iTasty
Cookie Policy
Controller and scope of this document
The controller of this website is Yaroslav Moskal, conducting business under the name Yaroslav Moskal, ul. Szlak 77/222, 31-153 Kraków, Poland, NIP: 6793286602.
This policy describes cookies and similar technologies used on the iTasty landing page, including analytics scripts, security mechanisms and technologies that may store or read information on the user's device.
What cookies and similar technologies are
Cookies are small text files saved on the user's device by a website. Similar technologies include scripts, local storage, pixels or security tools that help operate, protect or measure website usage.
Technologies we currently use
- Essential technical and security mechanisms used to display the site correctly and protect the contact form.
- Umami Analytics used in a privacy-first setup to measure visits and basic site performance without storing cookies, localStorage or sessionStorage on the user's device.
- Meta Pixel (Facebook, Meta Platforms Ireland Limited) — a marketing tool used only after you grant consent in the cookie banner, to measure ad performance and tailor ad audiences.
- ChatGPT Ads Measurement Pixel / OpenAI — a marketing measurement tool used only after you grant consent in the cookie banner, to attribute contact inquiries to ChatGPT ads.
- Umami Session Replay — session recording (cursor movement, scrolling, clicks) used to analyze site usability, run only after you grant consent in the cookie banner, the same as the marketing pixels. The contact form and all input fields are always excluded from recording.
| Name / provider | Purpose | Type | Example data | Retention |
|---|---|---|---|---|
| Essential website mechanisms / iTasty | Displaying the website correctly, supporting technical sessions, security and stability. | Essential / technical | Browser technical data, HTTP requests, technical settings. | For the duration of the website visit or session, depending on the mechanism. |
| Umami Analytics / self-hosted iTasty | Measuring visits, page popularity and landing page effectiveness. | Privacy-first analytics; in the current setup, no marketing cookies, localStorage or sessionStorage. | Aggregated pageview and website event information, such as visited URL, referrer, device type and browser. It does not include contact form data. | For the time needed to fulfill the analytics purpose or until a valid objection applies. |
| First-party source attribution / iTasty | Remembering which landing source generated a submitted contact inquiry. | First-party session data / legitimate interest | UTM parameters, referrer and landing page; no contact-form field values are stored in the browser. | In sessionStorage for the browser session. If the form is submitted, the attribution is attached to the inquiry and retained for the same period as the inquiry. |
| Cloudflare Turnstile / Cloudflare | Protecting the form from spam, bots and abuse. | Security / anti-spam | IP address, browser and device data, verification result and technical request data. | For the time required to ensure security and request integrity. |
| Meta Pixel / Meta Platforms Ireland Limited | Measuring the performance of iTasty ads on Facebook and Instagram and building ad audiences. | Marketing — opt-in only, loaded solely after consent | Cookie identifier (fbp), IP address, browser and device data, pages visited. | Per Meta's data retention rules; until consent is withdrawn. |
| ChatGPT Ads Measurement Pixel / OpenAI | Attributing contact inquiries and other configured conversions to iTasty ads shown in ChatGPT. | Marketing measurement — opt-in only, loaded solely after consent | ChatGPT ad referral identifier (oppref, stored in the first-party __oppref cookie), source URL, event name and time, and browser/device technical data. If Automatic Advanced Matching is enabled in Ads Manager, normalized contact identifiers may be hashed in the browser before being sent. | Further collection stops when consent is withdrawn; data already received is handled under OpenAI's applicable retention rules. |
| Umami Session Replay / self-hosted iTasty | Analyzing how the site is used (cursor movement, scrolling, clicks) to improve usability, including aggregated heatmaps. | Behavioral analysis — opt-in only, loaded solely after consent | Recording of on-site interactions (15% sampling, strict content masking). The contact form and all input fields are always excluded from recording. | A single recording lasts at most 5 minutes. Recordings are stored for no longer than 90 days, after which they are deleted. |
What we currently do not use on this page
- Google Ads remarketing or similar third-party marketing tools,
- behavioral advertising profiling beyond what is described above for the Meta and ChatGPT Ads measurement pixels.
Cloudflare Turnstile
The contact form is protected with Cloudflare Turnstile to reduce spam and abuse. This solution may process technical data related to security and request integrity.
Analytics
We use self-hosted Umami Analytics to measure traffic and landing page effectiveness. In the current configuration it is not used for behavioral advertising or cross-site tracking. Umami does not store cookies, localStorage or sessionStorage on the user's device.
Umami helps us understand which sections are visited, what devices are used and whether the page works effectively. We do not use this data for advertising profiling.
First-party source attribution
Separately from Umami Analytics, iTasty stores UTM parameters, referrer and the first landing page in sessionStorage for the duration of the browser session. If you submit the contact form, these values are attached to the inquiry so we can measure which landing pages and campaign sources generate contact requests. No values entered into the form are stored in sessionStorage.
Session Replay
In addition to the aggregate analytics described above, after you grant consent we may record a sample of browsing sessions (cursor movement, scrolling, clicks) using the Umami Session Replay module, to better understand site usability and detect interface issues. From the same data we also build heatmaps — collective click and scroll statistics. The chart you see is aggregated, but the stored events carry session and visit identifiers, so they are subject to the same consent and the same retention period as the recordings.
- A random sample of roughly 15% of sessions is recorded.
- Page content is strictly masked during recording.
- The contact form and all input fields (e.g. name, email, phone, message) are always excluded from recording — regardless of consent.
- A single recording lasts at most 5 minutes.
- Recordings are stored for no longer than 90 days, after which they are deleted. Withdrawing consent stops any further recording; recordings already stored can be deleted on request (Art. 17 GDPR).
Session Replay is not run by default. It only starts after you click "Accept" in the cookie banner, on the same terms as Meta Pixel below — including the ability to withdraw consent via "Cookie preferences" in the site footer.
Meta Pixel
Meta Pixel is a script provided by Meta Platforms Ireland Limited that lets us measure the performance of advertising campaigns run on Facebook and Instagram and build ad audiences. Meta Pixel stores a marketing cookie in your browser and sends Meta data about your visit to the site.
Meta Pixel is not loaded by default. The script only runs after you click "Accept" in the cookie banner shown on your first visit. If you click "Decline" or close the banner without accepting, Meta Pixel will not run. You can withdraw or change your consent at any time by clicking "Cookie preferences" in the site footer — the cookie banner will reopen so you can make a new choice. Clearing site data in your browser settings has the same effect.
More information about how Meta processes data is available in Meta's Privacy Policy.
ChatGPT Ads Measurement Pixel
The ChatGPT Ads Measurement Pixel is a script provided by OpenAI
that lets us measure whether an ad shown in ChatGPT led to a
contact inquiry. It reads the ChatGPT ad referral identifier
(oppref), stores it in the first-party
__oppref cookie and sends measurement events such as
lead_created, together with the source URL, event time
and technical browser/device data, to OpenAI.
We do not send contact-form field values in our Pixel event code. If Automatic Advanced Matching is enabled in Ads Manager, the Pixel may detect supported contact identifiers in the form, normalize them and hash them with SHA-256 in the browser before sending them to OpenAI.
The Pixel is not loaded by default. It only loads
after you click "Accept" in the cookie banner. A successful contact
form submission then triggers the lead_created
conversion. If you decline, the OpenAI script is not requested.
You can withdraw or change your choice at any time through "Cookie
preferences" in the site footer.
More information is available in OpenAI's Privacy Policy.
Legal basis and consent
We use essential technical and security mechanisms based on our legitimate interest in ensuring website security and proper operation (Art. 6(1)(f) GDPR).
We use Meta Pixel, ChatGPT Ads Measurement Pixel and Session Replay solely based on your freely given consent (Art. 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law of 12 July 2024), expressed by clicking "Accept" in the cookie banner. You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.
Managing cookies
On your first visit, a cookie banner is shown where you can accept or decline optional cookies (Meta Pixel, ChatGPT Ads Measurement Pixel and Session Replay). You can change your choice at any time by clicking "Cookie preferences" in the site footer. The banner reopens immediately; applying a withdrawal reloads the page so previously loaded optional scripts are stopped. Clearing site data (cookies and local storage) in your browser settings has the same effect and will also show the banner again on your next visit.
You can also always limit or remove cookies directly in your browser settings. Please note that disabling some technical mechanisms may affect the contact form or parts of the website.
Contact
For privacy and cookies matters, you can contact us at: [email protected]
Last updated: 2026-09-02