Version: 1.0
Effective Date: 2026-07-14
Operator: Heliopolis Creative and Culture Limited (Hong Kong)
Contact: privacy@catalpasatelier.com
This Notice explains how catalpasatelier.com (the "Official Site") uses cookies, browser storage, pixels, and similar technologies. It supplements the Catalpas Atelier Privacy Policy.
This Notice applies only to the Official Site. docs.catalpasatelier.com and blog.catalpasatelier.com provide separate property-specific notices and keep separate consent records. A choice made on one property does not automatically apply to another.
Cookies are small text records stored by a browser. Local storage is browser storage associated with a website. Pixels and tags are code that can cause a browser to contact another service and report an event, such as a page visit. Similar technologies may store or read an identifier, remember a choice, protect a session, measure site use, or attribute an advertising campaign.
Some technologies are set directly by the Official Site. Others are provided by a third party and may allow that provider to receive information under its own privacy terms.
We divide these technologies into three categories:
Analytics and marketing consent are separate choices. You can accept all, reject optional technologies, or manage each category. Rejecting optional technologies does not prevent ordinary access to public pages, although account, security, and requested offer functions still require strictly necessary storage.
| Category | Technology, provider, or record | Purpose | When active | Retention approach |
|---|---|---|---|---|
| Strictly necessary | Catalpas Atelier locale preference | Remember the language you select | When you select or use a language | Up to 12 months unless cleared earlier |
| Strictly necessary | Catalpas Atelier authentication and security storage | Maintain a signed-in session, protect requests, and prevent abuse | When needed for account/security functions | For the session or the security/account period appropriate to the record |
| Strictly necessary | ca_cookie_consent and ca_cookie_consent_v1 | Store your essential, analytics, and marketing choices and update time | After you save a choice | Up to 12 months unless cleared or replaced earlier |
| Strictly necessary | ca_campaign_coupon | Preserve an offer associated with a campaign link so it can be applied at checkout | After you follow a link carrying an applicable offer | Up to 30 days unless used, replaced, or cleared earlier |
| First-party campaign operation | Server-side campaign visit record (not a browser cookie) | Route a campaign link, apply an offer, prevent abuse, troubleshoot links, and perform limited campaign measurement | When you follow /r/<slug> | For limited operational, measurement, fraud-prevention, and dispute periods |
| Marketing | cas_visitor | Attribute a campaign visit to a later registration or purchase using a pseudonymous identifier | Only after marketing consent | Up to 30 days unless consent is withdrawn or the cookie is cleared earlier |
| Analytics | Google Analytics 4 | Measure page use, referrers, approximate region, browser/device category, and aggregate content performance | Only after analytics consent | According to our configured GA4 retention and Google's applicable terms |
| Marketing | Meta Pixel | Measure visits and advertising campaign performance and support permitted audience functions | Only after marketing consent | According to our Meta configuration and Meta's applicable terms |
| Marketing | Reddit Pixel | Measure visits, advertising attribution, and campaign performance | Only after marketing consent | According to our Reddit configuration and Reddit's applicable terms |
Provider technologies may create identifiers such as Google Analytics _ga cookies, Meta _fbp or related identifiers, and Reddit advertising identifiers. The exact names and duration can change when providers update their services or when browser controls limit storage. We review the provider configuration rather than representing that every browser receives every listed identifier.
When you follow a Catalpas Atelier campaign redirect, the server may record the campaign identifier, a single-visit pseudonymous request identifier, landing page, request time, referrer, browser/user-agent information, IP address, and approximate country. This first-party record may be created before you make a marketing choice because it supports link routing, an offer you requested, abuse prevention, troubleshooting, and limited campaign measurement. It does not load Google Analytics, Meta Pixel, or Reddit Pixel and is not linked to a later account or purchase without marketing consent.
If you grant marketing consent, the host-only cas_visitor cookie may be used for persistent registration or purchase attribution. The campaign offer cookie is functional storage used to preserve a discount or offer you requested; it is not used by Meta or Reddit Pixel.
We use Google Analytics 4 to understand how visitors find and use the Official Site, which pages are useful, and how the site performs. We use Basic Consent Mode:
We do not intentionally send Google Analytics names, email addresses, account identifiers, payment details, support text, or Scribe/Scroll project content. You should avoid placing personal information in URLs because a page URL may be included in a permitted analytics event.
Google provides more information in Safeguarding your data, GA4 data collection, and About consent mode.
After marketing consent, Meta Pixel may report events such as a page visit and related browser, device, URL, referrer, cookie, and campaign information to Meta. We use it for advertising attribution, campaign measurement, and permitted audience functions. We do not intentionally send Meta payment-card details, authentication credentials, support text, or Scribe/Scroll project content.
Before marketing consent, the Meta script and image pixel are not loaded and no Meta Pixel event is sent. Withdrawing marketing consent prevents future events from the Official Site and removes the first-party persistent campaign identifier; it does not automatically erase information already received by Meta.
The Official Site, Docs, and Blog may use the same suite-level Meta Pixel, but each property asks for marketing consent independently. Meta explains its processing in the Meta Business Tools Terms and its privacy materials.
After marketing consent, Reddit Pixel may report events such as a page visit and related browser, device, URL, referrer, advertising identifier, and campaign information to Reddit. We use it for advertising attribution and campaign measurement. We do not intentionally send Reddit payment-card details, authentication credentials, support text, or Scribe/Scroll project content.
Before marketing consent, the Reddit Pixel script is not loaded and no Reddit Pixel event is sent. Withdrawing marketing consent prevents future events from the Official Site and removes the first-party persistent campaign identifier; it does not automatically erase information already received by Reddit.
The Official Site, Docs, and Blog may use the same suite-level Reddit Pixel, but each property asks for marketing consent independently. See Reddit policies and Reddit's Attribution overview.
You can use the Cookie preferences control in the Official Site footer to:
You can also clear cookies and site data in your browser. Doing so may sign you out, remove language settings, and cause the consent panel to appear again. Browser extensions or settings may block additional technologies, but the effect depends on the browser and provider.
Where applicable law requires us to recognise a valid browser-based opt-out preference signal, we treat that signal as an opt-out for the relevant browser and property. Because optional trackers are disabled before consent, a visitor who has not opted in remains untracked by those technologies.
Changing your choice applies to future activity. To request access to or deletion of information already held by us, contact privacy@catalpasatelier.com. Information already held by a third-party provider is subject to applicable rights and that provider's processes.
Google, Meta, Reddit, and their service providers may process information in countries outside your residence. Our Privacy Policy describes international-transfer safeguards and your rights. Provider policies contain additional information about their locations and practices.
We may update this Notice when technologies, purposes, providers, or legal requirements change. If we introduce a new optional purpose or provider that requires consent, we will update the notice and ask for the relevant choice before loading it. The version and effective date identify the current Notice.
For questions about cookies, tracking, or privacy choices, contact:
