Cookie Policy

1. What Cookies Are

A cookie is a small text file a website asks your browser to store on your device. Cookies can remember preferences, keep you signed in, measure traffic, or follow you between websites for advertising.

Related technologies do similar jobs without being cookies. Local storage and session storage keep data in the browser itself; pixels and tags are tiny files or scripts that report activity back to a provider. This policy covers all of them, not just cookies in the strict sense.

2. The Four Categories

Cookies and similar technologies are conventionally grouped into four categories. We list all four so you can see exactly which ones apply to this Website — and which do not.

Necessary

Required to deliver and secure the website. They cannot be switched off because the site cannot operate safely without them. On this Website: none set by us. If our network provider performs bot filtering, a short-lived security cookie may be set — see Section 3.

Functional

Remember choices you make, or power an optional feature you have chosen to use, such as a booking widget. On this Website: none set by us. Cal.com may set its own on our booking page only — see Section 4.

Analytics

Measure how many people visit and which pages they read, so the site can be improved. On this Website: we use Vercel Web Analytics, which is cookieless and stores nothing on your device — see Section 5.

Marketing

Build a profile of your interests to target advertising, usually across multiple websites. On this Website: none, at all. We run no advertising and no remarketing, and we never will without updating this policy first.

3. Necessary Cookies

This Website sets no necessary cookies. We do not use sign-in, shopping carts, or server-side sessions, so there is nothing that requires a cookie to function.

Form protection is handled without cookies. Our contact form is protected by a hidden honeypot field, by server-side rate limiting keyed to a one-way hash of the sender's IP address (held in memory for three minutes, then deleted), and by Cloudflare Turnstile — an invisible bot check. Turnstile is used in its privacy-preserving mode: it sets no cookie and stores nothing on your device. It analyses browser and network signals in the moment to distinguish a person from a script, and Cloudflare states it does not use this for advertising or cross-site tracking. Most visitors see nothing at all; a small number see a brief checkbox.

Note: if we later place a security or bot-filtering proxy in front of the Website, that provider may set a short-lived first-party security cookie. We will list it here before enabling it.

4. Functional Cookies

We set no functional cookies. One optional feature involves a third party that may set its own:

Cal.com booking widget — booking page only, and only if you ask for it

Our booking page offers Cal.com's scheduling tool, which may set its own cookies to operate the widget and remember your progress through a booking. It does not load automatically. The page shows a short explanation and a button, and nothing is requested from Cal.com and no cookie of theirs can be set unless you press it. If you would rather not, the same page offers to take your booking by message instead. Any cookies that do result are set by Cal.com under its own cookie and privacy policies, not by us, and no other page on this Website loads Cal.com.

Cloudflare Turnstile — contact page only

Our contact form runs an invisible bot check supplied by Cloudflare. It sets no cookie and writes nothing to your device, but your browser does contact Cloudflare to complete the check, which transmits your IP address and basic browser information to them for that purpose. It runs only on the contact page.

5. Analytics — Vercel Web Analytics (Cookieless)

We use Vercel Web Analytics to understand how many people visit the Website and which pages are read. We chose it specifically because it does not use cookies.

It sets no cookie, and writes nothing to local storage or session storage. Instead, Vercel derives an anonymous hash from the incoming request to count a visitor once, and that hash is discarded after 24 hours. The result is that you cannot be tracked from one day to the next, and cannot be tracked from this Website to any other.

What we can see is aggregate only: page views, which pages are popular, roughly where traffic comes from, and general device or browser type. We cannot see who you are, and we cannot single you out. Vercel does not use this data for advertising.

6. Marketing and Advertising Cookies

There are none. To be explicit, this Website does not use Google Analytics, Google Tag Manager, Google Ads, Microsoft Clarity, the Meta (Facebook) Pixel, LinkedIn Insight Tag, Hotjar, TikTok Pixel, or any other advertising, remarketing, or session-recording technology.

Our Facebook page is linked from the footer as an ordinary hyperlink. No Facebook code runs on this Website, and nothing is sent to Facebook unless you choose to click that link.

We do not sell or share personal information for cross-context behavioral advertising, as those terms are defined under United States state privacy laws.

7. Browser Storage We Do Use

The Website stores two values in your browser's sessionStorage, and nothing else anywhere:

Scroll position

The vertical scroll position of the page you are reading, so that refreshing the page returns you to the same place.

Privacy notice dismissal

A single flag recording that you closed the short privacy notice shown on your first page view, so it is not shown to you again. It records only that the notice was dismissed. Because it lives in sessionStorage rather than a cookie, it is erased when you close the tab, and the notice will appear once more on a future visit.

Neither is a cookie, and neither is ever transmitted to us or to anyone else. They contain no personal information, stay entirely on your device, and are erased automatically when you close the browser tab. We use no localStorage at all.

8. Consent — and Why There Is No Cookie Banner

Consent is required before storing or reading information on your device, unless that storage is strictly necessary to provide a service you asked for. This is the rule under the EU and UK ePrivacy regime and the principle behind most cookie banners you see.

This Website places nothing on your device that requires consent. It sets no cookies, uses no localStorage, and our analytics is cookieless. There is therefore no lawful basis to ask for — and a banner offering to accept or reject cookies that do not exist would be misleading rather than helpful.

You may see a short notice on your first page view. It is not a consent banner and has no accept or reject buttons, because there is nothing to accept or reject. It states that we set no tracking cookies, links to this policy, and closes when you acknowledge it. Closing it stores the single sessionStorage flag described in Section 7 and nothing else.

The one thing on this Website that genuinely requires consent is the Cal.com booking widget, because Cal.com can set its own cookies. That consent is asked where it applies rather than in a site-wide banner: the booking page describes what loading the widget does and loads nothing from Cal.com until you choose to. See Section 4.

If we ever add a technology that does require consent — cookie-based analytics or any advertising tool — we will implement a compliant consent banner before switching it on, and we will update this policy first. Section 9 describes how that banner would have to behave.

9. If a Consent Banner Becomes Necessary

Should we introduce any non-essential cookie in future, the consent mechanism will meet the following standard, which is what GDPR and the ePrivacy Directive require:

• No non-essential cookie or script will load until consent is given — consent must come before placement, not after
• 'Reject Non-Essential' will be offered at the same level, with the same prominence and the same number of clicks as 'Accept All' — refusing must be as easy as agreeing
• 'Manage Preferences' will allow each category to be accepted or refused independently, with every non-essential category switched off by default
• No pre-ticked boxes, and continuing to scroll or browse will never be treated as consent
• The choice will be stored so returning visitors are not asked repeatedly, and consent will be re-requested if the purposes change or after 12 months
• Consent can be withdrawn at any time, as easily as it was given, through a permanently reachable link in the footer
• A record of what was consented to, and when, will be retained as proof of consent

10. Controlling Cookies in Your Browser

Independently of any website, your browser gives you direct control over cookies. You can view what has been stored, delete it, block cookies from specific sites, or block all third-party cookies. These settings are usually under Privacy and Security.

Chrome: Settings › Privacy and security › Third-party cookies. Safari: Settings › Privacy. Firefox: Settings › Privacy & Security. Edge: Settings › Cookies and site permissions.

Blocking all cookies will not break this Website, because we do not set any. It may affect the Cal.com booking widget, since that tool needs its own cookies to complete a booking.

Most browsers also offer a 'Do Not Track' or Global Privacy Control signal. We do not run the kind of tracking those signals are designed to stop, so there is nothing on this Website for them to disable.

11. Changes to This Cookie Policy

We will update this policy whenever we change the technologies used on the Website. The current version is always posted on this page with its effective and last-updated dates.

Any change that introduces a cookie requiring consent will be reflected here before that technology goes live.

12. Contact Us

Questions about this Cookie Policy can be sent to:

Entity

NuuLux LLC

Email

NuuLuxStudios@gmail.com

Phone

(910) 557-2032

Website

nuulux.net (formerly nuuluxstudios.com)