Cookies and Local Storage
Most cookie policies are long because most sites have a lot to declare. Ours is short for the same reason.
The three categories, one of which is empty
| Category | Do we use it? | Can you refuse? |
|---|---|---|
| Strictly necessary | Yes | No — the site does not work without them, and the law does not require consent for them |
| First-party analytics | Yes, and only after you say yes | Yes. Refusing changes nothing about the site |
| Advertising and tracking | No. None at all | There is nothing to refuse |
The third row is not a formality. We run no advertising, we have no pixels, no conversion APIs, no custom-audience uploads and no data brokers. There is no third-party cookie set anywhere on this site.
What is actually stored
| Name | Category | What it is for | How long |
|---|---|---|---|
| bp_session | Strictly necessary | Keeps you signed in | Until you sign out, or 30 days |
| bp_csrf | Strictly necessary | Stops another site submitting forms as you | The browser session |
| bp_consent | Strictly necessary | Remembers which of the choices below you made, so we do not ask again | 12 months |
| bp_anon | First-party analytics | A random identifier so we can tell one visit from two. Set only if you agree, never shared, and disconnected from your account after 90 days | 12 months |
Nothing outside the first three is set before you choose. Not on the marketing pages, not on this page, not anywhere. That is stricter than the common reading of the rules and it is much easier to be sure of.
Local storage
We use the browser's local storage for one thing: keeping a photograph upload alive if your connection drops mid-way, so you do not have to start the capture again. It holds the upload's progress, not the image. It is cleared when the upload finishes or fails.
Changing your mind
Whatever you chose, you can change it, and the change takes effect immediately rather than at the next visit. Clearing your browser's cookies for this site also resets the choice, and we will ask again.
If your browser sends a Global Privacy Control signal, we treat it as an objection under Article 21 and turn first-party analytics off for you without asking. That signal comes from a body of law we are not subject to, and we honour it anyway, because it is an unambiguous statement of what you want.
Analytics, and why they are ours
Our analytics run on our own servers, in our own database, and the data never leaves them. We count page views, we measure whether a page is slow, and we look at where people give up in the purchase flow. We do not build a profile of you, we do not follow you to other sites — we could not, having no presence on them — and we do not sell anything to anyone.
See also the Privacy Policy and the list of everyone who processes your data at /legal/subprocessors.
Changes to this page are dated and kept in the version history.
Questions: dpo@beautyprivilege.com.