01

1. Controller and scope

Alejandro García Martínez, tax ID 49170885J, with tax address at Calle Cronista Carlos Valcarcel, 8, 30120 Murcia, controls vuelvy.com and the decision to add the technologies described here. This policy applies to the public site and to subdomains or applications that expressly link to it. Contact privacy@vuelvy.com for privacy matters.

02

2. What cookies and similar technologies are

A cookie is a small file stored or accessed in a browser by a site or third party. This policy also covers local or session storage, pixels, tags, web beacons, identifiers and equivalent technologies that can recognise a device, remember a choice, protect the service, measure interactions or attribute campaigns. Not every such technology necessarily places a cookie.

03

3. Rules and basis for use

Cookies strictly required to provide a requested function or enable communication are used without consent where the legal exemption applies. Analytics, experience and advertising technologies are enabled only after a valid affirmative choice. Subsequent personal-data processing is explained in the Privacy Policy and relies, as appropriate, on consent, performance of the service, a legal obligation or a documented legitimate interest.

04

4. How technologies are classified

Cookies may be first party —sent from Vuelvy even where a provider assists— or third party —sent from another domain—; session or persistent; and necessary, functional, analytics or advertising according to purpose. A stated duration is the declared or configured maximum and may be shortened by the browser, provider, manual deletion or consent withdrawal.

05

5. Current status and activation rule

In the published configuration, Vuelvy stores analytics and advertising preferences separately. Google Analytics 4 loads only after analytics is accepted; Meta Pixel and TikTok Pixel load only when the corresponding identifier is configured and advertising is accepted. Microsoft Clarity and Google Ads remain disabled until configured and consent exists for their category. No optional category is preselected on a first visit.

06

6. Necessary cookies and signals

These technologies keep the choice, protect forms and enable core functions. Blocking them in the browser may prevent the preference from being remembered or a security measure from working.

  • vuelvy_consent · Alejandro García Martínez/Vuelvy · first-party and necessary · stores the version and accepted or rejected choice · 180 days
  • Cloudflare Turnstile · Cloudflare · necessary when shown on a form · analyses technical signals and may use storage strictly required to distinguish legitimate traffic from abuse · limited by the check and provider settings
  • vuelvy.session_token or __Secure-vuelvy.session_token · Vuelvy · first-party and strictly necessary for sign-in, administration and account areas · authenticates the session and preserves business isolation · up to 12 hours, with expiry after 2 hours of inactivity under the effective policy
07

7. Google Analytics 4

With analytics consent, GA4 shows visited pages, traffic source, device, interaction and aggregate conversions. Vuelvy does not load its tag while analytics is rejected. Event and user retention in the property is configured for up to 14 months and is separate from cookie lifetime.

  • _ga · Google Analytics · first-party, analytics · distinguishes pseudonymous users · up to 2 years
  • _ga_<ID> · Google Analytics · first-party, analytics · maintains session or property state · up to 2 years
  • Browser limits may shorten these periods; Google notes, for example, limits without a return visit of 400 days in Chrome and 7 days in Safari
08

8. Microsoft Clarity

When enabled and analytics and experience are accepted, Clarity may produce behavioural metrics, heatmaps and session replay. Form fields remain masked and deliberate capture of passwords or free text is not configured. Microsoft requires a valid consent signal for full functionality in the EEA, UK and Switzerland.

  • _clck · Microsoft Clarity · first-party, analytics · preserves the site's pseudonymous ID and preferences · normally 1 year
  • _clsk · Microsoft Clarity · first-party, analytics · joins page views into a session · normally 1 day
  • CLID · Microsoft · third-party, analytics · identifies when Clarity first saw the browser · normally 1 year
  • ANONCHK · Microsoft · third-party, operational · indicates whether MUID is transferred to ANID; Clarity states it does not use ANID · normally 10 minutes
  • MR · Microsoft · third-party, operational · indicates whether MUID should be refreshed · normally 7 days
  • MUID · Microsoft · third-party, analytics and operational · identifies browsers across Microsoft services · normally 1 year
  • SM · Microsoft · third-party, session · synchronises MUID across Microsoft domains · session
09

9. Google Ads and advertising measurement

Only with advertising consent may we enable conversion measurement, attribution, remarketing or Google Ads audiences. Consent Mode keeps ad_storage, ad_user_data and ad_personalization denied until that choice exists. The published configuration does not send advertising pings without consent.

  • _gcl_au · Google Ads · first-party, advertising · measures and attributes conversions · normally 90 days
  • _gcl_<ID>, including _gcl_aw or _gcl_dc variants · Google Ads · first-party, advertising · retains click information and attributes conversions · normally 90 days
  • IDE, test_cookie and other cookies on google.com or doubleclick.net · Google · third-party and advertising · delivery, frequency, measurement or compatibility testing · duration stated by Google for each product
10

10. Meta Pixel

Meta Pixel is enabled only with advertising consent to measure actions, attribute campaigns, build audiences and limit or personalise ads. It may process URL, referrer, event, time, IP, browser and identifiers. We do not send passwords, free text or special-category data; advanced matching is enabled only with specific information and a sufficient lawful basis.

  • _fbp · Meta · first-party, advertising · distinguishes browsers for measurement and advertising · normally 3 months
  • _fbc · Meta · first-party, advertising · retains the Facebook click identifier when present in the URL · normally 3 months
  • Other facebook.com or instagram.com cookies may exist if you visit those services or if a social feature is embedded in future; they are governed by Meta's settings and policy
11

11. TikTok Pixel

TikTok Pixel is enabled only with advertising consent to measure and optimise campaigns, attribute conversions, retarget audiences and personalise advertising. Its configuration may include first- and third-party cookies; the effective selection is documented before activation.

  • _ttp · TikTok · first- or third-party, advertising · measurement, optimisation and personalisation · 13 months from last use
  • ttcsid_ and ttcsid_<pixel ID> · TikTok · first-party, advertising · associate events with a session or pixel · 13 months from last use
  • ttclid · TikTok · first-party, advertising · retains the click ID and attributes conversions · 13 months from last use
  • _pangle · TikTok Pangle, where applicable · third-party, advertising · measurement and personalisation across the Pangle network · 13 months from last use
12

12. Data, profiles and consequences

Analytics technologies may associate pages, campaigns, clicks, scrolling, device, browser, IP and approximate location with pseudonymous identifiers. Advertising technologies may also attribute conversions, build segments and connect a visit to a campaign or provider account. Rejecting does not prevent browsing or requesting a diagnosis; it reduces measurement, personalisation and attribution.

13

13. Providers that do not necessarily involve cookies

The service subprocessors list is broader than the cookie inventory. Vercel provides hosting and delivery; OVHcloud hosts PostgreSQL and its backups in Milan, European Union; Vuelvy directly operates Versity object storage on its Mac mini in Spain, European Union; Klaviyo operates CRM and communications; Cal.com manages bookings; Apple, Google Wallet and Shopify support contracted integrations. We do not claim that all place cookies on the public site: they may process requests, logs or API data. If embedded content allows non-essential browser storage, it is blocked until consent and added to the inventory.

14

14. Third-party links and sites

Links to Cal.com, Apple, Google, Shopify, Instagram, TikTok or other services open sites controlled by their owners. A cookie placed by them after you leave Vuelvy or sign in to their service is governed by their own policies and preferences. Vuelvy cannot delete from its domain a cookie directly placed by a third party.

15

15. How consent is obtained and recorded

On a first visit we show a visible layer before loading non-essential technologies. Accepting requires an affirmative action; continued browsing or silence is not consent. Reject is given equivalent prominence. The vuelvy_consent cookie records the version and choice for 180 days to respect and evidence it, without turning that proof into an advertising identifier.

16

16. Changing or withdrawing your choice

Open Cookie settings from the footer at any time. When a category is withdrawn, we stop sending new events and its tags do not load on later visits; where technically possible, we also remove the associated first-party cookies. Withdrawal does not automatically erase data already lawfully processed by a provider, but it prevents future processing based on that consent.

17

17. Browser settings

Browsers let you inspect, block or remove cookies by site and configure signals such as Global Privacy Control where available. Blocking every cookie can affect security, sessions or preference storage. Browser settings are complementary: Vuelvy maintains its own way to accept, reject and revoke non-essential technologies.

18

18. Transfers, review and contact

Google, Microsoft, Meta, TikTok, Cloudflare and other providers may process information outside the European Economic Area. As appropriate, we use an adequacy decision, the EU–US Data Privacy Framework for certified entities, Standard Contractual Clauses and supplementary measures. We periodically review tags and will update this policy and request a new choice if purposes or third parties change materially. Contact privacy@vuelvy.com with questions or rights requests. The Spanish version governs where legally permitted. LinkedIn Insight Tag loads only with advertising consent on public marketing pages to measure visits and attribute confirmed enquiries to ads. LinkedIn may receive URL, referrer, IP, browser, time and advertising identifiers and use first-party or third-party cookies. We do not send form values, email, phone or URL parameters and do not enable enhanced matching. Withdraw consent from the footer. Current cookie names and lifetimes: https://www.linkedin.com/legal/l/cookie-table. Privacy policy: https://www.linkedin.com/legal/privacy-policy.