DubBox is now live → Add Dubler 2 and save 20% on both
Shop now
Vochlea

Advertising, analytics & marketing partners

This section supplements “Who we share your information with” above. When you consent to analytics or marketing cookies (see our Cookies Policy), we share limited information with the partners below — such as online identifiers, device and usage data, and your interactions with our site. What each advertising partner receives differs:

  • Meta (Facebook & Instagram) receives, through the Meta pixel and the server-side Conversions API, online identifiers, your IP address and browser information, and your interactions with our store — such as viewing a product, adding it to your basket, starting checkout, and purchasing. It also receives, in hashed (pseudonymised) form, the contact and order details you provide at checkout — your name, email address, phone number and postal address — and, for signed-in customers, a pseudonymous account identifier.
  • Google Ads receives only the ad-click identifier from the link you arrived on and the details of the resulting purchase. It receives no contact details, no hashed customer data, and no record of your browsing on this site.

We share this so that we can run and measure our marketing and operate the store. Each partner handles your data under its own privacy policy.

How long we keep this. The click identifier stays in our own cookie on your device for up to 90 days, or until you withdraw marketing consent — whichever comes first. Where it has been recorded against an order, it is kept with that order record for as long as we keep the order itself, because it forms part of the order’s commercial record. Where a purchase cannot be reported to Google straight away, it waits in a queue on our servers and is deleted as soon as Google confirms it or it permanently fails — in no case longer than 30 days. We do not write the click identifier to our diagnostic logs: those record only the order number, an error code and Google’s reference for the request, and are kept for 90 days.

You can withdraw your consent at any time. Where we show a cookie preferences banner (for example in the UK and EU), you can reopen it with the button below; you can also manage cookies in your browser. Where a partner processes data outside the UK or EEA (PostHog is hosted in the EU; Meta, Google, Sentry, Klaviyo and Cloudflare are in the US), we rely on appropriate safeguards. For transfers from the UK, we rely on the UK Extension to the EU Standard Contractual Clauses (the “UK Addendum”), or the UK International Data Transfer Agreement, or a UK adequacy regulation where one covers the destination. For transfers from the EEA, we rely on the European Commission’s Standard Contractual Clauses, or an EU adequacy decision where one applies. You can request a copy of the safeguards that apply to a particular transfer by emailing us at help@vochlea.co.uk.

PartnerWhat we use them forLawful basisPrivacy policy
ShopifyOur commerce platform: storefront hosting (Shopify Oxygen), checkout, payment processing, store analytics and cookie-consent management.Performance of a contract / legitimate interestView
PostHogProduct analytics (hosted in the EU) to understand and improve how the site is used. If you subscribe to our marketing emails while analytics consent is active, we also attach your email address to your analytics profile, so that we can connect your subscription to how you use the site. If you have not accepted analytics consent, your email address is never sent to PostHog — it goes only to Klaviyo, so that we can send you the emails you asked for.ConsentView
Meta Platforms (Facebook & Instagram)Advertising measurement and delivery via the Meta pixel and the server-side Conversions API. To measure our advertising this includes your interactions with our store — such as viewing a product, adding it to your basket, starting checkout, and purchasing — together with your IP address and browser information, and hashed customer-matching data: your email, phone number, name, address and, for signed-in customers, a pseudonymous account identifier — all matching data sent in pseudonymised (hashed) form. When you arrive from one of our Facebook or Instagram ads, Meta adds an ad-click identifier to the link (an “fbclid”). With your marketing consent we store that identifier in the _fbc cookie on your device for up to 90 days, so that a later purchase can be attributed to the ad.ConsentView
Google Ads (including YouTube ads)Advertising measurement. When you arrive from one of our Google or YouTube ads, Google adds an ad-click identifier to the link (a “gclid” or “wbraid”). With your marketing consent we store that identifier in our own cookie for up to 90 days, and record it against your order, so that we can later report the purchase to Google Ads and attribute the sale to the ad. Google receives only the click identifier and the purchase details — no contact details, no browsing stream. We load no Google advertising script on this site, and Google sets no cookie here.ConsentView
SentryError monitoring and performance diagnostics (hosted in the US). We do not include your name, email address or IP address in the crash reports we send, though Sentry necessarily receives your IP address when your browser contacts it, and derives an approximate country from it. Each report carries a random identifier, held only in your browser’s memory and discarded when you leave the page, so that we can tell how many page views a given fault affected.Legitimate interestView
Cloudflare (Turnstile)Bot-protection and abuse prevention on our login, sign-up and password-reset pages. When one of those pages loads, the Turnstile challenge runs in your browser and your IP address and limited browser characteristics (such as your user-agent and a TLS fingerprint) are sent to Cloudflare so it can tell a genuine visitor from an automated bot; when you then submit the form, our server passes the resulting token (and your IP) back to Cloudflare to confirm the check before we process the request. Cloudflare states these signals are used solely to detect and block bots — not to identify, profile or target you, and not for advertising or cross-site tracking.Legitimate interest (security & fraud prevention)View
KlaviyoEmail marketing: your email address is sent from our backend to Klaviyo when you subscribe to our newsletter, and also when you start a free product trial and tick the optional box to receive our product news and offers (a trial itself only creates your account and sends a transactional set-password email — you are added to the marketing list solely if you opt in), so that we can send you relevant marketing emails; plus onsite tracking (a script that records your on-site activity, such as the pages you view) used to tailor those emails.ConsentView
Google (YouTube)Embedded video content, in privacy-enhanced mode. Loaded automatically on pages containing a video, without waiting for a cookie choice.Legitimate interestView
VimeoEmbedded video content.Consent / legitimate interestView
TypeformEmbedded forms, quizzes and surveys.Consent / legitimate interestView

US residents: you can opt out of the “sale” or “sharing” of your personal information for targeted advertising, and exercise your other state privacy rights, on our Your Privacy Choices page.

This list was last reviewed on 26 August 2026.