Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your device — your computer, phone, or tablet — when you visit a website or use an application. They allow the website or application to remember information about your visit, such as your login session or your preferences. Cookies are widely used to make platforms work more efficiently, to improve the user experience, and to provide information to the owners of the site.

As well as cookies, Peekabl may use other similar tracking technologies including:

• Local storage — data stored in your browser that persists between sessions but does not leave your device unless transmitted separately. We use this to temporarily hold your profile image during host sign-up
• Session storage — similar to local storage but cleared when you close your browser tab. We use this to carry your registration details across the multi-step sign-up flow and to prevent duplicate feedback or booking submissions
• Pixel tags (web beacons) — small transparent images embedded in emails or pages that allow us to track whether an email has been opened or a page has been loaded

Where we refer to 'cookies' in this Policy, we mean all of the above technologies unless we specify otherwise.

2. Who Sets Cookies on Peekabl?

Cookies on Peekabl are set either by us directly (first-party cookies) or by our third-party service providers (third-party cookies) when they deliver services on our behalf — such as analytics, payment processing, or live streaming infrastructure.

Peekabl does not permit advertising networks or data brokers to place cookies on our platform for cross-site behavioural advertising. We do not monetise your browsing behaviour through third-party ad networks. This is consistent with our commitment in our Privacy Policy that we do not sell your personal data and do not build advertising profiles for third-party targeting.

3. Categories of Cookies We Use

We use the categories of cookies described below. The first category — essential cookies — is required for the Platform to function and cannot be disabled. All other categories require your consent, which you provide through our cookie consent tool when you first access the Platform.

3.1 Essential Cookies (Always Active)

Essential cookies are strictly necessary for the Platform to operate. Without them, core functions such as logging in, navigating between pages, or completing a payment would not work. Because these cookies are technically necessary, they do not require your consent under applicable law.

What they do:

• Maintain your authenticated session so you stay signed in as you navigate the Platform
• Renew your session securely in the background so you are not logged out unexpectedly
• Support fraud detection and security at the point of payment
• Remember your cookie preferences — ironically, we need a cookie to remember that you declined other cookies

These cookies are set by Peekabl and by our core service providers, including Stripe (payment processing). They are session-based or short-lived persistent cookies and do not track your behaviour across other websites. Our authentication cookies are HttpOnly (not readable by JavaScript) and use the SameSite=Lax attribute, which protects against cross-site request forgery. The cookies in this category are:

• peekbl_access_token (Peekabl) — HttpOnly token that keeps you authenticated across page loads and API requests. Duration: 30 days
• peekbl_refresh_token (Peekabl) — HttpOnly token used to securely renew your session without re-logging in. Duration: 30 days
• peekbl_consent (Peekabl) — stores your cookie consent choices so we do not re-prompt you. Duration: 12 months
• __stripe_mid (Stripe) — fraud detection and security during payment processing. Duration: 12 months
• __stripe_sid (Stripe) — session identifier for payment flow continuity. Duration: 30 minutes

Payments are processed on Stripe's secure hosted checkout. The Stripe cookies above are set by Stripe on its own checkout pages during the payment flow, under Stripe's privacy policy.

3.2 Analytics Cookies (Consent Required)

Analytics cookies help us understand how users interact with the Platform — what pages are visited, where users drop off, how long sessions last, and what features are most used. This data helps us improve the Platform for everyone. We process this data in aggregate or pseudonymised form and do not use it to build individual user profiles for commercial purposes.

We only deploy analytics cookies after you have provided your consent. Until you accept, Google Consent Mode keeps analytics storage denied and no analytics cookies are written. If you decline, we rely on aggregated, cookieless signals only. The cookies in this category are:

• _ga (Google Analytics 4) — distinguishes unique users via a pseudonymous client identifier, for aggregated traffic analysis. Duration: 24 months
• _ga_<id> (Google Analytics 4) — persists Google Analytics 4 session state for the Peekabl property. Duration: 24 months

Peekabl uses Google Analytics 4 (delivered via Firebase) under Google Consent Mode v2. We do not use Google Analytics advertising features, remarketing, Google Signals, or user-ID linking, and our analytics data is not shared with third parties for their own purposes.

3.3 Marketing Cookies (Consent Required)

Marketing cookies would be used to measure the effectiveness of our own marketing campaigns — for example, to understand whether a user who registered came from a specific campaign link. We do not use marketing cookies to build profiles that are shared with third-party advertisers.

At this time, Peekabl does not deploy any marketing cookies. When you choose 'Accept all', Google Consent Mode advertising signals are granted alongside analytics; choosing 'Necessary only' keeps them denied. Either way, no advertising or campaign-tracking cookies are written to your device today. If we introduce marketing cookies in the future, they will be for our own internal campaign measurement only, and we will update this Policy and obtain your consent first.

4. Cookies and the GDPR — Our Legal Basis

Under the GDPR and the EU ePrivacy Directive (implemented in Bulgarian law and across EU Member States), the following rules apply:

• Essential cookies — no consent required. Lawful basis: legitimate interests (technically necessary for service delivery)
• Analytics and marketing cookies — consent required (GDPR Article 6(1)(a)). We collect this consent through our cookie banner before any such cookies are deployed

Consent for non-essential cookies is:

• Freely given — you can decline all non-essential cookies and still use the Platform
• Informed — this Policy and our consent banner explain exactly what each category does
• Unambiguous — consent is given by actively clicking 'Accept all', not by pre-ticked boxes or continued browsing
• Withdrawable at any time — see Section 6 below

We do not use cookie walls — refusing non-essential cookies does not block you from accessing the Platform.

5. Third-Party Cookies and External Services

Where third-party service providers set cookies or process data through our Platform, they do so under their own privacy and cookie policies, which we link below. Peekabl has entered into Data Processing Agreements (DPAs) with these providers that limit their use of data collected through our Platform.

Current third-party providers and applicable policies:

• Stripe — payment processing: stripe.com/privacy
• Google Analytics — usage analytics: policies.google.com/privacy
• Stream (GetStream.io) — live video and chat streaming infrastructure: getstream.io/legal/privacy. The live tour viewer connects to Stream using short-lived access tokens and may use browser local storage to maintain the connection
• Cloudinary — image hosting and delivery (CDN): cloudinary.com/privacy. Cloudinary serves images and does not set tracking cookies on the Platform

If we add new third-party cookie providers, we will update this Policy and, where required, obtain fresh consent before deploying their cookies.

Peekabl does not permit social media platforms (including Facebook, Instagram, TikTok, LinkedIn, or X/Twitter) to place tracking pixels or cookies through our Platform for advertising retargeting purposes. Any social sharing functionality on the Platform operates through direct links, not embedded trackers.

6. How to Manage Your Cookie Preferences

6.1 Using Our Cookie Preference Tool

When you first visit peekabl.com, you will be shown a cookie consent banner. This lets you:

• Accept all — enables analytics and marketing signals in addition to essential cookies
• Necessary only — rejects all non-essential cookies; only essential cookies are used

You can revisit and change these preferences at any time by clicking the 'Cookie settings' link in the footer of any page on our website.

When you withdraw consent for a cookie category, we will stop deploying those cookies on your next page load. We cannot retroactively delete data already collected under a previously given consent, but we will stop all new collection immediately.

6.2 Browser-Level Cookie Controls

You can also control cookies directly through your browser settings. Most browsers allow you to:

• See which cookies are set and delete them individually or in bulk
• Block all cookies from specific websites
• Block third-party cookies globally
• Set your browser to alert you before a cookie is placed

Guidance for common browsers:

• Google Chrome — support.google.com/chrome/answer/95647
• Mozilla Firefox — support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Apple Safari — support.apple.com/guide/safari/manage-cookies-sfri11471
• Microsoft Edge — support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge

Please note that disabling essential cookies through browser settings will prevent the Platform from functioning correctly. Blocking third-party cookies from Stripe may prevent payment processing.

6.3 Mobile Application

On our mobile apps, cookies in the traditional sense do not apply. Instead, the app uses equivalent local storage mechanisms. You can manage these through:

• Your device's app privacy settings (iOS: Settings > Privacy & Security; Android: Settings > Apps)
• Deleting and reinstalling the app, which clears all locally stored data

6.4 Do Not Track (DNT)

Some browsers include a 'Do Not Track' (DNT) signal that you can activate to request that websites do not track you. There is currently no industry-wide standard for how websites must respond to DNT signals. Peekabl does not currently alter its cookie behaviour based on DNT signals. If a standard is adopted, we will update this Policy accordingly.

7. Cookies and Video Viewing — VPPA Compliance

Peekabl is a video streaming platform. Under the US Video Privacy Protection Act (VPPA), we are required to treat information about your video viewing activity with particular care. We do not use analytics or marketing cookies to track the specific experiences or streams you have viewed and share that information with third parties.

Any aggregate data about viewing patterns used for internal platform improvement is processed in a non-identifying form. If we ever seek to share specific video viewing data with a third party — including through analytics tools or social features — we will obtain your separate, standalone consent as required by the VPPA and as described in our Privacy Policy.

8. Data Retention for Cookie Data

Data collected through cookies is retained in line with the durations set out in Section 3. Session cookies are deleted automatically when you close your browser. Persistent cookies expire after the period shown.

Where cookie data is used to generate analytics reports or logs, the underlying personal data is deleted or anonymised within 26 months of collection, in line with Google Analytics data retention standards and our own internal data minimisation commitments.

For the exercise of your broader data rights including access, deletion, and portability of data collected through cookies, please refer to our Privacy Policy or contact us at [email protected].

9. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, changes in law, or updates to our service providers. When we make material changes, we will:

• Post the updated Policy on the Platform with a revised effective date
• Reset your cookie consent where required, so that you can review and re-confirm your preferences under the updated terms

We encourage you to check this page periodically. The 'Last Updated' date at the top tells you when the Policy was last revised.

10. Contact Us

If you have any questions about this Cookie Policy, your consent choices, or how we handle data collected through cookies, please contact us:

Peekabl (CU DPK)
Data Protection Contact: [email protected]
General Support: [email protected]
Website: peekabl.com
Registered address: Sofia, Bulgaria

If you are not satisfied with our response, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the supervisory authority in your country of residence.

Peekabl — Where technology meets humanity.
We respect your privacy as much as we respect your curiosity.