birthright logo
birthright
Sign in
Back to home
Legal · Public

Cookie & Tracking Notice

First draft — pending counsel ratification

This is a first draft published for transparency and public comment. It uses accepted standard language for its type but has not yet been ratified by outside counsel. It will be replaced with the ratified version — you'll see the banner disappear when it does.

Last updated August 11, 2026

Cookie & Tracking Notice

Effective date: February 2026. This notice explains the cookies and similar technologies we use on birthright.live.

1. Categories We Use

  • Strictly necessary (always on) — sign-in session, shopping cart, CSRF protection, load balancing. Cannot be disabled without breaking the site.
  • Preferences — remember your consent choices and locale.
  • Analytics (only with your consent) — anonymised page-view and performance metrics so we can improve the site.
  • No advertising cookies. We do not run behavioural ad networks.

2. Your Controls

  • The consent banner on your first visit lets you accept all or reject non-essential cookies. You can change your choice any time via Cookie Settings in the site footer.
  • Your browser lets you delete cookies or block them by site.
  • We honour Global Privacy Control (GPC) signals.

3. Third-Party Providers

Purpose Provider Cookie type
Payment Stripe Necessary
Session security Cloudflare Necessary
Product analytics (Self-hosted) Analytics (opt-in)

4. Retention

Session cookies expire when you close the browser. Persistent cookies expire in ≤ 12 months. Consent records: kept for 24 months to prove compliance.

5. Contact

privacy@birthright.live.

EU / UK Compliance Addendum

Where an EU or UK resident's mandatory local rights conflict with this document, the local rules prevail. Key points:

  • GDPR (EU) 2016/679 and UK GDPR govern personal-data processing. Lawful bases: contract necessity, legitimate interests (with opt-out), consent (marketing / non-essential cookies), and legal obligation.
  • ePrivacy Directive (2002/58/EC) — non-essential cookies require prior opt-in consent (see our Cookie Notice).
  • Consumer Rights Directive (2011/83/EU) — 14-day right of withdrawal on distance sales of goods and most digital services. Fully-performed digital content with prior consent may lose that right.
  • Digital Services Act (Reg. 2022/2065) — community features (posts, DMs, disputes) fall in scope. Single point of contact: eu-contact@birthright.live.
  • Cross-border transfers — EU SCCs (2021/914) + UK IDTA with a transfer-impact assessment per sub-processor.
  • DSAR window — 30 days (extendable to 90) at privacy@birthright.live.
  • Supervisory authority — EU: your national DPA (https://edpb.europa.eu). UK: ICO (https://ico.org.uk).
Download .docxQuestion about this document? Contact us