Cookie Policy
Last updated: 9 October 2026
This Cookie Policy explains what cookies and similar technologies biohance.eu uses, who sets them, what they do, how long they last and how you can control them. It supplements our Privacy Policy, which describes how we handle your personal data more broadly.
1. What are cookies
A cookie is a small text file that a website stores in your browser when you visit. Cookies let the site remember things about your visit, such as your preferences, your login status or which pages you looked at, so the site can work properly and give you a better experience on your next visit.
Cookies are set either by the site you are visiting ("first-party cookies") or by other companies whose services are embedded in the page ("third-party cookies"). First-party cookies can only be read by the site that set them. Third-party cookies can be read by the company that set them across every site where their code runs.
2. Other similar technologies
Besides cookies, we also use the following technologies that work in a similar way:
- Session storage is a browser feature that stores data for the duration of a single browser tab. When you close the tab, the data is deleted. It is similar to a cookie but cannot be sent to a server automatically and does not persist after the tab is closed. We use session storage to carry your checkout information (name, email, payment status) from the checkout page to the pages that follow.
- Local storage is a browser feature that stores data with no expiry date. The data stays in your browser until you or the website deletes it. It is similar to a persistent cookie but can hold more data and is not sent to the server with every request.
- Pixels (web beacons) are tiny, transparent images or snippets of code embedded in a page. When the page loads, the pixel sends a request to a server, telling it that the page was viewed. Pixels are often used together with cookies to track visits and conversions. The Meta Pixel on our site is an example.
- JavaScript tags are pieces of code that run in your browser when a page loads. They can set cookies, read cookies, send data to servers and interact with the page. Google Tag Manager, Google Analytics and our own analytics script are loaded this way.
- Server-side events are requests sent from our server to a third-party server (such as Meta) when something happens, like a purchase. The Meta Conversions API is an example. Server-side events do not rely on your browser or cookies, but they may use data that was originally collected through cookies (such as a click identifier stored in a cookie).
When we say "cookies" in this policy, we mean all of these technologies unless we say otherwise.
3. What cookies we use
The table below lists every cookie and storage item used on biohance.eu, who sets it, what it does, its category and how long it lasts.
3.1 Strictly necessary cookies
These cookies are needed for the site to work. Without them, parts of the site (specifically the checkout and payment flow) will not function. You cannot opt out of strictly necessary cookies because they are not used for tracking or advertising. They are used only to deliver the service you asked for.
| Name | Set by | What it does | Duration |
|---|---|---|---|
| Session storage | Biohance (first party) | Carries your name, email address and payment status from the checkout page to the pages that follow (upsell pages, booking page, thank-you page). This data stays in your browser tab and is not sent to any external server. It is deleted when you close the tab. | Until you close the tab |
| __stripe_mid | Stripe (third party) | A device identifier used by Stripe, our payment processor, to detect and prevent payment fraud. Stripe sets this cookie on every page where its JavaScript is loaded. It helps Stripe distinguish legitimate cardholders from fraudulent actors by recognising a returning device. This cookie is required for Stripe's fraud detection to work, and without it, payments may be blocked or flagged as suspicious. | 1 year |
| __stripe_sid | Stripe (third party) | A session identifier used by Stripe during the payment flow. It tracks the current browsing session for fraud scoring purposes. It helps Stripe assess the risk of a transaction by looking at the behaviour during the session (pages visited, time on page, interaction patterns) and comparing it to known fraud patterns. | 30 minutes |
3.2 Analytics cookies
These cookies help us understand how people use the site: which pages they visit, how long they stay, where they come from and where they drop off. We use this information to improve our pages, our offers and the overall experience. Analytics cookies do not identify you by name. They use pseudonymous identifiers (randomly generated strings) to distinguish one visitor from another.
| Name | Set by | What it does | Duration |
|---|---|---|---|
| _trk | Biohance (first party) | When you arrive on the site from an ad, a link, a social media post or a search result, the URL often contains tracking parameters (such as UTM tags, gclid, fbclid or other click identifiers). This cookie stores those parameters so that if you come back later and make a purchase, we can attribute the purchase to the original ad or link that brought you. The cookie is set by our own code and the data is sent only to our own analytics system, not to any third party. | 90 days |
| fa_vid | Biohance (first party) | A randomly generated visitor identifier used by our first-party analytics system. It lets us count how many unique visitors the site gets and distinguish a new visitor from someone who has been here before. The identifier is a random string with no personal information in it. The data collected with this cookie is processed only in our own analytics system, hosted on Vercel, and is not shared with any third party. | 1 year |
| fa_lc | Biohance (first party) | Records the last campaign, ad source or referral link the visitor came from. If a visitor arrives from one ad campaign on Monday and a different one on Thursday, this cookie updates to the most recent source. This lets us attribute a purchase to the most recent advertising touchpoint, which is the standard "last-click" attribution model used in digital advertising. | 1 year |
| fa_lt | Biohance (first party) | Records the timestamp of the visitor's most recent visit. Used together with fa_vid to measure how often visitors return and how much time passes between visits. This helps us understand whether our content brings people back or whether most visits are one-time. | 1 year |
| _ga | Google Analytics (third party) | The main Google Analytics 4 cookie. It contains a randomly generated client identifier that Google Analytics uses to aggregate usage data: page views, sessions, time on page, scroll depth, events and geographic region (derived from IP address, which is anonymised). The data is pseudonymised and appears in Google Analytics reports as aggregate statistics, not as information about individual people. Google may also use this data for its own purposes, such as benchmarking and improving its analytics service. | 2 years |
| _ga_* | Google Analytics (third party) | A companion cookie to _ga. The suffix (the part after _ga_) varies by Google Analytics measurement ID. This cookie persists session state across page loads, so that Google Analytics can group a series of page views into a single session and measure session duration and session-level events. Without this cookie, every page load would look like a separate session. | 2 years |
3.3 Advertising and measurement cookies
These cookies are set by advertising platforms (Google Ads and Meta) to measure whether our ads lead to visits and purchases. They connect a click on one of our ads to a visit or purchase on our site. This lets us see which ads are working and how much each purchase cost us in ad spend. These cookies do not show you ads on our site (we don't run ads on our own pages). They help the ad platforms report back to us on the performance of ads we run on their platforms (Google Search, YouTube, Facebook, Instagram).
| Name | Set by | What it does | Duration |
|---|---|---|---|
| _gcl_au | Google Ads (third party) | When you click one of our Google ads (Search, Display or YouTube), Google appends a click identifier called "gclid" to the URL. This cookie stores that gclid so that if you come back later (within 90 days) and make a purchase, Google Ads can match the purchase to the original ad click. Google uses this to report conversions in our Google Ads account and to optimise our ad campaigns (showing our ads to people more likely to buy). Google also uses conversion data for its own purposes, such as improving its ad delivery algorithms. | 90 days |
| _fbp | Meta / Facebook (third party) | A unique browser identifier set by the Meta Pixel. When the Pixel loads on a page, it sends a "PageView" event to Meta, together with the _fbp value, the page URL and basic device information. When a purchase happens, a "Purchase" event is sent with the transaction amount and product name. Meta uses the _fbp cookie to match these events to a Meta user profile (if you are logged into Facebook or Instagram in the same browser) and to attribute the event to the Meta ad you clicked or saw. This data appears in our Meta Ads Manager as conversion reports and is also used by Meta to optimise our ad delivery and for Meta's own advertising and product improvement purposes. | 90 days |
| _fbc | Meta / Facebook (third party) | When you click one of our Meta ads (on Facebook or Instagram), Meta appends a click identifier called "fbclid" to the URL. The Meta Pixel reads this fbclid from the URL and stores it in the _fbc cookie. If you make a purchase later in the same browser, the Pixel sends the _fbc value to Meta along with the purchase event, so Meta can match the purchase to the specific ad click. This is the click-through attribution mechanism for Meta ads. Without this cookie, Meta can only attribute purchases to ad views (view-through attribution), not to ad clicks. | 90 days |
4. The Meta Pixel and the Conversions API
The Meta Pixel is a snippet of JavaScript code loaded through Google Tag Manager on every page of the site. When a page loads, the Pixel fires a "PageView" event to Meta's servers, sending the _fbp and _fbc cookie values, the page URL, the referrer, the user agent string (browser and device information) and the IP address. When a purchase is completed, the Pixel fires a "Purchase" event with the transaction value, currency and product name.
In addition to the Pixel, we use the Meta Conversions API (CAPI), which is a server-to-server connection. When a purchase happens, our server sends the purchase data directly to Meta's server, including a SHA-256 hashed version of the buyer's email address. Hashing means the email is converted into a fixed-length string of characters that cannot be reversed back into the original email. Meta uses this hashed email to match the purchase to a Meta user account, if one exists with that email, even if the browser cookies are blocked or have expired.
The Pixel and the CAPI work together to give us a more complete picture of which Meta ads lead to purchases. We use this data to decide which ads to keep running, which to change and how much to spend.
Meta processes this data as a joint controller with us for ad measurement, and as an independent controller for its own purposes, including improving its ad delivery, building advertising audiences and developing its products and services. You can read more about how Meta uses this data in Meta's Data Policy, available in your Facebook or Instagram privacy settings.
5. Google Tag Manager
Google Tag Manager (GTM) is a tag management system. It does not collect personal data itself. Its job is to load and manage the other scripts on the site (Google Analytics, Google Ads conversion tracking and the Meta Pixel) based on rules we set up. GTM decides which script loads on which page and when, but the data collection is done by the scripts it loads, not by GTM itself. GTM may send its own operational data (such as tag firing times and error rates) to Google for debugging and service improvement, but this data does not include any information about you as a visitor.
6. How to control cookies
6.1 Browser settings
Every major browser lets you manage cookies. You can block all cookies, block only third-party cookies, delete existing cookies, or set your browser to ask before accepting each cookie. The exact steps depend on your browser:
- Google Chrome: Settings, then Privacy and Security, then Cookies and other site data. You can block third-party cookies, clear cookies on exit, or see and delete individual cookies.
- Mozilla Firefox: Settings, then Privacy and Security. Firefox offers Standard, Strict and Custom protection levels. Strict blocks most third-party tracking cookies by default.
- Apple Safari: Preferences, then Privacy. Safari blocks cross-site tracking by default and offers an option to block all cookies. On iOS, go to Settings, then Safari, then Privacy and Security.
- Microsoft Edge: Settings, then Cookies and site permissions, then Manage and delete cookies and site data. Edge offers Basic, Balanced and Strict tracking prevention levels.
If you block all cookies, the site will still load and you can read all the content, but you will not be able to complete a payment. Stripe requires its cookies (__stripe_mid and __stripe_sid) for fraud detection, and without them, the payment form may not work or your payment may be flagged as suspicious.
If you block only third-party cookies (the setting available in most browsers), the Stripe cookies, the Google Analytics cookies, the Google Ads cookie and the Meta cookies will be blocked. Our own first-party cookies (_trk, fa_vid, fa_lc, fa_lt) will still work because they are set by biohance.eu, not by a third party. The site will function normally, but our analytics will be incomplete and ad platforms will not be able to attribute purchases to ads.
6.2 Opt-out tools from Google and Meta
You can opt out of specific tracking by Google and Meta without blocking all cookies:
- Google Analytics: Install the Google Analytics Opt-out Browser Add-on, available for Chrome, Firefox, Safari, Edge and Opera. When installed, it tells Google Analytics not to collect data about your visits. You can also disable personalised ads in your Google Ad Settings (available when signed into your Google account).
- Meta: Go to your Facebook account settings, then Privacy, then Ad Preferences, and adjust the settings for "Ads shown off of Facebook" and "Data about your activity from partners". On Instagram, the same settings are available under Settings, then Ads. These settings control whether Meta uses data from sites like ours to personalise the ads you see, but they do not stop the Pixel from firing page view events.
6.3 Do Not Track
Some browsers offer a "Do Not Track" (DNT) signal, which is a setting that tells websites you prefer not to be tracked. There is no universally accepted standard for how websites should respond to DNT signals, and the Site does not currently alter its behaviour in response to a DNT signal. The cookie management methods described above are the most effective way to control tracking on this site.
6.4 Mobile devices
On mobile devices, you can control cookies through your mobile browser's settings (the same steps as described for desktop browsers above). You can also control ad tracking at the operating system level:
- iOS: Settings, then Privacy and Security, then Tracking. You can turn off "Allow Apps to Request to Track", which prevents apps from asking for your IDFA (advertising identifier). This does not affect website cookies in Safari.
- Android: Settings, then Privacy (or Google), then Ads. You can opt out of ad personalisation or delete your advertising ID.
7. Consent and legal basis
Under the GDPR, cookies fall into different categories, and the legal basis for using them depends on their purpose:
- Strictly necessary cookies (Stripe session and fraud cookies, our checkout session storage) do not require your consent because they are essential for the service you asked for (making a payment). The legal basis is Article 6(1)(b) GDPR (performance of a contract) and the ePrivacy Directive Article 5(3) exemption for cookies that are strictly necessary.
- Analytics and advertising cookies (our own analytics, Google Analytics, Google Ads, Meta Pixel) are based on our legitimate interest in measuring our advertising and improving our pages (Article 6(1)(f) GDPR). You can object to this processing at any time by managing cookies as described in section 6.
If you have questions about how we handle cookies, email support@biohance.eu.
8. Third-party cookie policies
The third-party cookies on our site are set by Stripe, Google and Meta. Each of these companies has its own cookie policy and privacy policy that governs how they use the data they collect through their cookies. We encourage you to review their policies:
- Stripe: Stripe's cookie policy is available on stripe.com. Stripe uses cookies for fraud prevention, authentication and analytics of its own payment services.
- Google: Google's privacy policy and cookie information are available at policies.google.com. Google uses cookies across its products for analytics, advertising, personalisation and service improvement.
- Meta: Meta's cookie policy is available in your Facebook or Instagram account settings. Meta uses cookies for authentication, security, advertising, measurement and product improvement.
We do not control the cookies that these third parties set or the data they collect through them. If you have questions about their cookies, contact them directly.
9. Changes to this Cookie Policy
We may update this Cookie Policy from time to time if we add new cookies, remove existing ones, change how we use them, or if the law requires changes. When we update this policy, we change the "Last updated" date at the top. We encourage you to review this page periodically.
10. Contact
For questions about this Cookie Policy or about how we use cookies, contact:
Notrel LLC
Miami Beach, Florida, USA
Email: support@biohance.eu