ESFERAUP · LEGAL
Cookies, local storage and abuse prevention
Last updated:2026-10-20 · Reading time about10 minutes.
1. Scope and approach
Esferacreix SL controls the website; contact privacy@esferaup.com. Device storage or access is assessed by purpose, even if it is not a cookie. The waiting list reads the campaign tag from the page address only at the moment you sign up and does not keep it on your device. Email consent is not tracking consent. Optional measurement or advertising requiring consent must remain disabled until a specific choice, with equally accessible rejection.
2. Necessary technologies
Language comes from the route and browser preference. Authenticated areas may use session and CSRF cookies restricted to their service; they are distinct from the public form. Confirmation and withdrawal links carry a fragment token which the page removes from the address bar after reading. The server uses an IP-derived identifier to limit attempts over a one-hour window; it is pseudonymous, not anonymous.
3. Cloudflare Turnstile
The form loads Turnstile to detect automated submissions. It may process IP, browser/device information and interaction signals. The IP is also sent to verification. Cloudflare has the roles described in the privacy policy: processor for site protection and independent controller for detection improvement. See https://www.cloudflare.com/turnstile-privacy-policy/. We consider this technology necessary for the security of the form. If you have questions about it, write to privacy@esferaup.com.
4. Inventory and controls
“Cookieless” is not represented as “no personal data.” This version enables no optional waiting-list analytics. You can manage browser storage, but blocking necessary protection may prevent submission. For alternatives or rights requests, contact privacy@esferaup.com. Inventory observed on 20-10-2026 when loading the waiting-list page. (1) First-party cookies: none. First-party storage: only “esferaup_cookie_consent” (localStorage, until you delete it), created when you press “Accept” on the notice and remembering that choice; it is not used to identify or track you. sessionStorage and IndexedDB are not used. (2) Cloudflare Turnstile (challenges.cloudflare.com): script and frame loaded when the page opens to protect the form; cookies or storage of its own frame are not visible from our page and are governed by the linked Cloudflare policy. (3) Cloudflare JavaScript detection: a script Cloudflare inserts from its network into HTML pages, not part of our code; according to its documentation it issues a technical “cf_clearance” cookie lasting 15 minutes to detect bots. (4) Cloudflare Web Analytics is not loaded, nor is optional analytics, advertising or social-network content. We review this inventory at each deployment.
Have a legal question?
Privacy: privacy@esferaup.com. Other questions: hola@esferaup.com.