Trust
Cookie policy
Last updated: 2026-05-07. This page lists every cookie and similar tracking technology used on mediabuyer.site, its category, purpose, and retention period, in compliance with Article 5(3) of the EU ePrivacy Directive 2002/58/EC, Article 22.2 of the Spanish Ley de Servicios de la Sociedad de la Información (LSSI-CE), and the AEPD’s Guía sobre el uso de las cookies (revised 2023).
1. What is a cookie?
A cookie is a small text file that a website asks your browser to store. We also describe here similar technologies (HTML5 local storage, pixels, fingerprinting attempts) where they are used. The legal regime is the same: any storage of, or access to, information on your device requires your prior consent unless the storage is "strictly necessary" to provide a service you explicitly requested (LSSI-CE art. 22.2).
2. Categories
- Strictly necessary. Required for the site to function (sign-in session, security, consent record, hosting routing). Set without prior consent under LSSI-CE art. 22.2 second paragraph.
- Preferences. Remember choices you have made (e.g. dark mode). Set only after you change the relevant setting.
- Analytics. Help us measure traffic in aggregate (Google Analytics 4, Microsoft Clarity). Loaded only after you grant consent.
- Marketing. We do not currently use marketing or advertising cookies. If we add them in the future they will require fresh consent.
3. Cookies we may set
| Cookie / storage key | Provider | Category | Purpose | Retention |
|---|---|---|---|---|
next-auth.session-token | mediabuyer.site (first-party) | Strictly necessary | Maintains the authenticated session for users who have signed in via Google OAuth. Without it, signed-in features (saved comparisons, newsletter preferences) cannot work. | Session, up to 30 days rolling. |
next-auth.csrf-token | mediabuyer.site (first-party) | Strictly necessary | Cross-site request forgery (CSRF) token used during the OAuth sign-in flow. Required for the security of the authentication form. | Session. |
klaro | mediabuyer.site (first-party, set by Klaro consent manager) | Strictly necessary | Stores your cookie-banner choices so we do not ask again on every page. Recording consent is itself an obligation under Art. 7(1) GDPR; this cookie is exempt under LSSI-CE art. 22.2 second paragraph. | 120 days, then re-prompted. |
theme | mediabuyer.site (first-party) | Preferences | Stores your dark/light mode preference. Set only after you change the toggle. | 1 year. |
_ga, _ga_<container-id> | Google LLC / Google Ireland Ltd. (Google Analytics 4) | Analytics | Pseudonymous client identifier used to distinguish unique browsers for aggregate traffic measurement. IP-anonymisation is enabled. Loaded only after consent. | Up to 13 months (we have set GA4’s lowest retention tier). |
_clck, _clsk | Microsoft Ireland Operations Ltd. (Microsoft Clarity) | Analytics | Pseudonymous identifier used to group page interactions into sessions for heatmap and recording analysis. Loaded only after consent. | Up to 12 months for _clck; 1 day for _clsk. |
__cf_bm | Cloudflare, Inc. | Strictly necessary | Bot-management cookie set by Cloudflare to distinguish humans from automated traffic. Used for security and abuse-prevention. Exempt under LSSI-CE art. 22.2. | 30 minutes. |
cf_clearance | Cloudflare, Inc. | Strictly necessary | Granted after a successful CAPTCHA / managed-challenge solve, allowing access without further challenges for a short period. Security-only. | 30 days. |
vercel-edge-* / __vercel_live_token | Vercel Inc. | Strictly necessary | Routing and preview-deployment cookies set by our hosting provider. Required for the site to load correctly. | Session. |
4. Managing your consent
- You can grant, refuse, or withdraw consent at any time using the cookie banner. Reopen it from the "Cookie preferences" link in the site footer.
- Refusing analytics will not break the site; it will simply mean we do not see your visit in aggregated reports.
- You can also block or delete cookies in your browser settings. See instructions for Chrome, Firefox, Safari, and Edge.
5. International data transfers
Several cookie providers are based outside the European Economic Area (notably Google LLC in the U.S. and Microsoft Corporation in the U.S.). Transfers rely on the EU-US Data Privacy Framework (Commission decision 2023/1795) and the European Commission’s Standard Contractual Clauses (Decision 2021/914), with a documented transfer impact assessment. See the privacy policy for the full transfer mechanisms.
6. Changes
When the cookie inventory changes (a tool added, a tool removed, a retention period changed), we update this page and re-prompt for consent where the change is material. The Klaro consent banner stores a versioned record of which inventory you consented to.
7. Complaints
You can contact privacy@luba.media with any complaint, or lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.