Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your device — your computer, phone, or tablet — when you visit a website or use an application. They allow the website or application to remember information about your visit, such as your login session or your preferences. Cookies are widely used to make platforms work more efficiently, to improve the user experience, and to provide information to the owners of the site.

As well as cookies, Peekabl may use other similar tracking technologies including:

• Local storage — data stored in your browser that persists between sessions but does not leave your device unless transmitted separately. We use this to temporarily hold your profile image during host sign-up
• Session storage — similar to local storage but cleared when you close your browser tab. We use this to carry your registration details across the multi-step sign-up flow and to prevent duplicate feedback or booking submissions
• Pixel tags (web beacons) — small transparent images embedded in emails or pages that allow us to track whether an email has been opened or a page has been loaded

Where we refer to 'cookies' in this Policy, we mean all of the above technologies unless we specify otherwise.

2. Who Sets Cookies on Peekabl?

Cookies on Peekabl are set either by us directly (first-party cookies) or by our third-party service providers (third-party cookies) when they deliver services on our behalf — such as analytics, payment processing, or live streaming infrastructure.

Peekabl does not permit data brokers to place cookies on our platform, and we do not sell your personal data. We work with a small number of advertising and measurement partners - currently Meta (Facebook) and Google Ads - to measure the effectiveness of our own marketing campaigns and to reach people who have shown interest in Peekabl. Whether these partners are active by default or only after you opt in depends on your location (see Section 4). We do not build advertising profiles for other companies to use for their own targeting.

3. Categories of Cookies We Use

We use the categories of cookies described below. The first category - essential cookies - is required for the Platform to function and cannot be disabled. The other categories (analytics, marketing and session recordings) are governed by the regional consent model in Section 4: in most regions they are deployed only after you opt in, and in the United States and Australia analytics and marketing are deployed unless you opt out. Session recordings are off by default everywhere. You can manage all non-essential categories at any time through our cookie consent tool.

The lists in this Section name the specific cookies and providers active as at the date of this Policy. Where we add a provider that serves a purpose already described in this Policy - for example, an additional analytics or advertising provider - we add it to this Policy and, where required, request your consent before the new provider is activated. If we add a new purpose, or a materially new kind of recipient, we ask for your choices again.

3.1 Essential Cookies (Always Active)

Essential cookies are strictly necessary for the Platform to operate. Without them, core functions such as logging in, navigating between pages, or completing a payment would not work. Because these cookies are technically necessary, they do not require your consent under applicable law.

What they do:

• Maintain your authenticated session so you stay signed in as you navigate the Platform
• Renew your session securely in the background so you are not logged out unexpectedly
• Support fraud detection and security at the point of payment
• Remember your cookie preferences — ironically, we need a cookie to remember that you declined other cookies

These cookies are set by Peekabl and by our core service providers, including Stripe (payment processing). They are session-based or short-lived persistent cookies and do not track your behaviour across other websites. Our authentication cookies are HttpOnly (not readable by JavaScript) and use the SameSite=Lax attribute, which protects against cross-site request forgery. The cookies in this category are:

• peekbl_access_token (Peekabl) — HttpOnly token that keeps you authenticated across page loads and API requests. Duration: 30 days
• peekbl_refresh_token (Peekabl) — HttpOnly token used to securely renew your session without re-logging in. Duration: 30 days
• peekbl_consent (Peekabl) - stores your cookie choices so we do not re-prompt you. It holds your choices only, not a visitor identifier. Duration: 6 months where you are asked for consent, and 12 months in the United States and Australia
• __stripe_mid (Stripe) — fraud detection and security during payment processing. Duration: 12 months
• __stripe_sid (Stripe) — session identifier for payment flow continuity. Duration: 30 minutes

Payments are processed on Stripe's secure hosted checkout. The Stripe cookies above are set by Stripe on its own checkout pages during the payment flow, under Stripe's privacy policy.

Two other providers are also necessary for the Platform to work. Stream delivers live video and chat using short-lived access tokens and may use browser local storage to keep the connection open. Cloudinary delivers images and does not set tracking cookies on the Platform.

3.2 Analytics Cookies (Consent or Opt-Out, by Region)

Analytics cookies help us understand how users interact with the Platform — what pages are visited, where users drop off, how long sessions last, and what features are most used. This data helps us improve the Platform for everyone. We process this data in aggregate or pseudonymised form and do not use it to build individual user profiles for commercial purposes.

How these cookies are governed depends on your location (see Section 4). In regions that require opt-in consent, no analytics tool is loaded until you accept analytics, and if you decline, none is loaded. In the United States and Australia, analytics cookies are set by default and you can opt out at any time. The cookies in this category are:

• _ga (Google Analytics 4) — distinguishes unique users via a pseudonymous client identifier, for aggregated traffic analysis. Duration: 24 months
• _ga_<id> (Google Analytics 4) — persists Google Analytics 4 session state for the Peekabl property. Duration: 24 months
• Ahrefs Web Analytics (Ahrefs) - counts visits and sign-up events. It does not set a cookie on peekabl.com. Requests to Ahrefs' servers may set a session cookie on Ahrefs' own domain

We use Google Analytics 4 under Google Consent Mode v2 for this purpose. If we add other analytics providers that serve the same purpose, or enable additional Google measurement features, we will add them to this Policy and, where required by law, obtain your consent before they are activated.

3.3 Marketing Cookies (Consent or Opt-Out, by Region)

Marketing cookies measure the effectiveness of our own marketing campaigns — for example, to understand whether a user who registered came from a specific campaign link — and allow us to show Peekabl ads to people who have previously visited our Platform (retargeting). We do not use marketing cookies to build profiles that are sold to or shared with unrelated third-party advertisers.

We currently use the Meta (Facebook) Pixel and Google Ads measurement for this purpose. We may add other advertising or social measurement providers that serve the same purpose - measuring our own campaigns and retargeting our own audiences. Any such provider will be added to this Policy and, where required, consent will be requested before it is activated.

Marketing tags are delivered through Google Tag Manager. How they are governed depends on your location (see Section 4): in opt-in regions no marketing tool is loaded until you accept marketing, and if you reject it no marketing cookies are written; in the United States and Australia they are active by default and you can opt out at any time. The cookies in this category are:

• _fbp (Meta Pixel) — distinguishes browsers for measurement and retargeting of our own campaigns. Duration: 3 months
• _fbc (Meta Pixel) — stores the click identifier when you arrive from a Meta ad, so we can attribute registrations to our campaigns. Duration: 3 months
• _gcl_au (Google Ads), and _gcl_aw if you arrive from a Google ad - store ad-click information so we can measure the results of our own advertising. Duration: 90 days

Data collected by the Meta Pixel is processed by Meta Platforms under its own privacy policy (facebook.com/privacy/policy).

3.4 Session Recordings (Opt-In Everywhere)

Session recordings show how visitors move through our pages - where they click, scroll and get stuck - so we can make Peekabl easier to use. They are off by default in every region, including the United States, and start only if you turn on Session recordings under Customize or choose Accept all. They are separate from the recordings of live experiences described in our Privacy Policy.

We use Contentsquare for this purpose. It sets the cookies _cs_c, _cs_id and _cs_s. They last 13 months, 12 months and less than a day respectively. Contentsquare does not run on Peekabl unless you allow session recordings. Text you type into forms is masked. Recordings are kept only as long as needed to review and improve our pages. Contentsquare is a temporary tool, and we may replace it with another provider for the same purpose.

4. Cookies, Consent, and the Law - Our Legal Basis by Region

Under the GDPR and the EU ePrivacy Directive (implemented in Bulgarian law and across EU Member States), and under US state privacy laws, the rules for non-essential cookies differ by location. Essential cookies require no consent anywhere - their lawful basis is our legitimate interest in delivering a functioning service. For analytics, marketing and session recordings, the model we apply is:

• Opt-in by default, everywhere - non-essential technologies stay off until you accept them in our cookie banner. Our legal basis is your consent (GDPR Article 6(1)(a) and the ePrivacy rules). Consent is freely given (you can decline and still use the Platform), informed, unambiguous (given by actively choosing 'Accept all' or switching on a purpose, never by pre-ticked boxes, silence, scrolling or continued browsing), and withdrawable at any time (see Section 6)
• United States and Australia - analytics and marketing are on by default and you can opt out at any time using the 'Your Privacy Choices' link in our footer. Session recordings are off by default. We honour the Global Privacy Control (GPC) signal as an opt-out
• If we cannot tell where you are - we treat you as opt-in

The regions where opt-out applies may change as the law changes, and we will update this Policy when they do.

We do not use cookie walls — refusing or opting out of non-essential cookies does not block you from accessing the Platform. Regardless of your location, we do not share information about your specific video viewing activity with third parties without your separate, express opt-in consent (see Section 7).

5. Third-Party Cookies and External Services

Where third-party service providers set cookies or process data through our Platform, they do so under their own privacy and cookie policies, which we link below. Most of these providers act as our data processors under a Data Processing Agreement (DPA) that limits their use of data to the purposes we specify. Some, however - notably Meta in respect of Meta Pixel data - act as independent or joint controllers under their own terms rather than as our processors. Each provider acts under the terms we have accepted with it.

Current third-party providers and applicable policies:

• Stripe — payment processing: stripe.com/privacy
• Google Analytics — usage analytics: policies.google.com/privacy
• Google Tag Manager — tag delivery for our analytics and marketing tools: policies.google.com/privacy. Google Tag Manager itself sets no cookies; the tags it delivers are governed by the regional model in Section 4
• Ahrefs - analytics (visits and sign-up events): ahrefs.com/legal/privacy-policy
• Contentsquare - session recordings, only if you allow them: contentsquare.com/privacy-center
• Google Ads - measurement of our own advertising: policies.google.com/privacy
• Meta (Facebook) - measurement and retargeting of our own marketing campaigns: facebook.com/privacy/policy
• Stream (GetStream.io) — live video and chat streaming infrastructure: getstream.io/legal/privacy. The live tour viewer connects to Stream using short-lived access tokens and may use browser local storage to maintain the connection
• Cloudinary — image hosting and delivery (CDN): cloudinary.com/privacy. Cloudinary serves images and does not set tracking cookies on the Platform

If we add a provider that serves a purpose already described in this Policy — for example, an additional advertising, analytics, or measurement provider - we will add it to this Policy and, where required by law, obtain your consent before its cookies are deployed. If we introduce a provider for a new purpose, or another higher-risk technology, we will update this Policy first. Any social sharing functionality currently on the Platform operates through direct links rather than embedded trackers.

6. How to Manage Your Cookie Preferences

6.1 Using Our Cookie Preference Tool

Where opt-in applies, you will be shown a cookie banner the first time you visit peekabl.com. It has three buttons of equal size and weight:

• Reject all - only essential cookies are used
• Customize - choose Analytics, Marketing and Session recordings separately; none is switched on until you switch it on
• Accept all - enables analytics, marketing and session recordings in addition to essential cookies

In the United States and Australia no banner is shown. Instead, the 'Your Privacy Choices' link in the footer lets you turn off analytics and marketing in one step ('Reject all') or keep them on. Session recordings stay off unless you turn them on. In every region you can revisit and change your choices at any time with the 'Cookie settings' link in the footer of our website or, on pages without a footer, the small link shown on the page.

We save your choice for six months where you are asked for consent, and for twelve months in the United States and Australia. We ask again sooner only if we add a new purpose or a materially new kind of recipient.

When you withdraw consent or opt out of a cookie category, we delete the cookies that category had set in your browser and stop deploying them from your next page load. We cannot retroactively delete data already collected under a previously given consent, but we stop new collection.

6.2 Browser-Level Cookie Controls

You can also control cookies directly through your browser settings. Most browsers allow you to:

• See which cookies are set and delete them individually or in bulk
• Block all cookies from specific websites
• Block third-party cookies globally
• Set your browser to alert you before a cookie is placed

Guidance for common browsers:

• Google Chrome — support.google.com/chrome/answer/95647
• Mozilla Firefox — support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Apple Safari — support.apple.com/guide/safari/manage-cookies-sfri11471
• Microsoft Edge — support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge

Please note that disabling essential cookies through browser settings will prevent the Platform from functioning correctly. Blocking third-party cookies from Stripe may prevent payment processing.

6.3 Mobile Application

On our mobile apps, cookies in the traditional sense do not apply. Instead, the app uses equivalent local storage mechanisms. You can manage these through:

• Your device's app privacy settings (iOS: Settings > Privacy & Security; Android: Settings > Apps)
• Deleting and reinstalling the app, which clears all locally stored data

6.4 Global Privacy Control and Do Not Track

Some browsers can send preference signals on your behalf. There are two you should know about:

• Global Privacy Control (GPC) - outside the regions where opt-in applies, we treat a GPC signal as an opt-out of analytics, marketing, session recordings and any 'sharing' for advertising purposes, from your first page load, unless you later make a different choice yourself in our cookie settings
• Do Not Track (DNT) — there is no industry-wide standard for how websites must respond to DNT, so, apart from the GPC handling described above, Peekabl does not currently change its behaviour based on DNT signals. If a standard is adopted, we will update this Policy

7. Cookies and Video Viewing — VPPA Compliance

Peekabl is a video streaming platform. Under the US Video Privacy Protection Act (VPPA), we are required to treat information about your video viewing activity with particular care. We do not use analytics or marketing cookies to track the specific experiences or streams you have viewed and share that information with third parties. This applies regardless of your location and is not affected by the regional model in Section 4.

Any aggregate data about viewing patterns used for internal platform improvement is processed in a non-identifying form. Separately, we record live experience sessions for quality, safety, and dispute-resolution purposes as described in our Privacy Policy; those recordings are used internally only, are not tracked through cookies, and are not shared with third parties. If we ever seek to share specific video viewing data with a third party — including through analytics tools or social features — we will obtain your separate, standalone consent as required by the VPPA and as described in our Privacy Policy.

8. Data Retention for Cookie Data

Data collected through cookies is retained in line with the durations set out in Section 3. Session cookies are deleted automatically when you close your browser. Persistent cookies expire after the period shown.

Where cookie data is used to generate analytics reports or logs, the underlying personal data is deleted or anonymised in line with Google Analytics data retention standards and our own data minimisation commitments.

For the exercise of your broader data rights including access, deletion, and portability of data collected through cookies, please refer to our Privacy Policy or contact us at [email protected].

9. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, changes in law, or updates to our service providers. When we make changes, we will post the updated Policy on the Platform with a revised 'Last Updated' date, and the changes take effect when posted. Where a change materially and adversely affects your rights, we will give advance notice and, where the law requires it, reset your cookie consent so you can review and re-confirm your preferences.

We encourage you to check this page periodically. The 'Last Updated' date at the top tells you when the Policy was last revised.

10. Contact Us

If you have any questions about this Cookie Policy, your consent choices, or how we handle data collected through cookies, please contact us:

Peekabl (CU DPK)
Data Protection Contact: [email protected]
General Support: [email protected]
Website: peekabl.com
Registered address: Sofia, Bulgaria

If you are not satisfied with our response, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the supervisory authority in your country of residence.

Peekabl — Where technology meets humanity.
We respect your privacy as much as we respect your curiosity.