Cookie Policy
How we use cookies and similar technologies in compliance with the ePrivacy Directive.
Effective Date: April 13, 2026 · Version 1.9
1. Introduction
This Cookie Policy explains how YTI Digital OÜ, trading as esimystic ("Company", "we", "us"), uses cookies and similar tracking technologies when you visit our website at esimystic.com (the "Service").
This Policy complies with the ePrivacy Directive (2002/58/EC) as amended, and should be read together with our Privacy Policy. For general questions about the Service, please visit our Help Center.
2. What Are Cookies?
Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They enable the website to remember your actions and preferences over a period of time.
Similar technologies include:
- Local Storage / Session Storage: Browser-based storage mechanisms;
- Pixels / Web Beacons: Small transparent images used to track user behavior;
- Fingerprinting: We do not use browser or device fingerprinting.
3. Cookie Categories
Under the ePrivacy Directive, cookies are classified based on whether they require user consent:
🔒 Strictly Necessary Cookies (No Consent Required)
These cookies are essential for the Service to function. They cannot be disabled without breaking core functionality.
⚙️ Non-Essential Cookies (Consent Required)
These cookies require your consent before they can be set. You can accept or reject them through our cookie consent mechanism.
4. Strictly Necessary Cookies
These cookies are required for the Service to operate correctly. Under Article 5(3) of the ePrivacy Directive, they are exempt from the consent requirement because they are "strictly necessary" for providing an information society service explicitly requested by you.
4.1 User Authentication
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
__Host-next-auth.csrf-token | CSRF protection for authentication | Session | First-party |
__Secure-next-auth.session-token | User authentication session | Session / 30 days | First-party |
next-auth.callback-url | Redirect after login | Session | First-party |
4.2 Shopping Cart
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
esimystic_cart | Stores your shopping cart contents (encrypted) | 30 days | First-party |
esimystic_guest_id | Anonymous identifier for guest users (to persist cart) | 30 days | First-party |
4.3 Preferences
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
NEXT_LOCALE | Language preference | 1 year | First-party |
esimystic_currency | Display currency preference (EUR or USD) for prices and checkout | 1 year | First-party |
Note: Theme preference (light/dark mode) is stored in your browser's localStorage, not as a cookie.
4.4 Partner Dashboard Session
If you are a registered Partner, this cookie is used for authenticated access to your Partner Dashboard:
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
esimystic_partner_session | Partner Dashboard authentication (JWT-signed) | 30 days | First-party |
4.5 Cookie Consent
This cookie stores your cookie preference decision:
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
esimystic_consent | Stores your cookie consent preference ("all" or "necessary") | 1 year | First-party |
Note: Detailed consent preferences are also stored in your browser's localStorage for a richer experience.
4.6 Advertising Attribution
This cookie is strictly necessary for business attribution — tracking which advertising campaigns lead to orders. It does not track you across websites or share data with third parties.
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
esimystic_ads | Stores the advertising campaign code when you arrive via an ad link (?ads=CODE). Used solely to attribute your order to the correct advertising source for internal ROI analysis. No personal data is collected or shared. | 30 days | First-party |
Legal basis: This cookie is exempt from consent under Article 5(3) of the ePrivacy Directive as it is strictly necessary for the legitimate interest of measuring advertising effectiveness (first-party attribution). It does not enable cross-site tracking.
6. Affiliate/Partner Tracking Cookies (Consent Required)
We operate a Partner Program that uses a cookie to track referrals. This cookie is classified as strictly necessary / functional because it is essential for our partner commission system and does not track you across other websites or share data with third parties.
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
esimystic_partner | Stores the partner referral code when you arrive via a partner link (?ref=CODE) | 60 days | First-party, Functional |
How it works: When you click a referral link containing a partner code (e.g., esimystic.com/?ref=ABC123), we store the code in esimystic_partner. This allows us to credit our partners for referred sales. The cookie is httpOnly (not accessible via JavaScript) and is only used for first-party business attribution.
Attribution model: We use a "last-click" model. If you click multiple partner links, only the most recent referral is credited.
7. Third-Party Cookies
Certain third-party services may set their own cookies when you use our Service:
7.1 Stripe (Payment Processing)
Stripe sets cookies for fraud prevention and payment processing. These are necessary to complete secure payments. See Stripe's Cookie Policy.
7.2 Vercel (Hosting)
Our hosting provider may set cookies for load balancing and performance optimization. These are strictly necessary for the technical operation of the Service.
8. Analytics and Advertising Measurement (Consent Required)
We use Google Analytics 4 (GA4) and, where configured, Google Ads conversion measurement to understand how visitors interact with our Service and measure advertising performance. These technologies require your consent before they load.
8.1 Google Analytics 4 and Google Ads
Google Analytics helps us understand user behavior, measure website performance, and improve our Service. When Google Ads is linked, Google may also use consent-gated data forconversion and ads measurement. We apply the following measures:
- Consent Mode v2: Non-essential Google tags respect your cookie choice
- IP Anonymization: Your IP address is anonymized in GA4 as configured
- Google Ads: Where enabled, we use Google's tags for conversion attribution after consent
- Data Retention: User-level analytics data is retained for 14 months in GA4
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
_ga | Distinguishes unique users by assigning a randomly generated number | 2 years | Third-party (Google) |
_ga_* | Maintains session state for Google Analytics 4 | 2 years | Third-party (Google) |
_gcl_* / _gcl_au (if set) | Google Ads conversion linker / attribution (when Ads measurement is enabled) | Typically 90 days (may vary) | Third-party (Google) |
Legal basis: We rely on your consent (GDPR Article 6(1)(a)) for GA4 and Google Ads measurement cookies. You can withdraw consent at any time by adjusting your cookie preferences.
Data sharing: Data is processed by Google LLC. Google is certified under the EU-U.S. Data Privacy Framework. For more information, see Google's Privacy Policy and how Google uses data.
8.2 What We Track (Google)
When you accept non-essential cookies, Google measurement may include:
- Pages visited and time spent on each page
- Navigation paths through the website
- Device type, browser, and operating system
- Approximate geographic location (country/city level)
- E-commerce events (product views, cart additions, purchases)
- Site performance metrics
We do not collect personal identifiers such as names, email addresses, or precise location data through analytics cookies.
8.3 Meta (Facebook) Pixel
When you choose Accept all in our cookie banner, we may load the Meta Pixel (provided by Meta Platforms Technologies Limited / Meta Platforms, Inc., depending on region) for advertising measurement and optimization: for example, to attribute conversions to ads, build aggregated audiences, and improve campaign performance. The Pixel is not loaded if you choose Necessary only.
Meta may use cookies and similar storage (including identifiers such as _fbp where applicable) and process data according to its own policies. How Meta uses data, and how you can exercise your rights with Meta, is described in the links below.
| Technology | Purpose | Duration | Type |
|---|---|---|---|
_fbp (if set) | Browser identifier used by Meta for ad delivery and measurement | Up to 90 days (per Meta defaults; may change) | Third-party / Meta (first-party cookie on our domain in some configurations) |
Legal basis: We rely on your consent (GDPR Article 6(1)(a)) before activating the Meta Pixel, consistent with our cookie banner.
Further reading: Meta Cookies Policy · Meta Privacy Policy · Meta ad preferences
9. Managing Your Cookie Preferences
9.1 Consent Mechanism
When you first visit our Service, you will be presented with a cookie consent banner allowing you to accept or reject non-essential cookies (analytics and marketing).
Your choices:
- "Accept all" — Enables analytics and marketing cookies alongside necessary cookies
- "Necessary only" — Only strictly necessary cookies are set; analytics and marketing are blocked
9.2 Withdrawing Consent
You can withdraw your consent at any time. To reset your cookie preferences:
- Clear your browser cookies for esimystic.com
- Clear localStorage data for esimystic.com
- Upon your next visit, the consent banner will appear again
After withdrawing consent, analytics and advertising technologies (including Google Analytics and the Meta Pixel) will no longer load on subsequent visits, though data already collected may remain subject to each provider's retention policies until deleted or expired.
9.3 Browser Settings
You can also control cookies through your browser settings:
- Chrome: Settings → Privacy and Security → Cookies and other site data
- Firefox: Options → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Cookies and website data
- Edge: Settings → Cookies and site permissions → Cookies and site data
Note: Blocking strictly necessary cookies may prevent parts of the Service from functioning correctly.
9.4 Google Analytics Opt-Out
In addition to declining cookies on our site, you can opt out of Google Analytics entirely by installing the Google Analytics Opt-out Browser Add-on.
9.5 Do Not Track
We honor "Do Not Track" (DNT) browser signals. If your browser sends a DNT signal, we will not set non-essential cookies without your explicit consent.
10. Changes to This Policy
We may update this Cookie Policy from time to time. Material changes will be communicated via a notice on the Service. The "Effective Date" at the top indicates when this policy was last revised.
11. Contact Us
For questions about our use of cookies, we're happy to help:
For information about how we handle your personal data beyond cookies, please see our Privacy Policy. For general support, visit our Help Center.