Cookie and Storage Notice

Natalore — https://natalore.com

---

In brief — the five things that matter most

1. Without your consent you receive at most one cookie, and it is our own. That cookie (NEXT_LOCALE) contains nothing but a language code, and it is not even always created: if you view the site in your browser's own language and do not switch language, you receive no cookie at all. Meta's advertising cookies (_fbp, _fbc) are created only if you choose "Accept" on the consent bar (section 4.1). A further cookie of our own (nl_admin) is created only when the operator signs in to the administration (section 3.2).
2. The most sensitive data is not held in a cookie. The questions and the order form store your first name, your birth data (the date and, if you gave them, the time and the place), for a two-person reading the first name and birth data of the other person (the Second Person), your e-mail address and — if you give them — the topics you chose for the Reading and your own question in your browser's session storage (sessionStorage). That is not a cookie, but the law applies to it as well — which is why Chapter 6 lists every item. These data disappear when you close the browser tab concerned, and this storage operation itself never sends them off your device.
3. We load Meta's advertising measurement code (the Meta pixel) only with your consent. The consent bar asks for it; until you accept, the code is not even loaded, and after "Reject" it is never loaded (section 4.1, Chapter 8). There is no Google Analytics, no Google Ads tag, no Tag Manager and no other advertising code. Our audience measurement is our own, cookieless solution, which stores nothing in your browser (Chapter 7).
4. If you arrive by clicking an advertisement, the campaign parameters and the advertising click identifier (gclid, fbclid, msclkid, ttclid) of the page you arrived on are kept only in the page's memory until you decide. They are written to your browser's session storage — and sent with the order to our own server, where we store them with the order data — only if you accept advertising measurement (sections 6.1.3 and 7.4). If you refuse, or do not decide, nothing is stored, and your order carries no such data.
5. Card payment takes place on Stripe's own site — that is also where you enter your billing name and address. Stripe's cookies are created on the checkout.stripe.com domain, not on ours.

If the language versions of this notice differ from one another, the interpretation more favourable to you prevails.

---

1. What this notice covers and what it is based on

This notice describes what the https://natalore.com website places on your device (computer, telephone, tablet) and what data stored there it accesses — irrespective of whether the storage technique concerned technically qualifies as a "cookie".

Legal basis.

• Section 155(4) of Act C of 2003 on Electronic Communications (the Hungarian Electronic Communications Act, the Eht.), which is the Hungarian transposition of Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive). The Hungarian text provides, in a working translation:

  "Data may be stored on, or access may be gained to data stored on, the electronic communications terminal equipment of a subscriber or user only with the consent of the user or subscriber concerned, given after clear and comprehensive information — extending also to the purpose of the data processing — has been provided to that person."

  (This rendering is a working translation provided for information only; the authentic text is the Hungarian one.) The corresponding provision of Union law reads, in its official English version:

  "Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."

  — Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC

• Article 6(1)(a) and Article 7 of Regulation (EU) 2016/679 (GDPR) (the conditions for valid consent) and Article 13 GDPR (information to be provided in advance), where the data stored is at the same time personal data.

Two things must be kept apart. Section 155(4) of the Eht. applies to the act of storage and of access itself — even where the information stored is not in itself personal data. Where the information stored is also personal data, the GDPR applies to its processing as well, and the Privacy Policy gives detailed information about that.

Related documents: Privacy Policy · Terms of Service · Legal Notice · Withdrawal Information Notice · Complaints Policy.

This notice is directly accessible from every page of the website, and may be read, printed and saved free of charge.

The language of this notice. This notice is available in Hungarian, English and Spanish. If you have a question, you may request information free of charge at support@natalore.com.

---

2. Definitions — what a cookie is and what web storage is

Why does the difference matter? A cookie travels to the server with every request; the contents of sessionStorage/localStorage do so only if the code of the page expressly sends them. The law, however, applies to both, which is why this notice lists the entire contents of web storage in addition to the cookies.

---

3. The cookies we use — the complete list

The list is based on the source code of our own application. We place no other cookie of our own, and — apart from Meta's advertising cookies under section 4.1, which are created only with your consent — we allow no other cookie to be placed on our domain.

What you should know about the table above:

• Even NEXT_LOCALE is not always created. The website writes it only where the language displayed differs from the one that would be expected on the basis of your browser settings or of an earlier choice. If you view the site in your browser's own language and do not switch language, you receive no cookie at all.
• The content of NEXT_LOCALE is a single language code (for example hu or en). It is not a unique identifier, it contains no personal data, and it is not capable of recognising or tracking you.
• There is no other cookie of our own. There is no login (session) cookie for visitors, because the website has no user account; nor is there a separate anti-abuse (CSRF) cookie, a measurement cookie or a "consent reminder" cookie — we keep your decision on the consent bar in local storage, not in a cookie (section 6.2). An advertising cookie is created only with your consent (section 4.1).

Legal classification. The NEXT_LOCALE cookie is strictly necessary for the provision of the service you have expressly requested — displaying the website in the language chosen — and we therefore do not ask for separate consent for it. The detailed reasoning is set out in Chapter 8.

---

4. Third-party code and cookies on our domain: only Meta's, and only with your consent

On the https://natalore.com domain a third party's code runs and sets cookies only with your prior, express consent: that of Meta, for advertising measurement (section 4.1). Without consent — and until you have decided — the website loads no advertising or social media script, no such cookie is created, and your browser sends no request to Meta. In every other respect the list is negative; this is supported by the following findings, each verified against the source code:

Without your consent, an external script loaded at run time is on the site only if we switch on audience measurement by Plausible (section 7.2), and that one is cookieless. Meta's script (section 4.1) is loaded only after you have accepted it. Our own audience measurement (section 7.1) loads no external script.

4.1 Meta's advertising measurement — only after your consent

To measure the effectiveness of our advertisements shown on Meta's services, and to show those advertisements to visitors of our website (retargeting), we use the Meta pixel of Meta Platforms Ireland Ltd. (Dublin, Ireland). Its code is loaded from Meta's server (connect.facebook.net), and it sends its signals to Meta (facebook.com) — but only if you chose "Accept" on the consent bar. If you refuse, or until you have decided, the code is not even loaded: no cookie is created, and your browser sends no request to Meta. We use no other advertising provider.

The cookies:

Because _fbp and _fbc sit on our domain, your browser also sends them to our own server with its requests; our application does not use them.

What Meta receives. While the code runs, your browser sends Meta the events below. With each event Meta receives the address of the page (together with any parameters in it) and of the referring page, your browser identifier (User-Agent), your IP address (as an inherent incident of the request), the time, and the identifiers stored in _fbp and _fbc.

Where the code sends nothing: on the private reading pages, on the withdrawal form, and on any page load whose address carries an access code or a token. The access code of your order is never sent to Meta.

What Meta does not receive: your name, your e-mail address, your date, time and place of birth, your billing address, the topics you chose for the Reading, your own question, the data of the Second Person of a two-person reading, or the content of the Reading. We have switched off Meta's automatic functions: automatic advanced matching (so no e-mail address, telephone number or name is sent, not even in hashed form), automatic event detection (the code collects no button clicks and no page metadata) and Meta's automatic counting of page views when you move around within the website (we send the page view ourselves, under the rules above). Our server sends nothing to Meta — there is no server-side event forwarding (Conversions API).

Meta's role. For the collection of these data on our website and their transmission to Meta, we and Meta are joint controllers; after that, Meta processes the data as an independent controller, for its own purposes as well. The details, the transfer to the United States and the safeguards for it are set out in the Privacy Policy (Chapter 3 row 15, Chapter 7 row 9, section 8.4).

Legal basis: consent under Article 6(1)(a) GDPR, in conjunction with Section 155(4) of the Eht. Consent is voluntary: refusing carries no disadvantage whatsoever — the site and the ordering process work exactly the same way.

How to withdraw: clicking the Cookie settings button in the footer clears your decision, and the bar reappears; if Meta's code had been loaded, the page reloads, so that the code stops at once. Withdrawal is as easy as giving consent (Chapter 8). The two cookies Meta's code set on our domain (_fbp, _fbc) are deleted by our code at the same moment — and likewise whenever you refuse, or your consent lapses because the question has changed. Meta's cookies on its own domains are beyond our reach; Chapter 9 explains how to remove them. Withdrawal does not affect the lawfulness of processing carried out before it (Article 7(3) GDPR).

One reservation, for the sake of accuracy. The list above is based on the code of our own application. If a content delivery network or a web application firewall (CDN/WAF) is ever placed in front of the website, it may set a cookie of its own (for example __cf_bm) on our domain; in that event this chapter will have to be supplemented.

---

5. Stripe's cookies — on Stripe's own domain

Card payment does not take place on our site: after you press the order button, your browser redirects you to Stripe's own payment page (checkout.stripe.com).

It follows that:

• Our website loads no Stripe script, and Stripe sets no cookie on the https://natalore.com domain.
• Stripe's cookies (typically __stripe_mid, __stripe_sid — the precise list and the lifetimes are set out in Stripe's own notice) are created on the checkout.stripe.com domain, within Stripe's own processing, while you are there.
• Those cookies are governed by Stripe's own cookie notice and privacy policy, not by this document. The contracting entity is: Stripe Payments Europe, Limited (Ireland).
• We never see and never store card data — neither in a cookie nor anywhere else.
• You also enter your billing name and address on Stripe's payment page. After the payment Stripe passes them to us so that we can issue the invoice; our website does not store them in your browser (the processing is described in the Privacy Policy).

---

6. Data stored on your terminal equipment that does not qualify as a cookie

This is the most important chapter of this notice. The items listed here are not cookies, but Section 155(4) of the Eht. applies to all data stored on your device. Among the items the questions and the ordering process store are some that qualify as personal data — including your birth data.

6.1 Session storage (sessionStorage) — lives until you close the tab

6.2 Local storage (localStorage) — a single item: your consent decision

The free preview is produced in your browser. The birth chart is calculated by code running in your browser; the first name and birth data you enter are not sent to our server for that purpose. There is one exception: if you type into the birthplace search box, your browser sends the text typed (at most 80 characters) to our own server, which returns matches from the list of places it holds; our application does not store the text typed and does not pass it on to any third party. Your data reach us if you place an order; the Privacy Policy deals with that.

6.3 Why the storage under 6.1.1 and 6.1.2 qualifies as "strictly necessary"

Article 5(3) of the ePrivacy Directive — and the practice of the authorities applying it — does not require consent where the storage is "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". In our view the two items above fall within that exception, for the following reasons:

1. You initiated it. The data comes into existence only if you answer the questions or place an order. Neither arises from mere browsing.
2. The data is yours, and it stays with you. The purpose of the storage is not for us to learn the data (we receive it in any event when the order is placed), but for your browser to remember it. The storage operation in itself sends nothing to our server, and still less to a third party.
3. Without it the function would not work as intended. The process consists of several steps and payment concludes on Stripe's external site. Without storage, after every page refresh, every use of the back button and every abandoned or failed payment you would have to start again from the beginning — for a two-person reading, with the data of two people — which would make reasonable use of the service impossible. And without storing the access code, the code would have to remain in the address bar.
4. The data lives for the shortest possible time. The storage is tied to the browser tab: it ends when the tab is closed. The answers to the questions and the checkout data are in addition destroyed when the successful payment is confirmed, by an express deletion instruction.
5. It is not tracking. Data stored in this way is not capable of — and is not used for — recognising you across pages or visits, building a profile of you, or targeting advertising at you.

We say so nonetheless: natalore.flow.v2 stores personal data — a name, birth data, an e-mail address and, if you give it, your own question — and, for a two-person reading, the first name and birth data of another person on your device. That is precisely why we could not content ourselves with the customary sentence that "we use only strictly necessary cookies": the law requires information about the fact of storage, whatever the sensitivity of the data stored.

Keeping the two legal layers apart. What is said in this section answers the question whether consent is required for the act of storage (Section 155(4) of the Eht.). It is a separate question that you also give us the same data with your order: the legal basis for processing that data under the GDPR — including the data of the Second Person — is set out in detail in the Privacy Policy.

6.4 What is not strictly necessary — and is therefore stored only with your consent

The storage under natalore.attribution.v1 (6.1.3) serves a measurement purpose, not the provision of the service: the order could be completed without it. In our view the exception set out above therefore does not extend to this item, and the requirement of prior consent under Section 155(4) of the Eht. arises for it. We therefore store it only with your consent: the question on the consent bar — whether you allow advertising measurement — covers this item as well (Chapter 8). Until you decide, the campaign data of the first page of your visit are held only in the memory of the page; they are written to session storage only after "Accept", and if you choose "Reject" or do not decide, nothing is stored.

What we do not conceal: the contents of natalore.attribution.v1 — unlike what point 2 of section 6.3 says of the other items — do not stay on your device. When the order is submitted, your browser also sends the campaign parameters, the click identifiers and the address of the referring page to our own server, where we store them with the order data — that is, in the same record-keeping in which your e-mail address appears (section 7.4). This happens only if the item was stored, that is, only with your consent; otherwise your order carries no such data.

If you withdraw your consent, the item is deleted from your browser at once. Withdrawal does not reach the data already sent with an order placed earlier; if you would like those removed as well, please let us know at support@natalore.com (Privacy Policy, Chapter 10).

6.5 What we do not store in your browser's storage

• We store no login data or password in the browser's storage — there is no user account for making a purchase in the first place.
• We store no card data, neither in a cookie nor in web storage.
• We use no IndexedDB, Service Worker or browser-side cache (Cache Storage) to store data.
• We apply no device fingerprinting — neither browser-based, nor canvas-based, nor font-based. Your browser draws the sky on the home page onto a canvas element; we do not read that drawing back and do not use it for identification.

---

7. Audience measurement — cookieless, but not invisible

7.1 Our own measurement

We follow the audience of the website with our own, cookieless measurement: your browser sends a short signal about page views and a few steps of the process (section 7.3) to our own server, which stores it in our own database. No third party is involved, and no external script is loaded for it.

What a signal contains: the name of the event and its short attributes (section 7.3); the path of the page opened — without the query part (the part of the address after ?), and on the order status page and the private reading page with a general placeholder instead of the order identifier —; the language of the page; on the first page view, the domain part of the address of the external referring page (for example www.google.com).

How we tell visitors apart — without cookies: from your IP address and browser identifier (User-Agent) the server calculates a one-way hash with a secret salt that is known only to the server and changes every day, and ties the event to this daily visitor identifier; from the browser identifier it also determines the type of device (phone, tablet, desktop). We do not store the IP address or the browser identifier, measurement requests are not written to the application log either, and neither can be recovered from the hash without the salt. The next day the same visitor receives a new identifier, so visits made on different days cannot be linked. Signals from known robots and automated requests are not stored.

The daily identifier is pseudonymised data, and we therefore do not claim that the measurement is "entirely anonymous". What we do claim is that it is cookieless, that it stores nothing in your browser, and that we derive statistics from the data: we see how many visitors came, from where, and how far they got in the process — including the path of an individual visitor on a given day, but without a name, an e-mail address or an order. We do not link the event data with the data of orders, and we keep them for statistical purposes for an indefinite period.

What we can prove about our own code: our audience measurement writes no cookie at all, and — apart from the item named in section 6.1.3, which is created only with your consent — we create no storage key for measurement purposes either. Meta's advertising cookies are dealt with in section 4.1.

The legal basis for the measurement is legitimate interest under Article 6(1)(f) GDPR — understanding and improving the use of the website — to which you may object under Article 21 GDPR (section 9.4).

7.2 Plausible Analytics — only if we switch it on

If we supplement the measurement with the service Plausible Analytics (Plausible Insights OÜ (Estonia)), your browser also sends the same page views and events — with the same path, without the query part and without the order identifier — to the provider. According to the provider's documentation, Plausible operates without cookies: it sets no cookie and creates no device identifier.

The measurement provider acts as a processor; the processing agreement required by Article 28 GDPR will be concluded with it before that measurement is switched on. The legal basis is the same as in section 7.1. If the provider's seat or the place of processing were outside the European Economic Area, the safeguards for the transfer are set out in the part of the Privacy Policy dealing with transfers to third countries.

The measurement script is loaded from the provider's server, so once it is switched on your browser makes contact with the provider. In the course of that — even without cookies — the following reach the provider:

• your IP address (as a technical incident of the connection),
• your browser identifier (User-Agent: browser, operating system, device type),
• the referring page (where you came from), the path of the page opened and its language.

These — the IP address in particular — may qualify as personal data. How long the provider retains those data is determined by the provider's own data processing policy; at the provider we ourselves see nothing but aggregated statistics. How the provider's script behaves is evidenced by the provider's documentation and by the processing agreement to be concluded with it.

7.3 The events measured — the full list

No event sends a name, birth data, an e-mail address, a billing address, card data or your own question — neither as an attribute nor concealed in the page address. The measurement does not send the campaign parameters or the advertising click identifiers (section 7.4). The events above go to our own server (and, once switched on, to Plausible) — not to Meta; what Meta receives with your consent is listed in section 4.1.

7.4 About the advertising click identifiers — separately, because they are not trivial

What is it? If you arrive by clicking an advertisement, the advertising system appends a unique identifier to the end of the link (gclid — Google, fbclid — Meta, msclkid — Microsoft, ttclid — TikTok). That identifier can be linked to your particular advertisement click and is therefore — although it contains no name — to be regarded as a pseudonymous identifier, and it cannot be dismissed as an insignificant technical detail.

What we do with it: we read it from the URL of the first page of your visit. Until you decide on the consent bar, it is held only in the memory of the page. If you accept advertising measurement — even later during the same visit — it is written to your browser's session storage (6.1.3), and when the order is submitted your browser also sends the click identifiers to our server — together with the campaign parameters and the address of the referring page — along with the order data. There we store them with the order, in our database, so that we can see which campaign brought a purchaser; they are not written to the operational log. If you choose "Reject" or do not decide, nothing is stored and your order carries no such data; if you withdraw your consent, the stored item is deleted from your browser at once. Our legal basis — for storing the data on your device and for this processing alike — is your consent (Article 6(1)(a) GDPR, in conjunction with Section 155(4) of the Eht.); the retention period is dealt with in the Privacy Policy.

What we do not do with it:

• We do not ourselves send it back to Google, Meta, Microsoft or TikTok: our server sends nothing to any advertising network, and there is no server-side event forwarding (Conversions API). If, however, you have accepted Meta's code, that code sends Meta, with its events, the address of the page concerned — on the page you arrived on, together with the parameters in its address — and it may record a click on a Meta advertisement in the _fbc cookie (section 4.1).
• We do not use it to produce the Reading, and we do not pass it to the processor that generates the text of the Reading.
• We build no advertising profile from it, and we do not use the identifiers stored with the order to build advertising audiences or for retargeting.

This storage — as stated in section 6.4 — cannot be regarded as strictly necessary for the provision of the service, and that is why it takes place only with your consent.

---

8. The consent bar — for advertising measurement only

8.1 What the consent bar asks, and what it does not

Until you decide, a bar is shown at the foot of the screen on every page of the website. It asks a single question: do you allow advertising measurement — that is, Meta's code and cookies, with which we measure our advertising and show our advertisements on Meta's services (section 4.1), and the storage of the campaign data of your visit (sections 6.1.3 and 6.4). It offers two buttons of equal weight, "Reject" and "Accept", and links to this notice; it is shown in the language of the website's interface. The bar does not cover the page: you may go on using the site without deciding, and until you decide nothing that requires consent takes place. The bar asks nothing else, because nothing else requires consent:

1. Our cookies are strictly necessary for operation (Chapter 3): for a visitor at most a language preference, for the operator the administration sign-in. For a cookie of that kind, Article 5(3) of the ePrivacy Directive and the practice of the authorities applying it require no consent — they do require information, and this document provides it.
2. Audience measurement is cookieless (Chapter 7) and rests on legitimate interest. The bar does not ask about it, and the measurement continues to run after a refusal; it counts only the decision itself (section 7.3, consent_choice).
3. Advertising measurement, however, does require consent (sections 4.1 and 6.4) — that is the sole subject of the bar.
4. The storage used by the questions and the order form serves a function initiated by you (section 6.3), and storing your decision is strictly necessary for managing the question (section 6.2).

The bar is shown only while advertising measurement is switched on. If we switch it off, the bar does not appear, Meta's code is not loaded, and the campaign data of your visit are not stored.

8.2 How the bar meets the requirements

An advertising pixel makes the processing subject to consent. The table below sets out, item by item, what the law requires and what implements it here:

Should further advertising or profiling code be placed on the site in the future — a Google Ads tag, a TikTok pixel, Google Analytics, Tag Manager or anything similar — that, alongside the requirements above, also entails a new version of this notice and raising the version of the consent question: an earlier acceptance does not extend to a new purpose or a new provider.

---

9. How to delete or block the stored data

9.1 The quickest solution: close the tab

All the data referred to in section 6.1 — your first name, your birth data, for a two-person reading the data of the Second Person, your e-mail address, the topics you chose and your own question, the access code of your order and, if you have consented, the advertising click identifiers — is tied to the browser tab. If you close the tab (or the browser window) in which you opened the site, those data cease to exist on your own device — no separate step is required. The answers to the questions and the checkout data are in addition deleted when the successful payment is confirmed.

What closing the tab does not delete: your decision on the consent bar (section 6.2) and — if you accepted advertising measurement — Meta's cookies (section 4.1); these can be deleted in the way described in section 9.2. And if you have already submitted your order, the order data — including, if you consented, the campaign parameters and the advertising click identifiers — remain on our server, and closing the tab does not affect them (6.4, 7.4). Their retention and erasure are dealt with in the Privacy Policy.

If you are using a shared or public machine, we recommend closing the tab after ordering, or using a private / incognito window — in such a window the browser discards cookies and local storage alike when the window is closed.

9.2 Deleting the stored data, browser by browser

The menu items below reflect the current English-language interface of the most common browsers; the exact wording may differ from version to version and between interface languages. In each of them you will find the option to delete "cookies and site data", which also deletes the contents of sessionStorage and localStorage.

Using the developer tools (in most browsers the F12 key, then the "Application" / "Storage" tab) you can also inspect and delete the Cookies, Session Storage and Local Storage entries item by item.

Deleting the data of our site also removes Meta's cookies set on our domain (_fbp, _fbc) and your decision on the consent bar — in that case the bar asks again on your next visit. Meta's own cookies on its own domains (for example facebook.com) can be deleted in the same menu, among the data of the site concerned, or under the settings of your Meta account.

9.3 Blocking cookies in advance

Cookies can also be restricted or blocked in advance in the privacy settings of your browser. What does that mean on our website?

9.4 Withdrawing consent and the right to object

You may withdraw your consent to advertising measurement at any time, as easily as you gave it: through the Cookie settings button in the footer (sections 4.1 and 8.2); withdrawal does not affect the lawfulness of processing carried out earlier.

You may object, under Article 21 GDPR, to processing based on legitimate interests carried out in the context of audience measurement and logging — the details and the contact points are set out in the Privacy Policy.

---

10. Contact and remedies

The controller is: Ágnes Gróf, sole trader.

---

11. Changes to this notice

We will amend this notice if the cookie or storage practice of the website changes (for example if we introduce a new measurement tool or a CDN/WAF service), or if a change in the law or guidance from an authority so requires. We publish the text in force on the website, indicating the version number and the date of entry into force. We will bring a new storage item requiring consent, or a new advertising provider, into operation only by amending this notice beforehand and raising the version of the consent question (section 8.2).

---

Version: 1.3 · Effective: 15 October 2026