Cookie Policy

Last Updated: September 4, 2026

Version: 1.0

This Cookie Policy explains the cookies and equivalent storage technologies (localStorage, sessionStorage) used on www.upload-post.com, operated by TONVI TECH SL (NIF B-19780394, Calle Puerta del Mar 18, 5th floor, 29005 Málaga, Spain). It complements our Privacy Policy.

Nothing marketing-related runs before you decide. Audience measurement is first-party only: OpenPanel runs on our own servers, the data is never shared with anyone and never used to follow you across other sites. Under the Spanish and French supervisory authorities' criteria that makes it exempt from prior consent, so it is always on. The consent banner itself is only shown to visitors located in the EEA, the United Kingdom and Switzerland, where the ePrivacy rules apply; elsewhere the optional categories run by default and can be changed from the cookie preferences link in the footer. Marketing scripts are not loaded at all until you accept the corresponding category in our consent banner. Google Consent Mode v2 is initialised in "denied" state as the very first instruction of every page.

1. What cookies are, and which ones need your consent

A cookie is a small file stored on your device by the browser. The same rules apply to localStorage and sessionStorage: under Article 22.2 of Spanish Law 34/2002 (LSSI-CE), which transposes Article 5(3) of Directive 2002/58/EC (ePrivacy), we may only read from or write to your device without consent when it is strictly necessary to provide a service you explicitly requested. Everything else — analytics and advertising included — requires your prior, informed and freely given consent.

We follow the Spanish data protection authority's Guía sobre el uso de las cookies (2023): consent is never obtained by simply continuing to browse, closing the banner or scrolling; rejecting is exactly as easy and as visible as accepting; and consent can be withdrawn at any time.

2. Legal basis

3. Cookies and storage we use

3.1 Strictly necessary — no consent required

Name Type Provider Purpose Duration
up_consent Cookie (first-party, .upload-post.com) TONVI TECH SL (Upload-Post) Stores the cookie decision you made in the consent banner (which categories you allowed, and when), so we do not ask again on every page and every subdomain. 6 months
up_consent_v1 localStorage TONVI TECH SL (Upload-Post) Local copy of the same consent record, read by the banner before the page paints. Until you withdraw consent or clear your browser storage
theme localStorage TONVI TECH SL (Upload-Post) Remembers whether you chose the light or the dark version of the site. Persistent, until you clear your browser storage

3.2 Analytics — only with your consent

Name Type Provider Purpose Duration
openpanel-pending-revenues sessionStorage OpenPanel, self-hosted by TONVI TECH SL on api.openpanel.fotoexamen.com (Hetzner, Germany). The browser SDK is served from www.upload-post.com itself, so no third party is contacted. Product and page analytics: which pages and features are used, so we know what to improve. Events are queued here while the page is open if the network call has not completed. Until the browser tab is closed (session)

OpenPanel is our own analytics server: the data never leaves infrastructure we control (Hetzner, Germany) and is not shared with any advertising network. The browser SDK (/js/op1.js) is served from this domain, so no third-party host receives your IP address. OpenPanel does not set a cookie; it uses one sessionStorage key, which is why it still sits behind consent. Analytics data is retained for 26 months.

3.3 Marketing and attribution — only with your consent

Name Type Provider Purpose Duration
aff_ref Cookie (first-party, .upload-post.com) TONVI TECH SL — our own affiliate platform, affiliates.upload-post.com (Hetzner, Germany) Records which affiliate link brought you to the site so that the affiliate is credited if you later subscribe. Setting it also sends one click event (affiliate code, landing page, referrer and any click ids in the URL) to affiliates.upload-post.com. 60 days
up_attribution Cookie (first-party, .upload-post.com) + localStorage key __up_attribution__ TONVI TECH SL (Upload-Post) Marketing attribution: stores the campaign parameters and paid-click identifiers present in the URL you arrived with (utm_*, gclid, gbraid, wbraid, fbclid, ttclid, msclkid, li_fat_id, twclid, gad_source), the external referring domain and the landing page, plus a first-touch snapshot. Lets us tell which campaign produced a sign-up. 90 days
__td_conversion_id__ localStorage TONVI TECH SL (Upload-Post) affiliate programme Conversion identifier taken from the tdrci / tdrcid / ref_id parameter of an affiliate link, so a later purchase can be matched to the referral. 90 days (previously stored with no expiry; an expiry is now written with the value)
_gcl_au, _gcl_aw, _gcl_dc, _gac_* Cookie (first-party, written by the Google Ads tag) Google Ireland Limited (Ireland) / Google LLC (United States) Google Ads conversion measurement and ad attribution: links a visit that came from a Google ad to a later sign-up or purchase. The tag only runs once you accept the marketing category, and Google Consent Mode v2 keeps ad_storage, ad_user_data and ad_personalization denied until then. Up to 90 days
_rdt_uuid Cookie (first-party, written by the Reddit advertising pixel) Reddit, Inc. (United States) Reddit Ads conversion measurement and audience building for our Reddit campaigns. 90 days
YouTube video cookies (VISITOR_INFO1_LIVE, YSC, __Secure-YEC and similar) Third-party cookies set by youtube-nocookie.com Google Ireland Limited / Google LLC (United States) Playing an embedded tutorial video. Videos on this site are rendered as a static thumbnail; the YouTube player is only loaded, from youtube-nocookie.com, if you click play. If you never click play, YouTube sets nothing. Set by Google; session to 8 months depending on the cookie

4. International transfers

Accepting the marketing category means Google Ireland Limited / Google LLC and Reddit, Inc. receive data about your visit. Both are established in, or transfer data to, the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; transfers to Reddit, Inc. and any residual Google transfers rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with supplementary measures. Our own cookies (up_consent, up_attribution, aff_ref) and OpenPanel stay on servers located in Germany (Hetzner). See the full list on our Sub-processors page.

5. Google Consent Mode v2

Before any script runs, this site sets ad_storage, ad_user_data, ad_personalization and analytics_storage to denied. Only functionality_storage and security_storage are granted, as they are strictly necessary. If you accept the marketing category, an update signal grants the advertising parameters; if you reject, they stay denied for the whole session and on every later visit.

6. How to withdraw or change your consent

Blocking strictly necessary storage in your browser may break the theme selector and will make the consent banner reappear on every visit, because there is nowhere left to record your decision.

7. Other domains

This policy covers www.upload-post.com. The application at app.upload-post.com and the documentation at docs.upload-post.com share the same up_consent cookie on .upload-post.com, so a decision made here applies there too. Social media platforms you connect from inside the application act as independent controllers under their own cookie policies.

8. Your rights and how to complain

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time, by writing to [email protected] or [email protected]. We answer within one month. You can also lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos: www.aepd.es (C/ Jorge Juan 6, 28001 Madrid).

9. Changes to this policy

If we add, remove or repurpose a cookie we update this page and, where the change requires it, ask for your consent again. The consent record is in any case renewed at most every 6 months.

Document Version: 1.0
Last Updated: September 4, 2026
Controller: TONVI TECH SL — NIF B-19780394 — Calle Puerta del Mar 18, 5th floor, 29005 Málaga, Spain