We use cookies and similar technologies on heylibro.com. Non-essential ones are used only with your consent, and you can change your choice at any time via “Cookie Settings”.
The website heylibro.com and its subdomains (the “Website”) are operated by CYTRIXLABS LTD, a private limited company incorporated in the Republic of Cyprus under registration number HE 498352 (“HeyLibro”, “we”, “us”, “our”). Our registered office is at Kasandras 7, Flat/Office 101, Strovolos, 2021 Nicosia, Cyprus. We are the controller of the personal data collected through cookies on the Website, unless this policy names another controller.
This policy explains which cookies we use, why we use them, who else receives the data and how you can control them. It supplements our Privacy Policy, which describes our other processing of personal data and how to exercise your rights.
In this policy, “cookies” means cookies and similar technologies, such as local storage and pixels. The policy applies to visitors in every country, with additional information for the European Economic Area (EEA), the United Kingdom, Switzerland and the United States.
2. What cookies and similar technologies are
Cookies are small text files that a website stores in your browser so it can recognize your browser and remember information between pages or visits.
• First-party cookies are set by the Website itself (domain heylibro.com). Third-party cookies are set by another domain, such as an analytics or advertising provider.
• Session cookies are deleted when you close your browser. Persistent cookies remain until they expire or you delete them.
• Local storage (HTML5 Web Storage) keeps information in your browser like a cookie, but has no expiry date and is not sent to a server automatically. It remains until the script that created it, or you, delete it.
• Pixels (tags) are small pieces of code that send information about your visit, such as the page viewed, to a provider.
Under EU and UK law, all of these technologies are treated alike: storing or reading information on your device requires your consent, unless it is strictly necessary to provide a service you have requested.
3. Categories we use and our legal basis
We use three categories. Strictly necessary items are always active; Performance and Targeting items stay off until you opt in, wherever you are located.
Strictly necessary
What it does: Runs the Website: security, sign-in, remembering your cookie choices
Providers: HeyLibro, CookieScript
Your consent: Not required; always active
Legal basis (EEA, UK, Switzerland): Exempt from consent under Article 5(3) of the ePrivacy Directive (2002/58/EC) as implemented in Cyprus. Any personal data: Article 6(1)(b) GDPR (to provide the service you request) and Article 6(1)(f) GDPR (our legitimate interest in a secure, working website)
Performance
What it does: Measures visits, registration and checkout starts so we can improve the Website. HeyLibro stores event counts without account identifiers for 30 days, with daily removal of expired events.
Providers: HeyLibro, Google Analytics 4
Your consent: Required; off by default
Legal basis (EEA, UK, Switzerland): Your consent: Article 5(3) ePrivacy Directive and Article 6(1)(a) GDPR
Targeting
What it does: Measures and personalizes our advertising on Meta services; enables web push notifications and marketing campaigns
Providers: Meta Pixel, ContactPigeon
Your consent: Required; off by default
Legal basis (EEA, UK, Switzerland): Your consent: Article 5(3) ePrivacy Directive and Article 6(1)(a) GDPR
Because we are established in Cyprus, the EU General Data Protection Regulation (GDPR) applies to our processing of personal data of all visitors. We therefore apply the same consent-based approach to visitors outside Europe, including in the United States.
You can withdraw your consent at any time. Withdrawal does not affect processing that took place before it.
4. Cookies and similar technologies on our Website
The table lists the cookies and local storage items used on heylibro.com. Local storage items have no fixed expiry: they remain until the script that created them, or you, delete them.
CookieScriptConsent
Category: Strictly necessary
Provider: CookieScript (our consent platform)
Type: First-party cookie
Purpose: Stores your cookie choices so we can apply them and do not ask again
Duration: 6 months
_ga
Category: Performance
Provider: Google
Type: First-party cookie
Purpose: Distinguishes visitors with a randomly generated client ID to produce visitor, session and campaign statistics
Duration: 2 years (Chrome limits it to 400 days)
_ga_K4DYXJV6GH
Category: Performance
Provider: Google
Type: First-party cookie
Purpose: Keeps session state for our Google Analytics 4 property
Duration: 2 years (Chrome limits it to 400 days)
_fbp
Category: Targeting
Provider: Meta
Type: First-party cookie
Purpose: Identifies your browser so Meta can deliver, measure and optimize our ads
Duration: 90 days
_fbc
Category: Targeting
Provider: Meta
Type: First-party cookie
Purpose: Stores the click identifier when you arrive from a Meta ad, to attribute the visit
Duration: 90 days
lastExternalReferrer
Category: Targeting
Provider: Meta
Type: Local storage
Purpose: Records the external page that sent you to our Website, for ad attribution
Duration: Until deleted
lastExternalReferrerTime
Category: Targeting
Provider: Meta
Type: Local storage
Purpose: Records when that referral happened
Duration: Until deleted
cp_shSess
Category: Targeting
Provider: ContactPigeon
Type: Local storage
Purpose: Records your navigation in the current session and your interaction with our active campaigns
Duration: Until deleted
cp_localStorageTrigger
Category: Targeting
Provider: ContactPigeon
Type: Local storage
Purpose: Triggers ContactPigeon sign-up forms and campaign messages
Duration: Until deleted
wantsnots
Category: Targeting
Provider: ContactPigeon
Type: Local storage
Purpose: Remembers your answer to our web push notification prompt
Duration: Until deleted
Google, Meta and ContactPigeon items are created only after you enable the relevant category, and we delete them from your browser when you withdraw consent where technically possible. When you sign in, submit a form protected against automated abuse or pay for a subscription, our sign-in, security and payment providers may also set strictly necessary items needed for that step.
5. Third parties and international transfers
Google, Meta and ContactPigeon receive data through these technologies. Google and ContactPigeon act on our instructions as processors; Meta also uses the data for its own purposes.
Google Ireland Limited and Google LLC
Role: Processor for Google Analytics
Data received: Pseudonymous client ID, pages viewed, events, device and browser data, approximate location
Location and transfer safeguard: USA: EU-U.S. Data Privacy Framework and Standard Contractual Clauses
For visitors in the EEA and the UK, we and Meta Platforms Ireland Limited are joint controllers for collecting data with the Meta Pixel and transmitting it to Meta. Meta is solely responsible for what it does with the data afterwards, including use in its own advertising products, and may also read its own cookies on its domains (such as facebook.com) under its own policies.
Where data is transferred outside the EEA, we rely on the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. framework) for certified recipients, or on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards using the contact details in section 10.
6. How to manage your choices
You decide which optional categories we use, and you can change your mind at any time.
• Cookie banner. On your first visit, we ask for your choice before any optional item is set. “Accept all” and “Reject all” are equally easy to select, and “Customize” lets you choose by category. If you close the banner without choosing, optional items stay off. We show the same banner to all visitors, wherever they are located.
• Cookie Settings. Open “Cookie Settings” or “Your Privacy Choices” in your profile, or use the links at the bottom of the home page and legal documents. Withdrawing consent is as easy as giving it.
• Global Privacy Control (GPC). If your browser sends a GPC signal, we switch Targeting off for that browser and show “Opt-Out Request Honored” in your settings. We do this for all visitors.
• How long we keep your choice. We store your choice, whether acceptance or refusal, for 6 months and then ask again. We ask sooner if we add new technologies or purposes. To demonstrate compliance, we keep a record of your choice (a random consent ID, date and time, your selections and the banner version) for up to 3 years.
• Browser controls. You can block or delete cookies and local storage (“site data”) in your browser: Chrome, Firefox, Safari, Microsoft Edge (Settings > Cookies and site permissions). If you block strictly necessary items, sign-in and payments may not work.
Targeting cookies are off unless you turn them on, and you can turn them off again at any time through “Your Privacy Choices”. Depending on your state of residence (for example, California, Colorado, Connecticut, Oregon, Texas or Virginia), you may have the rights described below.
• Information collected through cookies. Identifiers (cookie and device identifiers, IP address); internet or other electronic network activity (pages viewed, clicks, referring page); and approximate location derived from your IP address. We do not use cookies to collect sensitive personal information.
• Sale, sharing and targeted advertising. When you enable Targeting cookies, Meta receives information about your activity on our Website for advertising. Under California law this may be “sharing” for cross-context behavioral advertising, and under other state laws “targeted advertising” or a “sale”. We do not sell personal information for money, and we do not knowingly sell or share personal information of consumers under 16.
• How to opt out. Open “Your Privacy Choices” in your profile, or at the bottom of the home page and legal documents, and switch off Targeting. If you are signed in, we also apply your opt-out to your account.
• Global Privacy Control (GPC). We honor GPC signals from all visitors (see section 6). For U.S. residents, we also treat a GPC signal as a valid request to opt out of sale, sharing and targeted advertising for that browser.
• Do Not Track. Browsers’ “Do Not Track” signals have no common standard, so our Website does not respond to them; we honor GPC instead.
• Retention. Each item is kept for the duration shown in section 4.
This section, together with our Privacy Policy, is our notice at collection. To exercise your other rights (to know, access, correct or delete your data, and to appeal our decision), see our Privacy Policy. You may use an authorized agent; we will ask for proof of their authority.
8. Children
The Website and our services are intended for adults aged 18 and over. We do not knowingly use cookies to collect personal data from anyone under 18.
9. Changes to this policy
We review this policy at least once a year and whenever we add or change a technology. We will update the “Last updated” date and, where a change requires new consent, ask for your choice again through the banner.
10. Contact us and complaints
For questions about this policy or to exercise your rights, contact CYTRIXLABS LTD, Kasandras 7, Flat/Office 101, Strovolos, 2021 Nicosia, Cyprus, or email support@heylibro.com.
If you are in the EEA, you can lodge a complaint with the Cyprus Commissioner for Personal Data Protection (1 Iasonos Street, 1082 Nicosia, Cyprus; commissioner@dataprotection.gov.cy) or with the supervisory authority where you live or work. In the UK, you can complain to the Information Commissioner’s Office. We would appreciate the chance to address your concern first.
11. In the App
The App does not use browser cookies. Its analytics and marketing choices are stored separately on your device and are independent of your cookie choice on the Website and of “Offers & news”.
Analytics uses Google Analytics for Firebase and Google Tag Manager: usage events, screens, and an identifier of your installation of the App, without an advertising identifier. If a Google Tag Manager container is built into the App, the App downloads its configuration from Google's servers on every launch, regardless of your choice; that download carries no events or identifiers that could identify you as a reader.
Marketing uses Meta App Events: events, app installs and launches, and your device's advertising identifier. On iOS, we also ask the system tracking permission after you allow Marketing, and collect the identifier only if you grant it. On Android, the identifier is collected once you allow Marketing.
You can change your choice at any time in Account → Privacy in your profile. A change takes effect from the next event, without restarting the App. Withdrawing Analytics clears locally stored Google Analytics for Firebase data on your device; information already sent to Google or Meta is not deleted.