Cookiebeleid

1. What cookies are

A cookie is a small text file stored on your device by your browser. Similar technologies include local storage, session storage, pixels and software development kits. This policy covers all of them and calls them all "cookies".

First-party cookies are set by vitalleafrx.com. Third-party cookies are set by another domain, such as an analytics or advertising provider.

2. Our consent model

Strictly necessary cookies are set as soon as you arrive, because the site cannot work without them. Every other category is off by default and is set only after you accept it in the cookie banner.

The banner offers "Accept all", "Reject all" and granular settings, with equal prominence. Rejecting is one click, exactly like accepting. Closing the banner without choosing is treated as a rejection.

We record the consent you gave, the categories you accepted, the timestamp and the policy version, so we can prove consent was valid and so we can honour it on your next visit.

3. Strictly necessary cookies

These run without consent because they are required to deliver the service you asked for. Turning them off would break checkout.

• vlr_session — keeps you signed in and links your cart to your browser — session — first party
• vlr_cart — stores cart contents and the region you are shopping in — 30 days — first party
• vlr_agegate — records that you passed the 21+ entry gate so you are not asked on every page — 30 days — first party
• vlr_consent — stores your cookie choices and the consent timestamp — 12 months — first party
• vlr_csrf — protects forms against cross-site request forgery — session — first party
• [PSP]_fraud — payment provider's fraud and 3-D Secure signals during checkout — session to 30 days — third party

4. Preference cookies

These remember choices you make so the store behaves the way you left it. They are optional.

• vlr_region — remembers your storefront region and currency — 12 months — first party
• vlr_lang — remembers your display language — 12 months — first party
• vlr_theme — remembers light or dark mode — 12 months — first party
• vlr_recent — remembers recently viewed products — 90 days — first party

5. Analytics cookies

Analytics cookies tell us which pages are used, where checkout fails and how fast the site loads. We use the results in aggregate to improve the store.

Where the provider supports it, we enable IP truncation, disable cross-site tracking and turn off data sharing for the provider's own purposes.

• [ANALYTICS]_id — distinguishes one visitor from another — up to 13 months — third party
• [ANALYTICS]_ses — groups page views into a single visit — 30 minutes — third party
• vlr_perf — samples page-load and error metrics — 7 days — first party

6. Marketing and advertising cookies

These measure whether an advert or an email led to a visit or a purchase, and they can be used to show you our products on other sites. Advertising options for cannabinoid products are restricted on most large platforms, so this category may be empty in your region.

They are never set without your explicit consent, and never for anyone who has not passed the 21+ gate.

• [AD PLATFORM]_click — attributes a purchase to an advert click — up to 90 days — third party
• [EMAIL PLATFORM]_open — records that a marketing email was opened — 30 days — third party
• vlr_ref — records the affiliate or referral code used — 30 days — first party

7. Withdrawing or changing consent

Open "Cookie settings" in the site footer at any time. Changes take effect immediately and non-essential cookies are cleared when you switch a category off.

You can also delete cookies in your browser settings, use private browsing, or set your browser to reject third-party cookies. Deleting vlr_consent makes the banner appear again on your next visit.

Withdrawing consent does not make earlier processing unlawful, and it does not remove strictly necessary cookies.

8. Do Not Track and Global Privacy Control

We honour the Global Privacy Control signal where your browser sends one: it is treated as a rejection of analytics and marketing categories.

The older Do Not Track header is not consistently defined across browsers, so we do not rely on it alone.

9. Cookies and personal data

Data from cookies may be personal data under the GDPR — an identifier plus a device is enough. Where that is the case, the Privacy Policy applies to it in full, including your rights of access, erasure and objection.

Analytics and advertising providers may transfer data outside the EEA. The transfer safeguards described in the Privacy Policy apply.

10. Changes and contact

We review the cookie inventory each quarter and whenever we add or remove a third-party tool. This page shows the effective date of the current version.

Questions about cookies: privacy@vitalleafrx.com.