Cookie Policy

Scope and audit date

Cookies are small data files. Similar technologies include sessionStorage and IndexedDB in your browser. This inventory reflects the LuluVela storefront code and production homepage reviewed on September 26, 2026. It does not treat image pixels in customer artwork as tracking pixels.

Strictly necessary cookies

• luluvela_cookie_consent — records your optional-cookie choices for up to 1 year so the site can honor them.
• _medusa_cache_id — separates server cache data for a visitor; set automatically for 24 hours.
• _medusa_jwt — keeps an authenticated customer signed in for up to 7 days.
• _medusa_pending_customer — carries signup details through email verification for up to 24 hours.
• _medusa_cart_id — identifies the active shopping cart for up to 7 days.
• _luluvela_auth_return — remembers the requested same-site destination during Google or Apple sign-in for up to 10 minutes.
• _luluvela_apple_cart_id and _luluvela_apple_locale — preserve the cart and language through the Apple callback for up to 10 minutes and are then cleared.
• Stripe may set its own payment-security, fraud-prevention, and checkout cookies when Stripe.js loads on checkout. Google or Apple may use provider-domain cookies only after you choose their sign-in option. Those providers control their cookie names and retention under their notices.

Preferences

• _medusa_locale — stores the language you select for up to 1 year. It is written only when you use LuluVela’s language control.
• luluvela_embroidery_ai_preview_consent (sessionStorage) — records, for the current browser tab only, that you expressly agreed to send an uploaded design for an AI embroidery preview.
• luluvela_pending_embroidery_artwork (sessionStorage) — temporarily remembers the name and preview URL for a guest design in the current tab.
• luluvela-private-designs / pending-sources / latest-guest-embroidery-source (IndexedDB) — keeps a guest upload on that device for the requested embroidery flow and automatically rejects and removes it after 24 hours.

Analytics

LuluVela did not load Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, Hotjar, Microsoft Clarity, Segment, PostHog, Mixpanel, Plausible, or another analytics pixel in the storefront code or production homepage reviewed on the audit date. Accordingly, no LuluVela analytics cookie is currently active. Aggregate infrastructure logs generated by hosting and security providers are not browser analytics cookies.

Advertising and attribution

• luluvela_referral — a session cookie written only after Advertising & attribution consent; its opaque code is copied to cart metadata to attribute a qualifying personal referral.
• Partner attribution is attached server-side only through a Company-specific approved offer; LuluVela does not use a generic Partner cookie for personal retail orders.
• No third-party behavioral-advertising or social-media pixel was found in the audited storefront or production homepage.

Consent and controls

Strictly necessary cookies are set without an opt-in because the requested security, account, cart, checkout, Team Order, or payment function depends on them. LuluVela provides first-visit choices for Preferences and Advertising & attribution. A persistent Cookie Settings link in the footer lets you withdraw or change those choices; withdrawing Advertising & attribution clears its cookies. A validated personal referral code is held only in the current URL until you choose and is not converted into an attribution cookie if you reject that category. You can also block or delete cookies and browser storage in browser settings, but doing so may interrupt the related feature.

Legacy and updates

_medusa_onboarding may be read and deleted by legacy order-completion code, but the audited storefront does not create it. We will update this inventory before enabling a new browser-storage technology or tracking vendor. Last updated: September 26, 2026.