, then is deleted on first read.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
checkout-resume-step
Keeps a page reload during checkout on the payment-method step instead of sending you back to the address review.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
currency_exchange_rates
Caches the public FX reference rates used to render prices, so every page does not re-fetch them.
Provider
Area 13
Duration
Until you clear your browser data
Stored as
Local storage
currency_exchange_rates_timestamp
Records when the FX rate cache above was last refreshed.
Provider
Area 13
Duration
Until you clear your browser data
Stored as
Local storage
geolocation_permission_denied
Records that you declined the location prompt, so the address forms stop asking for this session.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
startup_ready
A flag noting the app finished its readiness check, so the loading screen is not replayed on every navigation.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
area13:chunk-reload-attempted
Guards the one-time automatic reload after a failed code download, so a broken deploy cannot trap you in a reload loop.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
django_language
Remembers the site language you chose (English or Arabic) so every page, and the server, answers in it.
Provider
Area 13
Duration
1 year
Stored as
Cookie
a13:pending-language-preference
Holds a language change for a moment while the page reloads, so saving it to your account is not lost mid-switch.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
currency
Remembers the display currency you selected.
Provider
Area 13
Duration
Until you clear your browser data
Stored as
Local storage
a13_consent
Records your privacy choices (which optional cookie categories you allowed) so the banner does not ask again and nothing optional runs without your consent.
Provider
Area 13
Duration
180 days
Stored as
Cookie
a13.terms-notice.dismissed.<version>
Remembers, for this tab only, that you closed the updated-terms notice so it does not reappear on every page.
Provider
Area 13
Duration
Until you close the tab
Stored as
Session storage
__stripe_mid
Set by Stripe to detect and prevent payment fraud on the checkout page. Identifies the device across payment attempts.
Provider
Stripe, Inc.
Duration
1 year
Stored as
Cookie
__stripe_sid
Set by Stripe to link the requests of a single payment attempt together for fraud detection.
Provider
Stripe, Inc.
Duration
30 minutes
Stored as
Cookie

Functional

We do not store anything in this category.

Analytics and diagnostics

_ga
Assigns a random identifier to your browser so Google Analytics can count you as one returning visitor across pages and visits.
Provider
Google LLC
Duration
2 years
Stored as
Cookie
_ga_<container-id>
Google Analytics 4 session-state cookie: tracks session start and count for this specific property.
Provider
Google LLC
Duration
2 years
Stored as
Cookie
sentryReplaySession
Identifies a Sentry Session Replay recording — a replayable capture of your interactions with the page, sampled at 10% of sessions and 100% of sessions that hit an error. Text is masked and media blocked, but the interaction trace is recorded and sent to Sentry.
Provider
Functional Software, Inc. (Sentry)
Duration
Until you close the tab
Stored as
Session storage

Marketing