TONVI TECH SL (Spanish tax ID B-19780394), controller of the PhotoExamAI website and application, informs you through this Cookie Policy about the use of storage and data retrieval devices on Users' equipment, in accordance with art. 22(2) of Spanish Act 34/2002 (LSSI-CE) and the ePrivacy Directive.
Version of this policy: 4 September 2026.
1. What are cookies?
Cookies are small files a website stores in your browser. In this policy we also treat equivalent local storage technologies (localStorage) as cookies, because legally they receive the same treatment.
2. How we manage your consent
The first time you visit you will see a notice with three options at the same visual level: «Accept all», «Reject all» and «Customise». No box is ticked by default.
Audience measurement is first-party only: OpenPanel runs on our own servers, the data is never shared with anyone and never used to follow you across other sites. Under the Spanish and French supervisory authorities' criteria that makes it exempt from prior consent, so it is always on. The consent banner itself is only shown to visitors located in the EEA, the United Kingdom and Switzerland, where the ePrivacy rules apply; elsewhere the optional categories run by default and can be changed from the cookie preferences link in the footer. Until you choose, besides the strictly necessary ones only our own measurement runs. The marketing scripts (Trackdesk, the up_attribution attribution script and the Hypewall widget) are not downloaded or executed: they are loaded dynamically only after you accept the corresponding category.
Your decision is stored in your own browser, under the fx_consent_v1 key, together with the date you made it. You can change it at any time.
3. Categories we use
- Necessary: essential for the site to work (session, language, anti-bot security and payments). They do not require consent and cannot be disabled.
- Audience measurement: self-hosted OpenPanel, with a pseudonymous identifier, to know what is used and improve the product. First-party only, no cross-site tracking: exempt from prior consent (AEPD/CNIL criteria), always on.
- Marketing and attribution: our own up_attribution cookie, Trackdesk (affiliate programme) and the Hypewall widget. Requires your consent.
We do not use third-party behavioural advertising cookies and we do not share advertising identifiers with social networks.
4. Cookie and local storage table
| Name | Provider | Purpose | Category | Duration | International transfer |
|---|---|---|---|---|---|
| token | PhotoExamAI (localStorage, first party) | Keep the user signed in to the application. | Necessary | Until sign-out or browser data is cleared | No |
| PhotoExamAI (localStorage, first party) | Remember the account used to sign in. | Necessary | Until sign-out | No | |
| theme | PhotoExamAI (localStorage, first party) | Remember the light/dark theme preference. | Necessary | Persistent until browser data is cleared | No |
| fx_consent_v1 | PhotoExamAI (localStorage, first party) | Store your cookie decision (necessary / analytics / marketing) and its date. | Necessary | Until you withdraw it or clear browser data | No |
| cookieConsent | PhotoExamAI (localStorage, first party) | Legacy key from the previous banner. No longer used and safe to delete. | Necessary (legacy) | Persistent | No |
| __cf_bm | Cloudflare, Inc. (United States) | Distinguish human traffic from bots and protect the site from automated attacks. | Necessary / security | 30 minutes | Yes — United States, DPF + Standard Contractual Clauses |
| cf_clearance | Cloudflare, Inc. (United States) | Record that the anti-bot check (Turnstile) has been passed. | Necessary / security | Up to 1 year | Yes — United States, DPF + SCC |
| __stripe_mid | Stripe Payments Europe Ltd. (Ireland) / Stripe, Inc. (United States) | Card payment fraud prevention. | Necessary / payment | 1 year | Yes — United States, DPF + SCC |
| __stripe_sid | Stripe Payments Europe Ltd. (Ireland) / Stripe, Inc. (United States) | Identify the payment session during checkout. | Necessary / payment | 30 minutes | Yes — United States, DPF + SCC |
| op_* (OpenPanel identifiers) | OpenPanel self-hosted on our Hetzner servers (Germany, EU) | Product analytics with a pseudonymous identifier: page views, sessions and usage events. | Analytics (consent required) | Up to 1 year | No — stays within the European Union |
| up_attribution | PhotoExamAI (own cookie on the .fotoexamen.com domain) | Marketing attribution: record which campaign or link the visit came from (utm_*, gclid, fbclid, ttclid...). | Marketing (consent required) | 90 days | No |
| __up_attribution__ | PhotoExamAI (localStorage, first party) | Local copy of the marketing attribution data above. | Marketing (consent required) | Persistent until withdrawn | No |
| trakdesk_cid and other Trackdesk cookies | Trackdesk (Czech Republic, European Union) — cdn.trackdesk.com | Attribute sign-ups and subscriptions to the affiliate that referred them, in order to pay commissions. | Marketing (consent required) | Up to 90 days | No — stays within the European Union |
Microsoft Clarity (session recording) and Google Analytics 4 have been fully removed in this version and are no longer loaded on any page. Meta Pixel and TikTok Pixel are not used either.
5. How to withdraw or change your consent
You can change your decision at any time from the «Cookie settings» link in the footer, present on every page of the site, or with this button:
When you withdraw marketing consent we delete the attribution cookies under our own domain. Cookies set by third parties from their own domains must additionally be removed from your browser.
6. How to block or delete cookies from your browser
Every browser allows you to block or delete cookies from its privacy settings. The official help links are:
- Google Chrome: support.google.com/chrome/answer/95647
- Mozilla Firefox: support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
- Safari (macOS and iOS): support.apple.com/guide/safari/sfri11471/mac
- Microsoft Edge: support.microsoft.com/microsoft-edge
- Android: support.google.com/android
If you block necessary cookies you may not be able to sign in or complete a payment.
7. Further information
Details of recipients, legal bases, retention periods and your rights are set out in our Privacy Policy.
For any question about this policy write to [email protected] or [email protected]. You may lodge a complaint with the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.