1. What cookies and similar technologies are
Cookies are small text files that your browser stores on your device at a website's request. Browser local storage, tracking pixels and advertising-platform scripts work in a similar way; below we call all of them "cookies". Cookies set on our own domain are first-party; cookies set from another company's domain are third-party. Either way, the data from Google, Meta and TikTok cookies reaches those companies, and what they do with it afterwards is governed by their own policies.
2. The four categories
- Necessary. The Site does not work without them: session and sign-in, the record of your cookie choice, bot protection for forms, load balancing, and the Film player on the Delivery Page. No consent is needed.
- Functional. Remember the language you chose for the Site.
- Analytics. Google Analytics 4 shows us which pages are visited, from which devices and where people stop — so we can make the Site clearer.
- Marketing. Meta Pixel, TikTok Pixel and Google Ads measure whether our advertising worked and let us show it to people who have already shown interest in the Studio.
For visitors from outside Ukraine, functional, analytics and marketing cookies run only with your consent. For visitors from Ukraine, the procedure described in section 4.1 applies.
3. The cookies we use
| Name | Provider | Purpose | Duration | Category | Party |
|---|---|---|---|---|---|
__Secure-better-auth.session_token |
the Studio | session and sign-in on the Site | session / up to 30 days | necessary | first-party |
cookie_consent |
the Site's own consent banner | stores your choice in the cookie banner | 12 months | necessary | first-party |
cf_clearance (Cloudflare Turnstile) |
the Studio | bot protection for forms, load balancing | session | necessary | first-party |
vc_aid |
Studio | an anonymous random identifier for our internal visit statistics (which parts of the Site are viewed, where people stop during checkout); never shared with anyone, not sent to Meta | until you close the browser; 180 days with your analytics consent | necessary (audience measurement, within the session only) / analytics (longer duration) | first-party |
cf_clearance, __cf_bm |
Cloudflare, Inc. | protects the Site from bots and abuse (Turnstile), delivers video and images via CDN | 30 minutes / up to 12 months | necessary | third-party |
lang |
the Studio | remembers the Site language (UA/EN) | 12 months | functional | first-party |
_ga |
Google (Google Analytics 4) | distinguishes visitors | 2 years | analytics | first-party, set by Google's script |
_ga_* |
Google (Google Analytics 4) | keeps the state of a browsing session | 2 years | analytics | first-party, set by Google's script |
_gid |
Google (Google Analytics 4) | distinguishes visitors within a day | 24 hours | analytics | first-party, set by Google's script |
_gcl_au |
Google (Google Ads) | links an ad click to a later action on the Site | 90 days | marketing | first-party, set by Google's script |
_fbp |
Meta Platforms (Meta Pixel) | distinguishes browsers for measuring Meta advertising | 90 days | marketing | first-party, set by Meta's script |
_fbc |
Meta Platforms (Meta Pixel) | stores the click identifier from a Meta ad | 90 days | marketing | first-party, set by Meta's script |
_ttp |
TikTok (TikTok Pixel) | identifies the browser for measuring TikTok advertising | 13 months | marketing | first-party, set by TikTok's script |
_tt_enable_cookie |
TikTok (TikTok Pixel) | enables the TikTok Pixel | 13 months | marketing | first-party, set by TikTok's script |
Durations are the providers' typical values as of this version; the current list is always available in the "Cookie settings" window.
4. How consent works
- The banner. For visitors from outside Ukraine: on your first visit you see three buttons: "Accept all", "Reject all", "Settings" — each works with a single click. No pre-ticked boxes.
- Nothing before consent. For visitors from outside Ukraine: until you choose, only necessary cookies run; the Google, Meta and TikTok scripts do not load at all.
- Google Consent Mode v2. Your choice is passed to Google as the signals
analytics_storage,ad_storage,ad_user_dataandad_personalization. Without your consent they stay "denied" (for visitors from Ukraine, see section 4.1). - 12 months. We store your choice — consent or refusal — for 12 months and do not ask again sooner, unless we add a new cookie category or a new provider (for visitors from Ukraine, see section 4.1).
- Changing your choice. At any time, via the "Cookie settings" link in the footer of every page. Withdrawing consent is as easy as giving it.
- Your browser. You can delete or block cookies in your browser settings. Without necessary cookies, the Site or the Delivery Page may not work properly.
- Global Privacy Control. If your browser sends a GPC signal, we treat it as "Reject all" for analytics and marketing cookies.
4.1. Visitors from Ukraine
If you visit the Site from Ukraine (the country is determined by Cloudflare from your IP address; we do not store the address for this purpose), instead of the consent window you see the notice "We use cookies to run the site and for advertising" (in Ukrainian: «Ми використовуємо cookies для роботи сайту й реклами»). In this case functional, analytics and marketing cookies are switched on immediately. You can switch off any category at any time with a single click — via "Settings" in the notice or "Cookie settings" in the footer; after that, the corresponding scripts no longer load. The Global Privacy Control signal applies to visitors from Ukraine as well.
5. Where the data goes
Google, Meta and TikTok process the data from analytics and marketing cookies in the United States and other countries. The transfer rests on your consent (for visitors from Ukraine, see section 4.1) and, contractually, on the European Commission's Standard Contractual Clauses (SCC) or, where the provider is certified, on the EU‑US Data Privacy Framework. Details are in our Privacy Policy.
Separately from cookies: after an Order is paid, our server notifies Meta of a "Purchase" event on the basis of the consent you give at checkout — see the Privacy Policy, clause 7.4.
6. Regional notes
- EU / EEA. Article 5(3) of the ePrivacy Directive (2002/58/EC) and the GDPR apply; consent must be freely given, specific, informed and unambiguous. Our EU representative: not appointed; for data-protection matters contact [email protected]. You may complain to the supervisory authority of your country.
- United Kingdom. PECR applies, as amended by the Data (Use and Access) Act 2025: the law now allows statistical cookies without prior consent, with a right to opt out. We deliberately keep one standard for all visitors from outside Ukraine — analytics cookies only with your consent. The regulator is the ICO. Our UK representative: not appointed; contact [email protected].
- Ukraine. The Law of Ukraine "On Personal Data Protection" (2297‑VI) applies. On your first visit we inform you that we use cookies and let you refuse non-essential cookies at any time (section 4.1). Complaints go to the Ukrainian Parliament Commissioner for Human Rights.
- United States. We honour the Global Privacy Control signal as a refusal of analytics and marketing cookies.
- Canada, Australia and other countries. The same banner and the same rules.
7. Contact
Questions about cookies: [email protected]. We acknowledge receipt within 2 business days and reply within 5 business days. Responsible person: Kotliar Yana Mykhailivna, Berezan, Kyiv Oblast, Ukraine.
8. Changes
We announce material changes to this Policy on the Site, and to Customers also by e-mail, 14 days before they take effect. If we add a new cookie category or a new provider, the banner asks for your consent again (for visitors from Ukraine, see section 4.1).
Version history: 1.0 — 10 September 2026 — first edition; 1.1 — 28 September 2026 — description of the banner, the vc_aid cookie, the server-side paid-Order event for Meta; 1.2 — 11 October 2026 — cookie notice for visitors from Ukraine (section 4.1); editorial correction of 11 October 2026 (terms and version unchanged) — only the town is now given in the Studio's details.