Cookie Policy
Effective date: 2026-07-20
This Cookie Policy explains how YAStuning OÜ uses cookies and similar technologies on shoptoai.com and within the ShopToAI service. Read it together with the Privacy Policy.
1. What cookies we use
We use strictly-necessary and functional cookies without consent, and analytics cookies only if you accept them. We do not use advertising or marketing cookies.
| Name | Type | Purpose | Duration | Set by |
|---|---|---|---|---|
| shoptoai_access | Strictly necessary (httpOnly) | Keeps you authenticated (short-lived access token) | ~15 minutes | First party |
| shoptoai_refresh | Strictly necessary (httpOnly) | Renews your session securely (rotated on each use) | ~7 days | First party |
| shoptoai_consent | Strictly necessary | Remembers your analytics cookie choice | 6 months | First party |
| Cloudflare Turnstile | Strictly necessary | Protects sign-in/registration/reset forms against bots | Session | Cloudflare |
| shoptoai_locale | Functional | Remembers your chosen interface language (EN/PL) | 1 year | First party |
| shoptoai_theme | Functional | Remembers your light/dark theme | 1 year | First party |
| _ga, _ga_* | Analytics (consent required) | Google Analytics - measures how the site is used so we can improve it | up to 2 years |
Authentication cookies are set with the httpOnly, Secure (in production) and SameSite=Lax flags to protect against theft and CSRF.
2. Analytics cookies and your consent
Under the ePrivacy rules and GDPR, strictly-necessary cookies - those required to deliver a service you explicitly requested, such as keeping you logged in and protecting forms - do not require prior consent. Purely functional preference cookies that only remember a choice you made (your language and theme) are likewise treated as not requiring consent under prevailing EU regulatory guidance.
Analytics cookies are different: they are not strictly necessary, so we set them only after you opt in. On your first visit we show a consent banner with equally prominent Accept and Reject options. Google Analytics loads only if you accept; if you reject or ignore the banner, no analytics cookies are set and no data is sent to Google. Accepting analytics also means your data is sent to Google LLC in the United States, protected by the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer. Our legal basis for analytics is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
3. Third-party cookies
- Cloudflare may set a strictly-necessary cookie via the Turnstile bot-protection widget on authentication forms.
- Google Analytics sets analytics cookies only after you consent (see Section 2).
See our Sub-processors for details of both.
4. Managing cookies
You can accept or reject analytics cookies from the consent banner, and change your choice anytime via "Cookie settings" in the footer. Strictly-necessary cookies cannot be switched off, as the Service cannot run without them; disabling them in your browser will prevent you from logging in. You can also clear cookies via your browser settings at any time, which will sign you out.
5. Changes
We will update this policy when our use of cookies changes.
6. Contact
Questions: [email protected].