Cookies

Language preference

The first-party lulu_locale cookie records the displayed language for up to one year and updates when that language changes, including when you open /en or /es directly. It is used for language preference only, not advertising or profiling.

Protected administration

The first-party __Host-lulu-admin-session cookie is issued only after an administrator signs in. It is Secure, HttpOnly and SameSite=Strict and lasts up to four hours. It protects access to the content editor; visitors do not need an administrator account to browse the website. Draft editing may also use storage in the administrator's browser tab.

Remembering your analytics choice

Where optional analytics is enabled, the first-party lulu_analytics_consent cookie remembers your explicit choice as v1.accepted or v1.rejected for 180 days. It uses SameSite=Lax and Secure on HTTPS and does not itself identify a visitor for analytics. Accept and Reject have equal prominence; neither browsing nor watching or skipping the welcome film counts as consent. Optional analytics begins only after acceptance and after the film has ended or been skipped.

Optional session storage

Only after consent, optional sessionStorage under lulu_analytics_session:v1 stores a random browser-tab session identifier, session timing and short validated first-touch source, medium and approved campaign labels. No full URL, query or referrer is stored. It is renewed after 30 minutes of inactivity or a maximum of 24 hours and is removed on withdrawal; it is not used for advertising or cross-site tracking. The server stores only a daily keyed HMAC of the identifier for analytics, with event records kept for 14 days and aggregate statistics for 90 days before scheduled deletion. A separate limited blocked-session hash honours withdrawal as explained in Privacy. These statistics measure visits and link clicks, not an exact person or a confirmed sale.

External services

The website does not use Google Analytics, Meta Pixel or advertising cookies. Videos and photographs are website content. Maps, social networks and messaging services open only when you follow an external link and may use their own cookies after you visit them. Telegram is used by the operator for limited aggregate reports and service alerts, not as an embedded feed or browser tracker.

Managing cookies and withdrawing consent

Use Cookie settings in the footer to accept, reject or withdraw optional analytics at any time without losing access to the website. Withdrawal removes lulu_analytics_session:v1 and stops future analytics events; the rejected choice is remembered in lulu_analytics_consent. You can also delete or block cookies in your browser: deleting lulu_locale resets the language and deleting the administrator session signs the editor out. Questions: office@fantastic-familysl.com. Last updated: 28 October 2026.

Contact the boutique