Cookie policy

Vavus measures how its websites are used, to improve them. What runs before you choose depends on where you are. In most EU and EEA countries, and wherever your location is unknown, our website servers count page loads from the request your browser already sends (page, referring website, browser and operating system family, device type, language and country), with no cookie, script or identifier. In France, Spain, the Netherlands, Italy, the United Kingdom, Canada, Turkey, China, South Korea, Argentina, the United Arab Emirates and Saudi Arabia (and India from 13 May 2027), an anonymous Vavus script also counts visits, time on page, scrolling, page speed and named actions after a visible notice; it stores nothing on your device. Everywhere else, Vavus measures visits, pages, clicks, campaign tags and the advertising network a visit came from with its own first-party cookie, after a notice. If you accept, Vavus measures the same detail in every country, including where you click on a page, and Google Analytics runs. Our team may receive a private notification when a measured visit starts. Short links on our websites (addresses that start with /go/) count each click before sending you on, the same anonymous way: the referring website, browser and operating system family, device type and country, with the daily key described below and no cookie, script or identifier. Reject, Global Privacy Control and Do Not Track stop that count too.

Anonymous statistics use a key that our server calculates from the website, your IP address and your browser type together with a random value that changes every day. The random value is deleted once the day's totals are calculated, so the key cannot be recreated or linked to another day. The key is never stored in your browser, your IP address is not stored, and only totals are kept: visitors, visits, bounce rate, time on site and breakdowns by page, source and device. Country is estimated from the request IP at the time of the request. Location is an estimate, and does not determine every privacy right you may have.

A necessary preference cookie (sv_privacy on ShopVavus or vb_privacy on Vavus Space), or vavus_cookie_consent in local storage on Vavus AI, remembers your choice for 180 days. If you reject, a necessary vavus_no_stats cookie records that objection for 180 days so our servers stop counting your page loads too. Where first-party measurement runs before a choice, or after you accept, vavus_site_visitor remembers a random browser identifier for up to 90 days, and vavus_website_session in session storage groups activity until 30 minutes of inactivity or the tab closes. Only after you accept, Google Analytics uses _ga and _ga_* cookies, configured for up to 90 days, and Vavus AI may save referral attribution in vavus_first_touch for up to 90 days.

Vavus keeps individual website sessions, events, click positions and related visitor-notification records on its server for 30 days, anonymous visit records for at most two days, and totals (hourly page counts and daily visitor, visit, bounce and duration totals) for 13 months. Notifications already delivered to your phone follow its notification settings. Browser identifiers expire after at most 90 days and privacy choices after 180 days. Google Analytics processes consented measurements separately under its privacy and data-processing terms, including network information it receives directly. Its event and user retention follows the relevant property settings; aggregate Google reports and existing report history may be retained longer. These Vavus retention periods do not describe Google report retention.

Accepting optional analytics is not a condition of browsing or sending an inquiry. Reject is available alongside Accept, and Cookie settings in the footer changes your choice at any time. Rejecting stops all Vavus website measurement for your browser, including anonymous statistics and server page counts, and clears the website analytics identifiers in your browser. Global Privacy Control and Do Not Track have the same effect. Withdrawal does not erase previously lawful records immediately; they remain subject to retention and applicable deletion rights. Anonymous totals cannot be separated into your individual activity.

Detailed website analytics, Google Analytics, click positions and, in the EU, the EEA and the other countries listed above, any browser identifier rely on consent. Server page counts in the EU and EEA, and anonymous statistics in France, Spain, the Netherlands and Italy, rely on our legitimate interest in understanding and improving our websites, within the national audience-measurement exemptions where they apply; you can object at any time with Reject. UK anonymous statistics rely on the statistical-purposes exception, with notice and an opt-out at no cost. Elsewhere, first-party measurement relies on notice with an opt-out, or on legitimate interest where that is the local basis. Necessary preference storage remembers a choice you request. Security and abuse prevention are separate from optional analytics.

Our hosting records the IP address, page, browser type, and time of each request for security and reliability. That is a server record, not device storage. See the privacy policy.