Loading

Loading...

Skip to main content

Cookie Policy

Last updated: July 14, 2026 — Version 1.1

This policy explains how picto-flow uses cookies and similar technologies on the picto-flow website and application (the "Service"). It complements our Privacy Policy.

1) Who is responsible?

Data controller: Timothée Miminoshvili, sole proprietor (trade name TEL-MI Labs) — 72 rue de Dantzig, Hall 14, 75015 Paris, France — SIREN 847 659 216 — Contact: temurimi@gmail.com
Data protection contact: Timothée Miminoshvili — temurimi@gmail.com.

2) What is a cookie?

A cookie is a file stored on your device (computer, mobile, etc.) that allows information to be stored or retrieved. Other trackers may work similarly (localStorage, SDK, pixels, tracking tags).

3) Legal framework

Non-essential cookies (audience measurement, personalization, advertising, support) require your prior consent (Art. 82 "Data Protection" Act / ePrivacy Directive). You can refuse as easily as accept and withdraw your consent at any time.

4) Your choices

  • On first visit: a banner offers "Refuse", "Configure" and "Accept".
  • At any time: a "Cookie preferences" link is available in the footer and in your account.
  • Proof of your choices (timestamp, version, technical identifier) is kept for 6 months.

5) Purposes and legal bases

Purpose Examples Legal basis
Strictly necessary Supabase authentication, security (anti-bots), load balancing, cart/subscription preservation Legitimate interest & technical necessity
Audience measurement Google Analytics 4 (configured in privacy-friendly mode) Consent
Personalization Interface preferences (theme, language), action history Consent
Marketing Targeted advertising, personalized recommendations Consent

6) Cookies/trackers used

a) Strictly necessary (exempt from consent)

  • supabase-auth-token (localStorage) — authentication session — duration: until logout — Supabase (EU hosting).
  • cookie_consent_v2 (localStorage) — consent proof — duration: 6 months — picto-flow.
  • cf_clearance / __cf_bm — anti-bot protection (Cloudflare Turnstile) — duration: 30 min to 1 year — Cloudflare (EU hosting).

b) Audience measurement (subject to consent)

  • Google Analytics 4 — audience measurement and statistics — duration: 2 years max — Google — EU hosting with potential transfers to the United States.

c) Personalization (subject to consent)

  • user_preferences (localStorage) — user preferences (theme, language) — duration: until deletion — picto-flow.

d) Marketing (subject to consent)

No marketing tracker is currently deployed. If this changes, this policy will be updated and your consent will still be required.

7) Retention period

  • Consent proof: 6 months (in accordance with CNIL recommendations).
  • Consent choices: 6 months, after which we will ask you again.
  • Session cookies: until browser is closed.
  • Persistent cookies: depending on purpose (2 years max for analytics, 13 months max for marketing).

8) Transfers outside the EU

Google Analytics 4 may involve transfers to the United States. Google is committed to complying with GDPR through:

  • EU standard contractual clauses
  • Appropriate safeguards
  • Approved transfer mechanisms

9) Your rights

In accordance with GDPR, you have the following rights:

  • Right of access: know what data is collected
  • Right to rectification: correct inaccurate data
  • Right to erasure: request deletion of your data
  • Right to data portability: retrieve your data
  • Right to object: refuse processing
  • Right to withdraw: withdraw your consent at any time

10) Contact and exercise of rights

11) Updates to this policy

This policy may be updated to reflect:

  • Changes in our practices
  • New legal requirements
  • Addition of new services

Significant changes will be notified to you via the website or by email.

Version history:

  • 1.0 (December 2024) - First GDPR/CNIL compliant version
  • 1.1 (July 2026) - Real data controller, marketing section aligned with actual trackers

Last updated: July 14, 2026