# HGM compliance setup — current static edition

Updated October 18, 2026. Implementation and launch checklist; not a legal opinion or certification. Scope is the corporate static site. Separate apps and media properties need their own verified notices and operations.

## What is active

- HTML/CSS/JavaScript pages and browser-local utilities.
- Forms prepare an email or download a text request. Visitors must send the email themselves. No web submission, server receipt, customer record, automatic email, purchase, or entitlement is created.
- No analytics, retargeting, advertising pixels, session replay, cross-site profiling, or sale/sharing of information for behavioral advertising is implemented.
- Two local preference records: hgm-display-v1 and hgm-static-privacy. Display selections, hero choices, browser-tool inputs and clock/timezone information are not transmitted by these controls.
- Circadian appearance, reduced-motion priority, reading controls, accommodation links and privacy choices.
- Public configuration is in assets/site-config.js. It documents the implemented settings; it does not protect against scripts independently added by a host or third party.

## Before publishing

1. Confirm legal entity, business contact, lawful mailing address, applicable Los Angeles registration/tax requirements, and actual provider contracts/logging/retention.
2. Review privacy, terms, accessibility, advertising and subscription copy against real operations. The legal package is a review draft, not an adopted contract.
3. Verify every product’s current availability, features, quotas, approved price, billing model and legacy commitments. No unverified price or Offer schema is authorized by this package.
4. Confirm publisher/operator/seller and asset rights for each of the seven participating network domains. The approved inventory contains seven network domains.
5. Adopt the operating procedures in operating-practices.md and configure a monitored inbox and request log.
6. Complete manual browser, keyboard, screen-reader, reflow, contrast, text-spacing and accommodation-process review. The widget supplements base design.
7. Confirm the production hostname, HTTPS and redirects. This review package remains noindex and robots-disallowed; intentionally change those only for an approved public launch.

## Forms and consent

See forms-and-consent.md. Do not bundle a privacy/accessibility request with marketing consent or acceptance of paid terms. The current site has no marketing sign-up. Local preference dismissal is not consent to tracking. Adding a checkbox is not a substitute for configuring a compliant processing system.

## Secure form backend — not included

To enable durable submissions, build and test server validation, request limits, origin controls, abuse protection, appropriate authentication for administration, encrypted transport, restricted storage, deletion/retention, incident response and a reliable acknowledgment process. Update the actual notices before collecting data. Keep credentials server-side. Do not point forms at an arbitrary endpoint and assume compliance.

## Payments — not included

Complete account linking, approved all-in price disclosure, separate recurring consent, consent evidence, provider receipts, signed webhooks, app entitlements, renewal/change notices, refunds and effective cancellation. A static success page cannot confirm a charge or grant access. See offerings-and-ownership.md. Existing external product subscriptions are not changed by this package.

## Sources and applicability

Official reference URLs appear in sources.md. Assess actual legal coverage and jurisdictions with qualified counsel; no blanket “compliant with all laws” badge is supported.