Cookies Policy
Last updated: 16 October 2026
This Cookies Policy explains how Vochlea Music Ltd (“Vochlea”, “we”, “us”) uses cookies and similar technologies on this website. It should be read together with our Privacy Policy, which explains how we handle your personal data more generally.
What are cookies?
A cookie is a small text file of letters and numbers that a website stores on your device when you visit it. We also use similar technologies, including your browser’s local storage and tracking pixels. We refer to all of these as “cookies” in this policy.
Some cookies are needed to make the site work or to remember your preferences. Others — only where you allow them — help us understand how the site is used and support our advertising. Cookies set by Vochlea are “first-party” cookies; cookies set by another company (such as Shopify, PostHog or Meta) are “third-party” cookies.
Your choices and how to manage consent
Strictly necessary and functional cookies are always active because the site and checkout cannot work properly without them, so they do not require your consent. How analytics and marketing cookies are handled depends on where you are:
- Where we show a cookie banner (for example in the UK, the EEA and Switzerland), analytics and marketing cookies are switched off by default and are only set after you opt in. Our store runs on Shopify, and the banner is Shopify’s privacy banner: it lets you Accept, Decline, or Manage preferences for each category. You can change or withdraw your choice at any time — withdrawing consent is as easy as giving it — by reopening the banner with the button below, or by clearing cookies in your browser to be asked again.
- Where we do not show a cookie banner, analytics and marketing cookies are on by default and you can opt out at any time on our Your Privacy Choices page, which has one switch to opt out of the “sale” or “sharing” of your personal information for targeted advertising (this turns off our advertising trackers) and a second switch to turn off analytics. We also honour the Global Privacy Control browser signal, wherever you are, as an opt-out of the sale or sharing of your personal information and of targeted advertising. If you previously clicked Decline on our cookie banner, or declined individual categories, we keep honouring those choices for the categories you declined until you change them on the Your Privacy Choices page. Declining marketing (or clicking Decline) also counts as an opt-out of the sale or sharing of your personal information. Two limits apply for now: the audience sync from Klaviyo to Meta works on your email address rather than your browser, so to be removed from it email us; and on our Shopify-hosted checkout, a Global Privacy Control signal on its own is applied to the checkout pixels only in the US states where Shopify honours it (see Our checkout).
In this policy we say analytics or marketing cookies are “active” on your device when you have opted in where we ask for consent, or have not opted out where we do not. While they are not active, PostHog is not loaded at all and makes no requests, the Meta pixel loads in a suppressed state — it sets no cookies and fires no tracking events — Klaviyo’s script is not loaded, and we do not read advertising click identifiers from the web address. If you withdraw or opt out after a tracker has loaded, it is switched off on the spot: PostHog stops recording and resets its identifier, and we set Klaviyo’s __kla_off cookie. One exception applies to embedded YouTube videos, which load without waiting for your choice — see Embedded third-party content below.
Strictly necessary & functional cookies
These cookies are required for the website and checkout to function and to remember basic choices. They do not track you across other websites and are exempt from consent. Shopify, which powers our store and hosted checkout, may also set additional strictly-necessary security cookies on its checkout domain.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
_tracking_consent | Shopify | 1 year | Stores your cookie-consent choices so we can apply them on your future visits. Set by Shopify’s privacy banner, which powers our store. |
_vochlea_consent | Vochlea | 1 year | A copy of your cookie-consent choices (analytics and marketing, as yes/no flags, together with the time they were last confirmed) that our own server can read, so the consent you gave — and only consent confirmed recently — is applied when you check out. It also remembers which of these categories you declined, so that each decline keeps being honoured for that category — including where we no longer show a cookie banner — until you change it yourself. Where tracking is allowed only because your region does not require consent, it also records that fact and the country it was assessed for, so that this allowance is not applied when you visit from a country where consent is required. Stores no identifier or personal data beyond these choices and that country. |
__kla_off | Vochlea (read by Klaviyo) | 1 year | Set by us when marketing cookies are not active on your device — because you declined or withdrew consent, opted out of the sale or sharing of your personal information, or your browser sends a Global Privacy Control signal. It is Klaviyo’s documented “off” switch: while it is present, Klaviyo’s onsite script does not track you even if it has already loaded. It stores only the value “true” and is removed if you allow marketing cookies again. |
cart | Shopify | Session (until you close your browser) | Remembers the products in your shopping cart so they persist as you browse the store. |
session | Vochlea | 30 days | Keeps you signed in to your Vochlea account and secures your session. Set only when you log in to the customer portal. |
pending_checkout_cart | Vochlea | 1 hour | Briefly links your cart to your order when you proceed to our Shopify-hosted checkout, so we can show your order confirmation afterwards. |
_upgrade_prefill | Vochlea | 5 minutes | Set when you open a valid DubBox upgrade handoff link. It holds a short-lived, encrypted token so that when you continue to our Shopify-hosted checkout, your account email is pre-filled for you (you can still change it). It is readable only by our server (HttpOnly), expires within minutes, and is not used for advertising or tracking. |
user_uuid, survey_id | Vochlea | 1 day | Used by our post-purchase “How did you hear about us?” survey to record your answer and avoid asking twice. Set only on the order-confirmation page. |
lang_suggest_dismissed | Vochlea | 180 days | Remembers that you dismissed (or acted on) the banner offering this page in your browser’s language, so we don’t show it again. Stores only a yes/no flag — no personal data. |
Set by Cloudflare Turnstile (name to be confirmed) | Cloudflare Turnstile | Session / short-lived (to be confirmed) | A strictly-necessary security cookie or browser-storage item set by Cloudflare in the challenges.cloudflare.com context to run its bot-protection challenge. It loads only on our login, sign-up and password-reset pages, the DubBox free-trial sign-up and the free-licence sign-up pop-up, to tell genuine visitors from automated bots before we process the form — for example to stop credential-stuffing and mass sign-up abuse. It is not used for advertising or cross-site tracking, and because it is needed for the security of these pages it loads without waiting for a cookie choice. |
Analytics cookies
These cookies help us understand how visitors use our site so we can improve it. They are set only while analytics cookies are active on your device. We use PostHog (privacy-friendly product analytics, hosted in the EU) and Shopify’s built-in store analytics. If you are signed in to your account, analytics events may be associated with your account: while analytics cookies are active, we link your PostHog profile to your account ID, email address and first name. If you subscribe to our marketing emails while analytics cookies are active, we also attach your email address to your PostHog profile. While analytics cookies are not active, neither your account details nor your email address are sent to PostHog. We never enable PostHog session replay (recordings of how a page is used) for visitors in the United States or its territories; elsewhere it follows our PostHog project settings and the same analytics condition. We also use Sentry for error monitoring; it is used under legitimate interest, strips personal data, and sets no cookies.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
ph_<id>_posthog | PostHog | 1 year | PostHog product analytics. Stores a randomly generated ID so we can understand how visitors use the site and improve it. Set only while analytics cookies are active on your device (you opted in where we ask for consent, or have not opted out where we don’t — see “Your choices”); otherwise PostHog is not loaded at all and makes no requests, and if you opt out after it has loaded it stops recording and the ID is reset. Data is processed in the EU. PostHog also stores equivalent entries in your browser’s local storage, under the same condition. We never enable PostHog session replay (recordings of how a page is used) for visitors in the United States or its territories. |
_shopify_y | Shopify | 1 year | Shopify’s built-in store analytics. Distinguishes unique visitors for our commerce reporting. |
_shopify_s | Shopify | 30 minutes | Shopify’s built-in store analytics. Tracks the current browsing session. |
Advertising & marketing cookies
These cookies support our advertising and email marketing, and are set only while marketing cookies are active on your device. The Meta pixel measures the performance of our advertising and helps show you relevant ads on Facebook and Instagram; we also send a matching server-side purchase event to Meta (the Conversions API), which follows the same condition — our servers refuse to send it when marketing cookies are not active or your browser sent a Global Privacy Control signal — and sets no additional cookies. Klaviyo’s onsite tracking recognises you and records your on-site activity (such as the pages you view) so we can send you relevant marketing emails; its script is not loaded while marketing cookies are not active, and if it has already loaded we switch it off with the __kla_off cookie. On the pages of this site we use no other advertising trackers — no TikTok, Reddit or AdRoll.
Our checkout. Checkout runs on pages hosted by Shopify, not on this site. There, Shopify also runs pixels from apps we have connected to our store — TikTok, Converlay and Google’s “Google & YouTube” app — which receive your checkout and purchase events and may set their own cookies on the checkout pages. Shopify applies the privacy choices recorded with it, including an opt-out you make with the switch on our Your Privacy Choices page, when deciding whether to run them. A Global Privacy Control signal on its own is applied to them only in the US states where Shopify honours it; elsewhere these checkout pixels may still run, and we are reviewing whether to remove them. The Privacy Policy lists what each of them receives.
Google Ads. We advertise on Google and YouTube. We do not load any Google advertising script or tag manager on this site, and Google sets no cookies here. Instead, when you arrive from one of our ads, Google adds a click identifier (a “gclid” or “wbraid”) to the web address you land on. If — and only if — marketing cookies are active on your device, we read that identifier from the address and save it in our own _vochlea_gads cookie (listed below) so it is still available when you check out. We then record it against your order, so that we can later report the purchase to Google Ads and credit it to the ad you clicked.
While marketing cookies are not active we do not read the identifier from the address at all — we do not store it temporarily and, where we ask for consent, we do not hold it while waiting for your answer. If you decline, opt out, or later withdraw your consent, the cookie is deleted and nothing is reported to Google; a Global Privacy Control signal has the same effect, including on our servers. The cookie expires automatically after 90 days, which is the longest period over which Google Ads credits a purchase to an earlier ad click.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
_fbp | Meta (Facebook & Instagram) | 90 days | Set by the Meta pixel to measure and deliver our advertising. Set only while marketing cookies are active on your device (see “Your choices”); otherwise the pixel is loaded in a suppressed state and sets nothing. |
_fbc | Meta (Facebook & Instagram) | 90 days | Stores the ad-click identifier that Meta adds to the web address when you arrive from a Facebook or Instagram ad, so that a purchase you make later can be attributed to that ad. It is set both by the Meta pixel and, when you arrive from one of our ads, directly by us (first-party) on landing — in either case only while marketing cookies are active on your device (see “Your choices”); otherwise the identifier is not read from the address at all. It is deleted if you withdraw consent or opt out, and expires after 90 days (the longest period Meta attributes a purchase to a click). |
_vochlea_gads | Vochlea (shared with Google) | 90 days | Preserves the Google Ads click identifier (a “gclid” or “wbraid”, together with the time it was captured) that Google adds to the web address when you arrive from one of our ads, so that a purchase you make later can be credited to the ad you clicked. Set only while marketing cookies are active on your device (see “Your choices”) — otherwise we do not read the identifier from the address at all — and deleted if you withdraw consent or opt out, after which no conversion is sent to Google. It expires after 90 days, the longest period Google Ads attributes a purchase to a click. |
__kla_id | Klaviyo | Up to 2 years | Set by Klaviyo’s onsite tracking script to recognise you across visits and record your on-site activity (such as the pages you view) for our email marketing. Set only while marketing cookies are active on your device (see “Your choices”) — otherwise the script is not loaded, and if it has already loaded our __kla_off cookie (listed above) switches it off. Klaviyo also stores related identifiers in your browser’s storage (for example _kx, used to link clicks from our marketing emails). |
Embedded third-party content
Some pages include content embedded from other services, such as YouTube or Vimeo videos and Typeform forms and quizzes. When that content loads, the provider may set its own cookies or store data on your device, over which we have limited control. These are governed by the provider’s own privacy and cookie policies (linked below).
YouTube videos load automatically. Where a page contains an embedded YouTube video, the player is loaded as soon as you open that page — before, and regardless of, any cookie choice you make. This means YouTube (Google) receives your IP address and may store data on your device from that moment. We use YouTube’s privacy-enhanced (“no-cookie”) mode, which limits what is stored unless you press play, but it does not prevent the connection to YouTube. If you would rather this did not happen, avoid pages with embedded videos, or block third-party content for this site in your browser settings.
Vimeo videos and Typeform embeds are handled differently, and follow your marketing cookie choice. Where we show a cookie banner, they are not loaded until you have given consent or clicked the “Load content” button shown in their place. Where we do not show a cookie banner, they load automatically unless you have opted out (or your browser sends a Global Privacy Control signal), in which case the “Load content” button is shown instead. The one exception is the English version of our Contact page: its contact form is provided by Typeform, so it loads from Typeform as soon as you open that page, regardless of your cookie choices, and what you type into it is sent to Typeform.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
VISITOR_INFO1_LIVE, YSC, __Secure-* (plus yt-* in local storage) | YouTube (Google) | Session up to ~2 years | Set when an embedded YouTube video loads or plays, to remember playback preferences and measure views. YouTube videos load automatically when you open a page that contains one, so YouTube is contacted whether or not you have accepted cookies. We use YouTube’s privacy-enhanced (“no-cookie”) mode, so what YouTube stores is limited unless you actually play a video. |
vuid (plus player cookies) | Vimeo | Up to ~2 years | Set when an embedded Vimeo video loads, to store playback preferences and analytics. |
Various (e.g. attribution_user_id) | Typeform | Up to 1 year | Set when an embedded Typeform form, quiz or survey loads, to support its functionality and usage statistics. |
Third parties and their privacy policies
Where cookies or data are handled by a third party, that company is the data controller for the data it collects. You can learn more, and in some cases opt out directly, using the links below:
- Shopify — privacy policy
- PostHog — privacy policy
- Meta (Facebook & Instagram) — privacy policy
- Google (YouTube & Google Ads) — privacy policy · opt out
- Vimeo — privacy policy
- Typeform — privacy policy
- Sentry (error monitoring — no cookies) — privacy policy
- TikTok (checkout pixel) — privacy policy
- Converlay (checkout pixel) — privacy policy
- Cloudflare (Turnstile bot-protection on our sign-in and sign-up forms) — privacy policy
- Klaviyo (email marketing & onsite tracking) — privacy policy
Controlling cookies in your browser
In addition to the controls described above, most browsers let you view, manage and delete cookies through their settings, and block some or all cookies. Please note that if you block all cookies (including strictly necessary ones), some parts of our website may not work correctly. General information about cookies is available at aboutcookies.org.
Changes to this policy
We may update this Cookies Policy from time to time to reflect changes to the technologies we use or for legal reasons. The date at the top of this page shows when it was last updated.
Contact us
If you have any questions about this Cookies Policy or how we use cookies, please contact us at help@vochlea.co.uk. For more information about how we process your personal data, see our Privacy Policy.
If you are in the UK or EU and are unhappy with how we handle your data, you have the right to lodge a complaint with your data protection authority. In the UK this is the Information Commissioner’s Office (ICO), ico.org.uk.
