Cookie Notice

GOYO Cosmetics Last updated: August 24, 2026

1. What cookies are

Cookies are small text files a website stores on your device. We also use related technologies that do similar jobs — pixels (tiny invisible images that report an event back to a server), local storage, software development kits (SDKs), and server-side event forwarding (where our server sends event data to an advertising platform directly). In this notice, "cookies" means all of them.

We use them to make the store work, to remember your choices, to understand how the site is used, and to advertise.

2. Your choices

In the EU, the UK, and Switzerland: we don't set anything other than strictly necessary cookies until you tell us we can. Our cookie banner appears on your first visit, and "Reject all" is as easy to click as "Accept all."

In the United States: strictly necessary and analytics cookies are set by default, and you can opt out of advertising cookies at any time using our banner, the "Your Privacy Choices" link in the footer, or the Global Privacy Control.

Change your mind anytime: click Cookie Preferences in the site footer.

Global Privacy Control (GPC). If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of the sale and sharing of your personal information and of targeted advertising, as required by California, Colorado, Connecticut, Texas, Montana, Oregon, Delaware, New Jersey, Nebraska, New Hampshire, Minnesota, and Maryland law.

Browser controls. Every major browser lets you block or delete cookies in its settings. Blocking strictly necessary cookies will break the cart and checkout.

3. The cookies we use

Strictly necessary — always on

Required for the site to function. You can't turn these off.

Cookie	Set by	Purpose	Duration
`_secure_session_id`	Shopify	Keeps you signed in through checkout	24 hours
`cart`, `cart_ts`, `cart_ver`	Shopify	Remembers what's in your cart	2 weeks
`_shopify_m`, `_shopify_tm`, `_shopify_tw`	Shopify	Manages privacy settings and consent	1 year / 30 min / 2 weeks
`secure_customer_sig`	Shopify	Keeps you logged in to your account	1 year
`_cmp_a` / your CMP's cookie	Shopify	Remembers your cookie choices	1 year
`keep_alive`, `localization`	Shopify	Region and language	2 weeks / 1 year

Preferences

Remember choices you've made so the site feels consistent.

Cookie	Set by	Purpose	Duration
`[popup_shown / newsletter_dismissed]`	GOYO / [klaviyo app]	Stops us re-showing a popup you closed	[30 days]
`localization`	Shopify	Country and currency preference	1 year

Analytics / performance

Tell us how the site is used, in aggregate, so we can improve it.

Cookie	Set by	Purpose	Duration
`_shopify_y`, `_shopify_s`, `_y`, `_s`	Shopify	Store analytics — unique visitors and sessions	1 year / 30 min
`_ga`, `_ga_[ID]`	Google Analytics 4	Distinguishes users, measures sessions and traffic sources	2 years / 2 years
`_gid`	Google Analytics	Distinguishes users	24 hours
`__kla_id`	Klaviyo	Recognizes you across visits; onsite behavior for email/SMS	2 years

Advertising / targeting

Used to show you GOYO ads on other platforms, and to measure whether those ads worked.

Cookie / technology	Set by	Purpose	Duration
`_fbp`	Meta Pixel	Identifies your browser for ad delivery and measurement	90 days
`fbc` / `fbclid` parameter	Meta	Attributes a visit to a specific ad click	90 days
Meta Conversions API (server-side)	Meta	Sends purchase and page events from our server, with hashed email/phone, to measure and optimize ads	Event-based
`_gcl_au`	Google Ads	Conversion tracking and attribution	90 days
`IDE`, `test_cookie`	Google / DoubleClick	Ad delivery and measurement on Google's network	13 months / 15 min
`[_ttp — TikTok Pixel]`	[TikTok]	Ad measurement and optimization	[13 months]
Klaviyo onsite tracking	Klaviyo	Abandoned-cart and browse-abandonment triggers	2 years

4. About the Meta Pixel and Conversions API specifically

We use Meta's advertising tools to show ads to people likely to be interested in our products and to measure whether those ads led to a purchase.

The Meta Pixel runs in your browser and reports events — page views, product views, add-to-cart, purchases — to Meta, along with a browser identifier.
The Conversions API sends the same kinds of events from our server. Where we send contact information such as your email address or phone number for matching, it is hashed before it leaves us, so Meta receives a scrambled value, not the address itself.
Meta uses this to build audiences, including Custom Audiences (people who visited our site) and Lookalike Audiences (people who resemble our customers).

Several US state privacy laws treat this as a "sale" or "sharing" of personal information, and as targeted advertising. You can stop it: reject advertising cookies in our banner, use the "Your Privacy Choices" footer link, or send a Global Privacy Control signal. You can also change your ad settings directly with Meta and Google.

Meta acts as an independent or joint controller for some of this activity, under its own terms.

5. Third-party opt-out tools

Digital Advertising Alliance: optout.aboutads.info
Network Advertising Initiative: optout.networkadvertising.org
YourAdChoices: youradchoices.com
Your Online Choices (EU): youronlinechoices.eu
Google Analytics opt-out: tools.google.com/dlpage/gaoptout

6. More information

How we handle the personal information collected through cookies — including your access, deletion, and opt-out rights — is set out in our Privacy Policy.

Questions: support@goyocosmetics.com.

Cookie banner copy — ready to paste

Version A — for EU/UK visitors (consent required before non-essential cookies)

Banner headline: We use cookies

Body:

We use cookies to run our store, understand how it's used, and show you relevant ads. You choose what we're allowed to use. Read our Cookie Notice.

Buttons (all equally prominent, same size and contrast): Accept all · Reject all · Manage preferences

Preference panel toggles:

Category	Default	Toggle
Strictly necessary	On	Locked
Preferences	Off	On/Off
Analytics	Off	On/Off
Advertising	Off	On/Off

⚠️ Under EU/UK law, "Reject all" must be available in the first layer of the banner, not hidden behind "Manage preferences," and must be as easy to click as "Accept all." Regulators across the EU have fined brands specifically for this. Continuing to browse is not consent.

Version B — for US visitors (opt-out model)

Banner body:

We use cookies and similar technologies to run our store, measure performance, and personalize advertising. By continuing, you agree to this use. You can opt out of advertising cookies anytime under Your Privacy Choices. See our Cookie Notice.

Buttons: Got it · Your Privacy Choices