1. What this policy covers
Cookies are small browser files. Local storage, pixels and similar technologies can also remember choices or send event information. This policy covers designs.lunaxstudios.com, operated primarily by L’Una Music Group LLC, with L’Una Studios LTDA responsible for operations in Brazilian territory. Read it with our Privacy Policy.
2. Active storage in this version
lunax-language (local storage): remembers the language you select until you clear browser storage. lunax-cookie-preferences (local storage): remembers analytics and marketing choices for 180 days, after which the website asks again. These entries support your preferences and are not advertising identifiers.
Google Analytics 4 (G-DWNWKXLQZV) is configured for the production site and remains blocked until analytics consent. Refusal keeps the Google tag unloaded. Withdrawing consent sets Google’s measurement-disable flag, stops future collection for this property and removes accessible analytics cookies belonging to this integration. It does not erase information already received by Google. TikTok Pixel and a Tag Manager container remain unconfigured.
When protected server delivery is enabled, lunax_form_session is an essential first-party session cookie used for form request verification. It is HttpOnly and SameSite=Strict, with Secure on HTTPS. It expires with the browser session; the server’s form verification nonce expires after one hour. It is independent of optional analytics or marketing choices. Rate-limit state contains keyed hashes of request IP addresses and attempt times, not message contents; it is held privately for abuse prevention and can be removed through the documented cleanup task.
After analytics consent, the Google tag can set first-party analytics cookies with the lunax prefix, including lunax_ga and the property-specific lunax_ga_DWNWKXLQZV. They identify a browser and support session measurement. This integration requests a maximum 180-day lifetime without extending expiration on each visit, with host-only scope, path /, SameSite=Lax and Secure. Exact browser storage and any property-level overrides should be confirmed after production deployment.
Meta Pixel (719471049083365) requires marketing consent independently of Google Analytics. Before consent, its script and tracking request are blocked; no tracking image fallback is included. Meta can use first-party _fbp (browser identifier) and _fbc (advertising-click identifier, when available) cookies, typically lasting up to 90 days, and its own third-party cookies depending on browser settings and Meta account state. Cookie domain and lifetime may be controlled by Meta; confirm the actual production inventory. Refusal and Global Privacy Control keep the Pixel unloaded. Withdrawal revokes Pixel consent and deletes accessible _fbp/_fbc cookies on this host and parent domains. We cannot delete cookies belonging to Meta’s domains.
3. Planned optional technologies
Analytics consent controls Google Analytics 4; marketing consent controls Meta Pixel. TikTok Pixel and Google advertising tags remain unconfigured. Any future advertising provider must explicitly honor marketing consent, and a future Tag Manager container must not bypass these choices.
The inventory above describes the configured Google Analytics and Meta Pixel integrations. Additional providers may use different cookies, domains and lifetimes; their verified inventory must be added before activation. Form contents and sensitive information must not be supplied to advertising or analytics events.
4. Security and Cloudflare Turnstile
Essential security functions protect the site and forms against abuse. Cloudflare security and Turnstile CAPTCHA are planned for that purpose, independently of analytics and marketing choices. Turnstile must be configured and validated on the server before a protected form is considered operational. Its data practices are described in Cloudflare’s Turnstile Privacy Addendum.
Cloudflare’s existing proxy/CDN protection can use security cookies when a browser challenge is needed. Its hosting-injected Web Analytics performance beacon is separate from our consent-gated Google Analytics and Meta Pixel tags. The Cookie settings categories control those two optional integrations and do not change the Cloudflare account’s proxy/security or beacon configuration. The form-specific Turnstile widget is still awaiting private setup.
5. Manage or withdraw consent
You can accept all optional categories, reject them or choose analytics and marketing separately. Both are off by default. Use Cookie settings in the footer to change your choice at any time. Browsing and quote requests remain available after refusal. If your browser sends a recognized Global Privacy Control signal, this website keeps marketing disabled.
Withdrawal stops future optional processing under the changed choice; it does not remove data already lawfully collected by a provider. You can also clear cookies and local storage in your browser, which may reset your preferences. Ask [email protected] about deletion or other privacy rights.
6. External content and updates
Social and portfolio links do not load an advertising pixel merely because they appear on this page. The Instagram API feed loads public image previews from Instagram/Meta servers as the section enters view; those requests can expose your IP address and browser request information. The feed does not include an embedded Instagram widget or advertising pixel. Following a link opens a third-party service with its own practices. Changes to remote content or embeds will require a review of storage and consent requirements. Questions: [email protected].