Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your device — your computer, phone, or tablet — when you visit a website or use an application. They allow the website or application to remember information about your visit, such as your login session or your preferences. Cookies are widely used to make platforms work more efficiently, to improve the user experience, and to provide information to the owners of the site.

As well as cookies, Peekabl may use other similar tracking technologies including:

• Local storage — data stored in your browser that persists between sessions but does not leave your device unless transmitted separately. We use this to temporarily hold your profile image during host sign-up
• Session storage — similar to local storage but cleared when you close your browser tab. We use this to carry your registration details across the multi-step sign-up flow and to prevent duplicate feedback or booking submissions
• Pixel tags (web beacons) — small transparent images embedded in emails or pages that allow us to track whether an email has been opened or a page has been loaded

Where we refer to 'cookies' in this Policy, we mean all of the above technologies unless we specify otherwise.

2. Who Sets Cookies on Peekabl?

Cookies on Peekabl are set either by us directly (first-party cookies) or by our third-party service providers (third-party cookies) when they deliver services on our behalf — such as analytics, payment processing, or live streaming infrastructure.

Peekabl does not permit data brokers to place cookies on our platform, and we do not sell your personal data. We work with a small number of advertising and measurement partners — currently Meta (Facebook) — to measure the effectiveness of our own marketing campaigns and to reach people who have shown interest in Peekabl. Whether these partners are active by default or only after you opt in depends on your location (see Section 4). We do not build advertising profiles for other companies to use for their own targeting.

3. Categories of Cookies We Use

We use the categories of cookies described below. The first category — essential cookies — is required for the Platform to function and cannot be disabled. Non-essential categories are governed by the regional consent model in Section 4: in some regions they are deployed only after you opt in, and in others they are deployed unless you opt out. You can manage all non-essential categories at any time through our cookie consent tool.

The tables in this Section list the specific cookies and providers active as at the date of this Policy. Because the tools we use evolve, the authoritative, up-to-date list of cookies and providers is maintained in our cookie settings tool, which is scanned and refreshed regularly. Where we add a provider that serves a purpose already described in this Policy — for example, an additional analytics or advertising provider — we update that list and, where required, request your consent before the new provider is activated, without needing to reissue this Policy. We revise this Policy itself only when we introduce a genuinely new purpose or a higher-risk technology, such as session recording or replay.

3.1 Essential Cookies (Always Active)

Essential cookies are strictly necessary for the Platform to operate. Without them, core functions such as logging in, navigating between pages, or completing a payment would not work. Because these cookies are technically necessary, they do not require your consent under applicable law.

What they do:

• Maintain your authenticated session so you stay signed in as you navigate the Platform
• Renew your session securely in the background so you are not logged out unexpectedly
• Support fraud detection and security at the point of payment
• Remember your cookie preferences — ironically, we need a cookie to remember that you declined other cookies

These cookies are set by Peekabl and by our core service providers, including Stripe (payment processing). They are session-based or short-lived persistent cookies and do not track your behaviour across other websites. Our authentication cookies are HttpOnly (not readable by JavaScript) and use the SameSite=Lax attribute, which protects against cross-site request forgery. The cookies in this category are:

• peekbl_access_token (Peekabl) — HttpOnly token that keeps you authenticated across page loads and API requests. Duration: 30 days
• peekbl_refresh_token (Peekabl) — HttpOnly token used to securely renew your session without re-logging in. Duration: 30 days
• peekbl_consent (Peekabl) — stores your cookie consent choices so we do not re-prompt you. Duration: 12 months
• __stripe_mid (Stripe) — fraud detection and security during payment processing. Duration: 12 months
• __stripe_sid (Stripe) — session identifier for payment flow continuity. Duration: 30 minutes

Payments are processed on Stripe's secure hosted checkout. The Stripe cookies above are set by Stripe on its own checkout pages during the payment flow, under Stripe's privacy policy.

3.2 Analytics Cookies (Consent or Opt-Out, by Region)

Analytics cookies help us understand how users interact with the Platform — what pages are visited, where users drop off, how long sessions last, and what features are most used. This data helps us improve the Platform for everyone. We process this data in aggregate or pseudonymised form and do not use it to build individual user profiles for commercial purposes.

How these cookies are governed depends on your location (see Section 4). In regions that require opt-in consent, Google Consent Mode keeps analytics storage denied until you accept, and if you decline we rely on aggregated, cookieless signals only. In regions that operate on an opt-out basis, analytics cookies may be set by default and you can opt out at any time. The cookies in this category are:

• _ga (Google Analytics 4) — distinguishes unique users via a pseudonymous client identifier, for aggregated traffic analysis. Duration: 24 months
• _ga_<id> (Google Analytics 4) — persists Google Analytics 4 session state for the Peekabl property. Duration: 24 months

We currently use Google Analytics 4 under Google Consent Mode v2 for this purpose. If we add other analytics providers that serve the same purpose, or enable additional Google measurement features, they will appear in our cookie settings tool and, where required by law, we will obtain your consent before they are activated.

3.3 Marketing Cookies (Consent or Opt-Out, by Region)

Marketing cookies measure the effectiveness of our own marketing campaigns — for example, to understand whether a user who registered came from a specific campaign link — and allow us to show Peekabl ads to people who have previously visited our Platform (retargeting). We do not use marketing cookies to build profiles that are sold to or shared with unrelated third-party advertisers.

We currently use the Meta (Facebook) Pixel for this purpose. We may add other advertising or social measurement providers that serve the same purpose — measuring our own campaigns and retargeting our own audiences. Any such provider will be listed in our cookie settings tool and, where required, consent will be requested before it is activated.

Marketing tags are delivered through Google Tag Manager. How they are governed depends on your location (see Section 4): in opt-in regions they remain inactive under Google Consent Mode until you choose 'Accept all', and if you choose 'Necessary only' no marketing cookies are written; in opt-out regions they may be active by default and you can opt out at any time. The cookies in this category are:

• _fbp (Meta Pixel) — distinguishes browsers for measurement and retargeting of our own campaigns. Duration: 3 months
• _fbc (Meta Pixel) — stores the click identifier when you arrive from a Meta ad, so we can attribute registrations to our campaigns. Duration: 3 months

Data collected by the Meta Pixel is processed by Meta Platforms under its own privacy policy (facebook.com/privacy/policy). We do not send Meta information about the specific video experiences or live streams you view.

4. Cookies, Consent, and the Law — Our Legal Basis by Region

Under the GDPR and the EU ePrivacy Directive (implemented in Bulgarian law and across EU Member States), and under US state privacy laws, the rules for non-essential cookies differ by location. Essential cookies require no consent anywhere — their lawful basis is our legitimate interest in delivering a functioning service. For analytics and marketing cookies, the model we apply is:

• EU, EEA, and UK — opt-in consent is required (GDPR Article 6(1)(a)). Non-essential cookies are off by default and are set only after you actively consent through our cookie banner. Consent is freely given (you can decline and still use the Platform), informed, unambiguous (given by actively clicking 'Accept all', never by pre-ticked boxes or continued browsing), and withdrawable at any time (see Section 6)
• California — we operate on an opt-out model. Analytics and marketing cookies may be set by default, and you can opt out at any time using the 'Your Privacy Choices' link in our footer, by selecting 'Necessary only' in the cookie settings tool, or by enabling a Global Privacy Control (GPC) signal, which we honour as a valid opt-out
• Other US states — we provide notice of these cookies and give you the ability to opt out at any time through the cookie settings tool and the 'Your Privacy Choices' link, and we honour recognised universal opt-out signals such as GPC where required by your state's law

We do not use cookie walls — refusing or opting out of non-essential cookies does not block you from accessing the Platform. Regardless of your location, we do not share information about your specific video viewing activity with third parties without your separate, express opt-in consent (see Section 7).

5. Third-Party Cookies and External Services

Where third-party service providers set cookies or process data through our Platform, they do so under their own privacy and cookie policies, which we link below. Most of these providers act as our data processors under a Data Processing Agreement (DPA) that limits their use of data to the purposes we specify. Some, however — notably Meta in respect of Meta Pixel data — act as independent or joint controllers under their own terms rather than as our processors.

Current third-party providers and applicable policies:

• Stripe — payment processing: stripe.com/privacy
• Google Analytics — usage analytics: policies.google.com/privacy
• Google Tag Manager — tag delivery for our analytics and marketing tools: policies.google.com/privacy. Google Tag Manager itself sets no cookies; the tags it delivers are governed by the regional model in Section 4
• Meta (Facebook) — measurement and retargeting of our own marketing campaigns: facebook.com/privacy/policy
• Stream (GetStream.io) — live video and chat streaming infrastructure: getstream.io/legal/privacy. The live tour viewer connects to Stream using short-lived access tokens and may use browser local storage to maintain the connection
• Cloudinary — image hosting and delivery (CDN): cloudinary.com/privacy. Cloudinary serves images and does not set tracking cookies on the Platform

If we add a provider that serves a purpose already described in this Policy — for example, an additional advertising, analytics, or measurement provider — we will list it in our cookie settings tool and, where required by law, obtain your consent before its cookies are deployed, without needing to reissue this Policy. If we introduce a provider for a new purpose, or a higher-risk technology such as session recording or replay, we will update this Policy first. Any social sharing functionality currently on the Platform operates through direct links rather than embedded trackers.

6. How to Manage Your Cookie Preferences

6.1 Using Our Cookie Preference Tool

When you first visit peekabl.com, you will be shown a cookie consent banner appropriate to your region. This lets you:

• Accept all — enables analytics and marketing cookies in addition to essential cookies
• Necessary only — rejects all non-essential cookies; only essential cookies are used

California and other eligible US residents can also use the 'Your Privacy Choices' link in the footer to opt out of analytics and marketing cookies. You can revisit and change these preferences at any time by clicking the 'Cookie settings' link in the footer of any page on our website.

When you withdraw consent or opt out of a cookie category, we will stop deploying those cookies on your next page load. We cannot retroactively delete data already collected under a previously given consent, but we will stop all new collection immediately.

6.2 Browser-Level Cookie Controls

You can also control cookies directly through your browser settings. Most browsers allow you to:

• See which cookies are set and delete them individually or in bulk
• Block all cookies from specific websites
• Block third-party cookies globally
• Set your browser to alert you before a cookie is placed

Guidance for common browsers:

• Google Chrome — support.google.com/chrome/answer/95647
• Mozilla Firefox — support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Apple Safari — support.apple.com/guide/safari/manage-cookies-sfri11471
• Microsoft Edge — support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge

Please note that disabling essential cookies through browser settings will prevent the Platform from functioning correctly. Blocking third-party cookies from Stripe may prevent payment processing.

6.3 Mobile Application

On our mobile apps, cookies in the traditional sense do not apply. Instead, the app uses equivalent local storage mechanisms. You can manage these through:

• Your device's app privacy settings (iOS: Settings > Privacy & Security; Android: Settings > Apps)
• Deleting and reinstalling the app, which clears all locally stored data

6.4 Global Privacy Control and Do Not Track

Some browsers can send preference signals on your behalf. There are two you should know about:

• Global Privacy Control (GPC) — where you are in California or another US state whose law recognises universal opt-out signals, we treat a GPC signal as a valid opt-out of analytics and marketing cookies and of any 'sharing' for advertising purposes
• Do Not Track (DNT) — there is no industry-wide standard for how websites must respond to DNT, so, apart from the GPC handling described above, Peekabl does not currently change its behaviour based on DNT signals. If a standard is adopted, we will update this Policy

7. Cookies and Video Viewing — VPPA Compliance

Peekabl is a video streaming platform. Under the US Video Privacy Protection Act (VPPA), we are required to treat information about your video viewing activity with particular care. We do not use analytics or marketing cookies to track the specific experiences or streams you have viewed and share that information with third parties. This applies regardless of your location and is not affected by the regional model in Section 4.

Any aggregate data about viewing patterns used for internal platform improvement is processed in a non-identifying form. Separately, we record live experience sessions for quality, safety, and dispute-resolution purposes as described in our Privacy Policy; those recordings are used internally only, are not tracked through cookies, and are not shared with third parties. If we ever seek to share specific video viewing data with a third party — including through analytics tools or social features — we will obtain your separate, standalone consent as required by the VPPA and as described in our Privacy Policy.

8. Data Retention for Cookie Data

Data collected through cookies is retained in line with the durations set out in Section 3. Session cookies are deleted automatically when you close your browser. Persistent cookies expire after the period shown.

Where cookie data is used to generate analytics reports or logs, the underlying personal data is deleted or anonymised in line with Google Analytics data retention standards and our own data minimisation commitments.

For the exercise of your broader data rights including access, deletion, and portability of data collected through cookies, please refer to our Privacy Policy or contact us at legal@peekabl.com.

9. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, changes in law, or updates to our service providers. When we make changes, we will post the updated Policy on the Platform with a revised 'Last Updated' date, and the changes take effect when posted. Where a change materially and adversely affects your rights, we will give advance notice and, where the law requires it, reset your cookie consent so you can review and re-confirm your preferences.

We encourage you to check this page periodically. The 'Last Updated' date at the top tells you when the Policy was last revised.

10. Contact Us

If you have any questions about this Cookie Policy, your consent choices, or how we handle data collected through cookies, please contact us:

Peekabl (CU DPK)
Data Protection Contact: legal@peekabl.com
General Support: support@peekabl.com
Website: peekabl.com
Registered address: Sofia, Bulgaria

If you are not satisfied with our response, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the supervisory authority in your country of residence.

Peekabl — Where technology meets humanity.
We respect your privacy as much as we respect your curiosity.