Cookie Policy
LUMWAY WELLNESS INC.
Effective date: September 10, 2026
1. Introduction and Scope
This Cookie Policy explains how Lumway Wellness Inc. ("Lumway," "we," "us," or "our") uses cookies and similar technologies, and the choices available to you. This document applies only to the corporate informational page at https://lumwaylabs.com/pages/corporate and related business inquiries. It does not govern purchases, customer accounts, or other activities in the online store. The store's separate policies remain applicable to those activities. This Policy is published at https://lumwaylabs.com/pages/corporate-cookie-policy and should be read with our Privacy Policy at https://lumwaylabs.com/pages/corporate-privacy-policy. Certain cookies, identifiers, and browser privacy choices are shared with the online store because it uses the same domain; store-only technologies are identified as conditional in the tables below.
2. What Are Cookies and Similar Technologies
Cookies are small text files placed on your device when you visit a website. The Site and its third-party providers also use related technologies, including:
- pixels and web beacons – small network requests that transmit data to a server without necessarily storing anything on your device;
- local storage and session storage – browser-based storage areas similar to cookies but generally not sent with every request;
- IndexedDB – a browser database used by some analytics providers; and
- browser and device identifiers generated by analytics and advertising providers.
For simplicity, this Policy refers to all of these collectively as "cookies" unless otherwise specified.
3. Categories of Cookies We Use
We group cookies and similar technologies into four descriptive categories. The Site does not currently offer a separate selector for these categories; the opt-out control in Section 7 applies the tracking restrictions described there.
- Strictly Necessary – required for core operation, security, or remembering your privacy choice, including hCaptcha protection for the contact form. These are not disabled by the tracking opt-out. Shared store storage is identified below; automatic installation by the platform does not itself establish that a cookie is strictly necessary for a corporate-page visit.
- Functional (Preferences) – remember choices you make (such as your market/language) or support features such as consistent A/B test display.
- Analytics – help us understand how visitors use the Site so we can improve it.
- Marketing/Advertising – used to measure and, where applicable, optimize advertising, and to enable cross-context behavioral advertising by our partners.
Cookies falling into the Marketing/Advertising category (including those associated with Google Ads, Google Merchant Center, Meta, TikTok, Axon, and Klaviyo) may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising under the CCPA/CPRA or subject to sale or targeted-advertising opt-outs under other applicable state laws. The classification depends on the actual use of information and the applicable arrangements, rather than the provider name alone. See Section 8 for how to opt out.
4. Detailed List of Cookies and Trackers
The tables below retain the inventory from 04 September 2026 (U.S. visitor), cross-checked on 03 September 2026 with an EU-based visitor, updated with the developer's subsequent report about the opt-out implementation and hCaptcha. The listed analytics and marketing tools may operate before opt-out; their presence in the inventory does not mean they continue tracking after opt-out. Privacy-choice storage, hCaptcha identifiers, and store-only technologies are identified separately or conditionally. Cookies on lumwaylabs.com are first-party in the browser context, including those supplied by third-party services; cookies in another provider's domain context are third-party. Cookie expiry differs from retention of data already received by a provider. Persistent local storage and IndexedDB may remain until cleared by the site, provider, browser, or user.
4.1 Strictly Necessary
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| cart | Shopify | Shopping cart token (shared store storage; no purchase function on the corporate page) | 91 days | First-party |
| cart_currency | Shopify | Cart currency (shared store storage; no purchase function on the corporate page) | 91 days | First-party |
| _shopify_essential | Shopify | Platform service identifier; separates storage by consent category (HttpOnly, Secure) | 1 year | First-party |
| _tracking_consent | Shopify | Stores Shopify privacy choices, including opt-out where used by the integration | 1 year | First-party |
| _cmp_a | Shopify | Technical cache of your consent status where used by the consent mechanism | 1 day | First-party |
| _secure_session_id, keep_alive, secure_customer_sig, checkout_token | Shopify | Session, security, account sign-in, and checkout (store pages only) | Session or 1 year | First-party |
| hCaptcha identifiers (embedded iframe) | Intuition Machines, Inc. (U.S.) | Invisible bot protection; loads on first interaction with a contact-form field. No cookies on lumwaylabs.com. Provider identifiers are stored in the hcaptcha.com iframe context. | Provider-controlled; varies by identifier | Third-party (hcaptcha.com) |
4.2 Functional (Preferences)
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| Shoplift_Essential | Shoplift | Keeps you consistently assigned to the same A/B-test variant | 1 year | First-party |
| signInWithShop:cartSyncNextRecognitionAt (local storage) | Shopify | "Sign in with Shop" recognition | Persistent | First-party |
| localization | Shopify | Selected market, country, and language | 1 year | First-party |
4.3 Analytics
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _shopify_y | Shopify | Unique visitor identifier for Shopify Analytics | 1 year | First-party |
| _shopify_s | Shopify | Session identifier for Shopify Analytics | 30 minutes | First-party |
| shopify_client_id | Shopify | Client identifier for Web Pixels and attribution | 1 year | First-party |
| _shopify_analytics | Shopify | Service storage for analytics data (HttpOnly, Secure) | 1 year | First-party |
| _ga | GA4 client identifier | 2 years | First-party | |
| _ga_9LEVY1Q60K, _ga_9PH4LLZTF8 | GA4 session state for two properties | 2 years | First-party | |
| _clck | Microsoft | Clarity user identifier | 1 year | First-party |
| _clsk | Microsoft | Clarity session identifier | 1 day | First-party |
| _cltk (session storage) | Microsoft | Clarity technical key | Session | First-party |
| AMP_12ac916206 | Amplitude | Device ID and session ID | 1 year | First-party |
| AMP_MKTG_12ac916206 | Amplitude | Marketing attribution (UTM, referrer) | 1 year | First-party |
| EXP_12ac916206_identity | Amplitude | Experiment identifier | 1 year | First-party |
| AMP_SHOPIFY_TEST | Amplitude | Technical connectivity check | Session | First-party |
| AMP_* (local/session storage, IndexedDB) | Amplitude | Event buffering, configuration, session-replay data | Persistent / session | First-party |
| Shoplift_Analytics | Shoplift | A/B test statistics | 1 year | First-party |
| Shoplift_Session | Shoplift | A/B test session | Session | First-party |
| Shoplift_ClientId, shoplift_last_pageview* (local storage) | Shoplift | Client identifier and last page viewed | Persistent | First-party |
| ri-*, wpm-ri-*, consentHeader, __shopify_agent_context_events, _shs_state, es-endpoint-key (session storage) | Shopify | Web Pixel Manager service data | Session | First-party |
4.4 Marketing / Advertising
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _shopify_marketing | Shopify | Service storage for marketing data (HttpOnly, Secure) | 1 year | First-party |
| _gcl_au | Google Ads conversion linker | 90 days | First-party | |
| _gcl_ls (local storage) | Stores click identifier (gclid) | Persistent | First-party | |
| IDE, test_cookie | Google (doubleclick.net) | Remarketing (genuine third-party cookie, browser-dependent) | Up to 13 months | Third-party |
| _fbp | Meta (via Parkour app) | Meta Pixel browser identifier | 90 days | First-party |
| __parkour_landing, __parkour_referrer | Parkour | Landing page and referrer for Meta/TikTok attribution | 90 days | First-party |
| Parkour_* (local storage, 12 keys incl. Parkour_external_id, Parkour_fbp, Parkour_geo_fb, Parkour_customer_params) | Parkour | Pixel configuration, identifiers, approximate geolocation | Persistent | First-party |
| _axwrt, ax_visitor, _ax_session_data, _ax_last_event | Axon (AppLovin) | Visitor/session identifiers for ad optimization | 1 year | First-party |
| _axsid (session storage), _applovin_pixel_version (local storage) | Axon (AppLovin) | Session and pixel version | Session / Persistent | First-party |
| __kla_id | Klaviyo | Visitor identifier | 2 years | First-party |
| __kl_key, klaviyoOnsite, kl-post-identification-sync, $referrer, $last_referrer (local storage), klaviyoPagesVisitCountV2 (session storage) | Klaviyo | Onsite tracking | Persistent / Session | First-party |
4.5 Technologies That Do Not Set Cookies
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| Shopify Web Pixels (14 sandboxed pixels) | Shopify & installed apps | Transmit a page_viewed event (URL, referrer, client ID); 14 sandboxed pixels were recorded in the September 2026 audit | N/A | Analytics / Marketing |
| Google Fonts | Loads web fonts; sets no cookie, but Google receives your IP address and browser type | N/A | Third-party | |
| IP-based geolocation (ipinfo.io; Klaviyo geo-ip endpoint) | IPinfo; Klaviyo | Approximate location based on IP address; sets no cookie | N/A | Third-party |
5. Server-Side Tracking
In addition to browser-based cookies, the Meta Pixel application installed on the Site ("Parkour Facebook Pixel") supports server-to-server transmission of conversion events to Meta (Meta Conversions API). This capability does not by itself mean that every corporate-page visit generates a server-side conversion event. Where server-side Site events are transmitted, we apply the relevant consent status and applicable sale/sharing or targeted-advertising opt-out to those disclosures, as to browser-based tracking. Deleting cookies alone does not necessarily stop server-side transmissions; use the Site's privacy controls to communicate your choice.
6. Session Recording and Heatmap Tools
The Site uses two session-recording / heatmap tools: Microsoft Clarity (session recordings, heatmaps, click and scroll analysis) and Amplitude Session Replay (reconstruction of activity within the page). Both providers offer input-masking of form field values; the actual masking settings are controlled in each vendor's console and are not established by the absence of custom masking rules in the page code. Please do not enter sensitive personal information into the contact form. Session replay is subject to the tracking opt-out controls in Section 7. We do not use any additional session-recording or heatmap tool beyond these two.
7. Managing Your Tracking Choice
The Site currently uses a U.S. opt-out model. It does not display a cookie consent banner or offer Accept All, Reject Non-Essential, or a category-selection panel. If you have not opted out and your browser does not send GPC, the listed analytics and marketing technologies may operate. Select "Do Not Sell or Share My Personal Information" in the footer to submit an opt-out with one click; the footer then displays "Opt-Out Request Honored". Your Privacy Choices is also available at https://lumwaylabs.com/pages/data-sharing-opt-out.
The browser-based choice applies to the corporate page and store pages using the shared privacy control on lumwaylabs.com. The Undo control displayed beside the confirmation allows you to request a change to your previous site-level choice; it is not a category selector. Any consent and separate confirmation required by applicable law must be obtained before sale/sharing resumes. An active GPC signal is not overridden merely by a conflicting site setting. You may need to repeat a choice on another browser or device.
Following opt-out, the Site restricts analytics and marketing tracking by Shopify Web Pixels, the custom Amplitude pixel and Amplitude Session Replay, Google Analytics 4, Google Ads, Google Merchant Center, Microsoft Clarity, and Axon. The implementation blocks the relevant tracking requests and cookie creation, rather than relying solely on a Google Consent Mode denied value. The opt-out is recorded when selected; reloading the page also loads it with the stored opt-out applied.
Meta and TikTok tracking through Parkour is also blocked following opt-out, including their tracking requests and cookies. IPinfo geolocation and Klaviyo onsite tracking are disabled. Klaviyo may still load a small loader without tracking or setting a cookie; the presence of that loader is not the same as continued onsite tracking. Server-side event disclosures are addressed separately in Section 5.
Shoplift responds to the Shopify privacy choice and stops its A/B-test tracking following opt-out. Shopify platform requests and contact-form security, including hCaptcha when you interact with a form field, may continue. Google Fonts is described in Section 4.5 as a font-delivery service without cookies. The tracking opt-out does not mean that all third-party requests cease, or that information already received by a provider is automatically deleted.
8. "Do Not Sell or Share My Personal Information" (U.S. Residents)
If applicable law gives you a right to opt out of sale or sharing of personal information for cross-context behavioral advertising or targeted advertising, you can exercise it using the "Do Not Sell or Share My Personal Information" link in the footer. One click submits the choice and the footer confirms "Opt-Out Request Honored". You may also visit https://lumwaylabs.com/pages/data-sharing-opt-out. The Site applies broader restrictions to the listed analytics and replay tools as described in Section 7, including Google, Meta, TikTok, Axon, Klaviyo, Amplitude, Clarity, and Shoplift. No account or identity verification is required for this browser-based choice. The Notice of Right to Opt-out is in Section 11(e) of our Privacy Policy at https://lumwaylabs.com/pages/corporate-privacy-policy.
9. Global Privacy Control (GPC)
We honor Global Privacy Control (GPC) as a request to opt out of sale/sharing and targeted advertising where applicable. To send the signal, enable GPC in a supporting browser's privacy settings or through a compatible browser extension before visiting the Site. Information about supporting tools is available at https://globalprivacycontrol.org/. No separate click on our opt-out link is needed when the signal is received. The footer displays "Opt-Out Preference Signal Honored". On this Site, the signal activates the same broad tracking restrictions as a manual opt-out, including the analytics and session-replay tools described in our Cookie Policy. It applies to the browser or device sending it and, where required and identifiable, an associated profile. An active signal is not overridden merely by a conflicting site setting; any legally required consent to change that choice must be obtained. The absence of a signal does not by itself constitute a new opt-in after a known prior opt-out.
10. Browser-Level Controls
Most browsers allow you to block or delete cookies through their settings, and many offer a private/incognito browsing mode that limits cookie persistence after your session ends. Blocking all cookies, including strictly necessary ones, may prevent parts of the Site (such as the shopping cart or checkout, where applicable) from functioning correctly. Private browsing does not itself prevent all tracking or server-side data collection, and clearing storage may remove your saved privacy choice.
11. If You Opt Out
The Site and its core functionality remain available if you opt out. Our contact form is a native Shopify submission and does not depend on analytics or marketing cookies. Navigation and informational content remain available, and hCaptcha continues to protect the form. The listed analytics, session replay, advertising tracking, and Shoplift A/B-test tracking stop under the opt-out controls. Klaviyo onsite tracking is disabled, although its non-tracking loader may remain. The opt-out does not itself delete correspondence, previously collected information, or a store account. For access or deletion requests, contact support@lumwaylabs.com as described in our Privacy Policy.
12. How Long We Remember Your Choice
The Site and Shopify privacy mechanism store your choice for the relevant browser. Storage expiry, browser settings, or clearing site data may remove a locally stored choice, so you may need to make it again when the Site no longer recognizes that browser. An enabled GPC signal is processed whenever it is received. Where a prior opt-out remains associated with an identifiable profile, losing a browser signal or stored value does not itself authorize sale/sharing to resume. No cookie banner is shown again merely because storage is cleared: the Site currently uses the footer opt-out and Undo controls. Any legally required new consent must be obtained before the relevant processing resumes.
13. Changes to This Cookie Policy
We may update this Cookie Policy from time to time to reflect changes to the cookies and technologies we use or to applicable law. The "Effective date" at the top of this page indicates when it was last revised.
14. Contact Us
If you have questions about this Cookie Policy, please contact us at:
- Lumway Wellness Inc.
- 1615 Valley Avenue East, Apt 22, Sumner, WA 98390, United States
- Email: support@lumwaylabs.com