Cookie Policy
Preamble
Copy link to “Preamble”This cookie policy explains how DAAR GLOBAL LIMITED uses cookies and similar technologies on the desioart platform (desioart.com and its subdomains) — which kinds we use, for which purposes, which third parties are involved, and how you manage your settings.
It supplements our privacy policy (Privacy, section 8 there) and, like that policy, is information required by law, not a contractual term (Terms section 19.1). All personal data arising through cookies is processed as described in the privacy policy.
Legal bases: Article 5(3) of the ePrivacy Directive 2002/58/EC as implemented nationally — in Germany section 25 TDDDG (the Telecommunications Digital Services Data Protection Act, formerly the TTDSG), in Cyprus Article 99 of Law 112(I)/2004 — together with Article 6 GDPR for the subsequent processing of personal data.
1 What cookies and similar technologies are
Copy link to “1 What cookies and similar technologies are”1.1 Cookies
Copy link to “1.1 Cookies”“Cookies” are small files of text that a website saves on whatever device you are browsing with — a computer, a smartphone or a tablet. They let us recognise your device on a later visit, store your settings and offer certain features.
1.2 Similar technologies
Copy link to “1.2 Similar technologies”Besides cookies we use similar technologies, which the law treats in the same way:
| Technology | How we use it |
|---|---|
| Local storage / session storage | stores settings directly in your browser: appearance (light or dark), accessibility settings, the settings for the privacy screen (“quick hide”) and the app lock, a counter for the app installation prompt, display preferences, and the random visitor identifier for your cookie decision (section 3.1); no content and no credentials |
| Service worker cache storage (web app) | caches static interface files for fast loading and offline display; never media, messages, API responses or signed links |
| IndexedDB | not used |
| Web beacons and tracking pixels | not used — neither on the platform nor in our emails |
| Device identifier (“fingerprinting”) | Not for tracking or advertising. Solely for account security and preventing misuse, your browser derives an identifier from technical characteristics, which is sent with your requests to us; we store and use it only as a hash, to spot unusual sign-ins, recognise “trusted devices” and prevent permanent suspensions being circumvented (Privacy sections 2.12 and 3.4). It is strictly necessary for the security of your account (section 2.1) |
Where this policy speaks of “cookies”, it covers these technologies too.
1.3 Session and persistent cookies
Copy link to “1.3 Session and persistent cookies”| Type | Duration |
|---|---|
| Session cookies | deleted automatically when you close the browser |
| Persistent cookies | stored for a set period — with us, between 7 days and 12 months — or until you delete them |
1.4 First-party and third-party cookies
Copy link to “1.4 First-party and third-party cookies”| Type | Who sets them |
|---|---|
| First-party | us directly (desioart.com) — the overwhelming majority |
| Third-party | services we take you to for a particular step, or that we embed (payment, verification, third-party sign-in) — section 3.2 |
2 Cookie categories
Copy link to “2 Cookie categories”We group cookies into four categories, matching the switches in our cookie banner. Only the first is active without consent; the other three are off by default and are used only once you consent.
2.1 Strictly necessary (essential)
Copy link to “2.1 Strictly necessary (essential)”These cookies and storage items are technically required to run the platform — without them, signing in, security, language and purchases do not work.
These include: the sign-in session, a role identifier controlling which pages load (fan or creator), storage of your cookie decision, language, “trust this device for 30 days” (only if you choose it when signing in), the age verification status for visitors without an account, the device identifier for account security (section 1.2), bot protection on forms, privacy screen and accessibility settings, and checkout.
Legal basis: section 25(2) no. 2 TDDDG; Article 6(1)(b) and (f) GDPR. No consent required; cannot be switched off (you can block them in your browser, but then the platform cannot be used).
2.2 Analytics
Copy link to “2.2 Analytics”With your consent we may include your use, linked to you as a visitor, in our own statistics, which we run ourselves (Privacy section 2.7): pseudonymised content statistics for creators (which preview was viewed, how long something played), profile visits, activity signals for session lengths, and app and loading-time telemetry. No third-party analytics services are used — no web analytics, no ad networks — and no data is passed on. Without consent, only anonymous totals are counted, with no link to a visitor.
Legal basis: section 25(1) TDDDG and Article 6(1)(a) GDPR — only with your consent; the browser signal “do not track” switches collection off as well (section 4.4).
2.3 Marketing
Copy link to “2.3 Marketing”With your consent we store which promotional link from a creator or which referral link brought you to us, so that a later purchase or registration can be attributed to the creator or referrer (tracking links: Advertising section 2; referral programme: Terms section 10 and Referral). We show no third-party advertising, set no advertising pixels and build no interest profiles.
Important for referrals: if you decline marketing cookies we store no attribution, so a later registration or purchase can no longer be attributed to the promotional or referral link, and the referring creator may lose their commission. Without consent we count the click anonymously only. For referral links we set no cookie of our own: with your consent the attribution is noted on our servers under a pseudonymous visitor identifier for 30 days.
Legal basis: section 25(1) TDDDG and Article 6(1)(a) GDPR — only with your consent.
2.4 Personalisation
Copy link to “2.4 Personalisation”With your consent we remember display and feed preferences across sessions that go beyond what is technically necessary. Your language choice is not one of them; we store that as a necessary setting (section 2.1). Recommendations in the feed rest, independently of this, on your follows and subscriptions (Terms section 3.5).
Legal basis: section 25(1) TDDDG and Article 6(1)(a) GDPR — only with your consent.
3 The cookies we actually use
Copy link to “3 The cookies we actually use”The tables below list the cookies and storage items we use. A technically current list is available at any time in the cookie banner under “settings”.
3.1 First-party (set by us)
Copy link to “3.1 First-party (set by us)”| Name | Category | Purpose | Duration |
|---|---|---|---|
refreshToken |
essential | keeps you signed in (the sign-in session); HttpOnly, Secure, SameSite=Strict, sent only to the sign-in endpoints | 7 days, extended as you use it |
trustedDevice |
essential (only if you ask for it) | skips the two-factor prompt on this device; contains only a random token, which we store hashed; HttpOnly, Secure | 30 days |
user_role |
essential | controls which pages load (fan or creator) — nothing personal beyond the role | 7 days |
NEXT_LOCALE |
essential | the language you chose (DE/EN/FR) | 12 months |
age_verified |
essential | records for visitors without an account that age verification was passed (nothing personal) | until the verification expires, at most 12 months |
tl_attr |
marketing | attributes a purchase or registration to a creator’s tracking link; set only with marketing consent and deleted once attributed; HttpOnly, Secure | 90 days |
We set no other cookies. In particular we need no CSRF cookie (sign-in is token-based and the session cookie goes only to our sign-in endpoints), no analytics cookie (whether visitor-level statistics are allowed is read from the consent stored on our servers) and no referral cookie (section 2.3).
Local storage (not a cookie, and only on your device): a random visitor identifier (platform_visitor_id) under which we store your cookie decision on our servers while you are not signed in, and the version of the banner text you agreed to (platform_cookie_hash); plus appearance, accessibility, automatic privacy screen, app lock settings, the app installation prompt, display preferences and a storage persistence marker for the web app — none of which is transmitted to us.
3.2 Third-party services
Copy link to “3.2 Third-party services”These services set cookies on their own domains when you go through a step with them, whether by redirect or in an embedded window. We have no influence over that, and their own privacy notices apply (Privacy section 5).
| Provider | When | Category | Purpose |
|---|---|---|---|
| Age verification provider | when verifying your age | essential | running and securing the check |
| Identity verification provider (creators, co-performers) | when verifying your identity | essential | running the check, preventing fraud |
| Payment service provider (cards, regional methods) | on the payment page or in the payment window | essential | payment security, 3-D Secure, fraud prevention |
| Crypto payment service provider | on the crypto payment page | essential | running the payment |
| Google, Apple, Discord, Reddit (third-party sign-in) | only if you choose that sign-in | essential | signing in with that provider |
| Bot protection service | on registration, invitation and reporting forms | essential | bot detection — cookieless, no tracking |
| Content delivery network (media, video) | when media is retrieved | – | sets no cookies; access through short-lived signed links |
| Push services (Google, Apple, Mozilla) | only if you enable push | – | no cookies; delivering notifications |
We use no third-party analytics, advertising or social media services — no web analytics, no advertising pixels, and no embedded chat or social media widgets.
4 Managing your cookie settings
Copy link to “4 Managing your cookie settings”4.1 The banner on your first visit
Copy link to “4.1 The banner on your first visit”On your first visit we show you a cookie card with equally weighted options:
- “Accept all” — all four categories are switched on;
- “Essential only” — only strictly necessary storage; the same as rejecting everything;
- “Settings” — choose category by category (analytics, marketing and personalisation separately).
Both main buttons are equal in size, colour and placement, and the non-essential categories are not pre-ticked (CJEU C-673/17 Planet49; German Federal Court of Justice I ZR 7/16 Cookie-Einwilligung II). Until you decide, no non-essential cookies are set, and you can carry on using the platform without deciding (the card stays visible as a small notice).
We store your decision on our servers — in your account when you are signed in, otherwise under a random visitor identifier — together with the version of the banner text. If the banner text changes materially, we ask you again, and in any event after 12 months (section 5).
4.2 Changing your mind and withdrawing consent
Copy link to “4.2 Changing your mind and withdrawing consent”You can change your settings or withdraw your consent at any time — as easily as you gave it (Article 7(3) GDPR):
- through the “cookie settings” link in the footer of every page;
- when signed in, under settings → privacy → cookies.
A withdrawal takes effect immediately; non-essential cookies already set are deleted or no longer evaluated.
4.3 Browser settings
Copy link to “4.3 Browser settings”You can also manage or delete cookies directly in your browser. Instructions are on each browser’s help pages:
- Chrome: https://support.google.com/chrome/answer/95647
- Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
- Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/
- Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
Please note: if you block all cookies, signing in and buying are no longer possible.
4.4 Do-not-track and global privacy control signals
Copy link to “4.4 Do-not-track and global privacy control signals”We respect your browser’s do-not-track (DNT) signal: while it is on, we collect no visitor-level statistics (search history, content statistics, activity signals, app telemetry) — not even if you have consented to the analytics category. Marketing and personalisation cookies are in any event set only after express consent in the banner. We treat the global privacy control (GPC) signal exactly as we treat DNT.
5 How long we keep them
Copy link to “5 How long we keep them”We keep cookie lifetimes as short as we can; the specific durations are in section 3. Persistent cookies expire after 12 months at the latest. Your consent lasts 12 months; after that, or if the banner changes materially, we ask again. We keep the evidence of your decision (time, categories chosen, banner version, hashed IP) for 3 years (Privacy section 7.1).
6 International transfers
Copy link to “6 International transfers”Our own cookies are processed exclusively on servers in the EU. With third-party services (section 3.2), data may reach countries outside the EEA — the USA (card payments, bot protection, sign-in providers) and the Caribbean (crypto payments). The safeguards (adequacy decision or DPF, standard contractual clauses) are those described in the privacy policy (Privacy section 6).
7 Changes to this cookie policy
Copy link to “7 Changes to this cookie policy”We adapt this policy to new legal requirements or technical circumstances. You find the current version at legal.desioart.com. Where new categories or services requiring consent are added, we use them only after you have decided again in the banner; simply continuing to use the platform does not count as consent.
8 Contact
Copy link to “8 Contact”For questions about cookies or tracking:
Data protection contact: dpo@desioart.com · Post: marked “Data protection”, 1 Apriliou 52, 7600 Athienou, Larnaca, Cyprus Data protection requests: privacy@desioart.com · General: support@desioart.com