Cookie Policy

1. Operator

The operator of the FlipKing Pro platform and the controller of cookies is:

• Maxim Ponomarenko
• Business ID (IČO): 73988146
• VAT ID (DIČ): CZ8507074378
• Place of business: náměstí Naděje 771, 566 01 Vysoké Mýto, Czech Republic
• Self-employed natural person (sole trader)
• Contact: [email protected]

2. What cookies are

Cookies are small text files stored on your device that allow a website to recognise the browser between visits. On FlipKing Pro we use cookies, local storage (localStorage) and similar technologies.

3. Categories of cookies we use

3.1 Strictly necessary (always active)

These are required for the basic functioning of the Platform — login, security tokens, language preference, credit basket, CSRF protection. The legal basis is the Operator's legitimate interest (Article 6(1)(f) GDPR) and Section 89 of Act No. 127/2005 Coll., on Electronic Communications — consent is not required.

• __Host-next-auth.session-token — logged-in user session (without the __Host- prefix in the development environment)
• __Host-next-auth.csrf-token — protection against CSRF attacks (without the __Host- prefix in the development environment)
• NEXT_LOCALE — language preference
• fk_cookie_consent_v1 — record of cookie consent
• __cf_bm, cf_clearance (Cloudflare, 3rd-party) — bot and DDoS protection at the CDN/WAF level; necessary for the availability of the Platform. Processor: Cloudflare Inc. (US, EU-US DPF + SCCs).
• __stripe_mid, __stripe_sid (Stripe, 3rd-party) — fraud prevention during payment and Stripe Connect onboarding; necessary for processing payments and payouts to Tipsters. Processor/co-controller: Stripe Payments Europe Ltd. (IE).

3.2 Functional (consent)

These store user preferences beyond what is strictly necessary for operation — e.g. display options, dashboard layout or remembered filters. They are activated only with consent (the "Functional" category in the cookie banner); without consent the Platform works with default settings.

3.3 Analytics and product (consent)

These serve to understand user behaviour in the application, detect errors and improve the product. They are activated only with consent (Article 6(1)(a) GDPR) given in the cookie banner. In this category the Operator deploys in particular:

• Product analytics — navigation through the application, clicks, conversion paths, time spent on a page.
• Session recording (session replay) — the rrweb technology records the user's DOM interactions (mouse movement, clicks, scrolling, keystrokes in editable fields with automatic masking of sensitive values such as passwords and payment data). The recording is paired with the logged-in user's ID, if logged in.
• Technical telemetry — IP address, user agent, screen resolution, session identifier, referer. These data are linked to a specific session and, for logged-in users, also to their ID; they are therefore neither anonymous nor merely aggregated data.
• Google Analytics 4 (third-party) — on the landing pages the Operator measures traffic and conversions using Google Analytics 4 (two properties by visitor type). The tool is activated only after consent is granted (Google Consent Mode v2, default state "denied"); it stores the _ga and _ga_* cookies. Processor: Google Ireland Ltd. / Google LLC (USA); data are transferred to the USA under the EU-US Data Privacy Framework (DPF) or standard contractual clauses (SCC). Retention per the GA4 settings.
• Google Tag Manager (third-party): a technical loader for measurement tags. It stores no cookies of its own and measures no traffic. The container is downloaded from Google only after consent to analytics cookies is granted, and the tags inside it start under Google Consent Mode v2 in the "denied" state. The exception is the <noscript> variant for browsers with JavaScript disabled: it stores no cookies but does pass the IP address and page address to Google. Processor: Google Ireland Ltd. / Google LLC (USA); data are transferred to the USA under the EU-US Data Privacy Framework (DPF) or standard contractual clauses (SCC).

Data from product analytics, session replay and technical telemetry are stored on the Operator's servers in the EU (the processor Askela, Czech Republic, participates in telemetry processing) and are not sold to third parties. Data measured by Google Analytics 4 on the landing pages are processed by Google as a processor (see above) and transferred to the USA under the EU-US DPF / SCC.

3.4 Marketing and remarketing

The Operator enables the advertising (remarketing) signals of Google Analytics 4 only with consent to the "Marketing" category in the cookie banner (Art. 6(1)(a) GDPR). Without such consent they remain in the default "denied" state (Google Consent Mode v2) and no advertising data is sent. In this category the Operator deploys:

• Google Analytics 4 advertising signals — ad_storage, ad_user_data, ad_personalization under Google Consent Mode v2; activated only with this consent. Processor: Google Ireland Ltd., resp. Google LLC (USA); transfers to the USA take place under the EU-US Data Privacy Framework (DPF) or the standard contractual clauses (SCC).

Withdrawal of consent takes effect immediately — the tools listed stop running. If the Operator deploys further advertising tools, they will be placed in this category with separate consent and this policy will be updated in advance.

4. Consent management

Consent given in the cookie banner can be changed at any time by clicking the "Cookie settings" button in the page footer. Once the preferences are opened, consent can be updated or reset; withdrawal of consent takes immediate effect — analytics and marketing tools stop running and any ongoing session recording is terminated.

Withdrawing consent is, both technically and procedurally, as easy as giving it, in accordance with Article 7(3) GDPR. Data recorded so far in connection with the given consent remain stored for the retention period stated in Section 5, unless the user requests their erasure at [email protected].

In most browsers, cookies can be disabled entirely, but this may affect the functionality of the Platform (especially login).

5. Storage periods

• Session cookies — until the browser is closed.
• Login token — 7 days.
• Record of cookie consent — up to 12 months; after this period the record is considered expired and the banner is shown again for a renewed decision.
• Google analytics cookies (_ga, _ga_*) — up to 2 years; server-side retention of measured data in GA4 max. 14 months.
• Google Analytics 4 advertising signals ("Marketing" category) — use the analytics cookies _ga/_ga_* (see above); the Operator currently deploys no separate third-party advertising cookies.
• Product analytics data and session recordings (session replay) — 30 days from capture.

6. Related documents

• Privacy Policy
• Terms and Conditions
• Platform Rules

Please direct any questions to [email protected].