Privacy policy

Last updated: 17 September 2026

01 Who runs this site

This site (https://opal.vikataylor.com) is published by Vika Taylor, an independent designer and creator, acting as an individual and not through a company. OPAL itself is invented: the studio name, the Austin address, the hours and the founding year are content written for a landing page design demo that accompanies a YouTube video. There is no salon, no chair and no client list behind this domain.

For anything on this page, including any request under section 5, write to vika.taylor.one@gmail.com. No data protection officer is appointed, because the scale and nature of the processing described below does not require one under GDPR Art. 37.

02 What data is collected and why

The site itself collects nothing

There is no form on this origin. The buttons that read "Book a set", "Start a design" and "Call the studio" are part of the demo: they move you down the page and submit nothing, because there is nothing behind them to submit to. No account can be created, no newsletter can be joined, no payment can be made, no appointment can be booked. If you never accept analytics, this site learns nothing about you beyond what your browser must reveal to receive the page at all.

Analytics, and only after you accept

Google Analytics 4 (measurement ID G-VFPV5MZNL2) is the single analytics tool on this site, and it runs through Cloudflare Zaraz, a Cloudflare service that runs such tools on Cloudflare's servers instead of in your browser. Before you click Accept, and after you decline, this page sends nothing to Zaraz, so nothing reaches Google. After you click Accept, /consent.js starts Zaraz, served from this site under /cdn-cgi/zaraz/. Zaraz tells Cloudflare the page address and title, the referring page, your screen and window size, colour depth, character set and time-zone offset, and Cloudflare's servers pass Google the page view, this site's events, your browser's user-agent, your IP address and a random ID kept in a cookie. Your browser makes no request to Google for any of this. Google uses the IP address to estimate an approximate location and states that Google Analytics 4 does not log or store IP addresses.

Once accepted, it records the pages viewed, the referring source, an approximate location (country or region, not an address), device and browser type, and how long the visit lasts. The purpose is narrow: to see whether the demo is being looked at and where the traffic comes from. Legal basis: your consent, GDPR Art. 6(1)(a).

The build video, and only after you press play

The home page ends with the YouTube video that shows how this demo was built. Until you press play, what you see is a still image served from this site, and nothing is requested from YouTube or Google. Pressing play loads YouTube's player from www.youtube-nocookie.com, the privacy-enhanced embed domain, and the video then streams from Google's servers. From that moment Google receives what any website receives when your browser contacts it: your IP address, browser and device details, and the address of this site as the referring page (the site only, never the page path). YouTube requires that address before its player will run.

Google states that a view in its privacy-enhanced mode is not used to personalise your YouTube experience or the advertising shown to you outside this site, and that any ads on such a video are non-personalised. Inside its own frame the player may still store data in your browser under Google's domains; this site cannot read or remove that data. Legal basis: your choice to press play after the notice shown under the player, GDPR Art. 6(1)(a). If you would rather not load the player here, use the Open on YouTube link instead. If the page cannot embed the player, pressing play opens the video on youtube.com in a new tab.

Request logs at the host

The site is served by Cloudflare. As with any host, the request itself is processed before a consent question can be asked, because that processing is how the page reaches your browser: IP address, user agent, the URL requested and a timestamp. It is used for delivery, caching and abuse protection. Legal basis: legitimate interest, GDPR Art. 6(1)(f). This is not analytics, it is not connected to the Google Analytics data, and no report is built from it here.

Nothing else is collected. This site runs no profiling, no advertising, no cross-site tracking and no browser fingerprinting.

03 Cookies

This site's own code sets no cookies. The cookies listed here are set by Cloudflare Zaraz, and only after you accept; the other entries sit in your browser's own storage. If you press play on the build video, YouTube's player runs in its own frame and may keep its own storage under Google's domains, described in section 2; it is not listed here because this site neither sets nor reads it.

• cfz_google-analytics_v4, cfzs_google-analytics_v4 and cf_zaraz_client: cookies set by Cloudflare Zaraz for Google Analytics, only after you press Accept. The first holds the random ID that tells one visit from another and lasts a year; the second counts page views in the current session; the third is Zaraz's own working cookie and lasts a year. They are set for vikataylor.com, so every site in the network shares them, and they are HttpOnly, so no script on a page can read or delete them.
• _zaraz_google_consent_update: a localStorage entry Zaraz writes after you accept. It holds the consent state passed to Google, analytics allowed and advertising not, and no identifier.
• opal_consent: your consent choice. This is a localStorage entry on this origin, not a cookie, so it is never attached to a request and never leaves your browser. It holds one word ("granted" or "denied"), the moment you chose and the version of this policy you answered. It expires after 180 days, or sooner if this policy changes in a way that needs a new answer, and you are then asked again rather than carried forward on an old answer.

You can change or withdraw your choice at any moment with the Cookie settings control, which is also in the footer of every page on this site. Withdrawing consent is exactly as easy as giving it, as GDPR Art. 7(3) requires: same control, same number of clicks.

If you declined, there is nothing to delete, because Zaraz never ran and no analytics cookie was ever written.

If you accepted earlier and have changed your mind, press Cookie settings and choose Decline. It takes effect at once, in the page you are already on, with no reload: the page stops sending anything to Zaraz and deletes the _zaraz_ entry, and from the next page load Zaraz does not start at all. The Zaraz cookies are HttpOnly, so no page can delete them; they stay until they expire or you clear them, and nothing on this site reads them while your choice is Decline. The page also deletes what the earlier set-up could leave until September 2026: the cookies _ga, _ga_VFPV5MZNL2, _gid and any _gat cookie, and the storage entry _gcl_ls.

Withdrawal is therefore not advisory here: it is executed. You can still clear site data for this domain from your browser settings if you would rather not take our word for it.

04 Third-party services

• Cloudflare Zaraz (Cloudflare, Inc.) and Google Analytics 4 (Google LLC and Google Ireland Limited): analytics, started only after you accept and run on Cloudflare's servers, with the advertising signals denied. Cloudflare acts as a processor, as it does for the hosting. According to Google, GA4 does not log or store IP addresses. Policies: cloudflare.com/privacypolicy, policies.google.com/privacy.
• YouTube (Google LLC and Google Ireland Limited): the embedded build video, loaded from www.youtube-nocookie.com only after you press play, as described in section 2. Google's policy: policies.google.com/privacy.
• Cloudflare (Cloudflare, Inc., USA): hosting and CDN for this origin, processing the request data described in section 2. Cloudflare's policy: cloudflare.com/privacypolicy.
• Fonts are hosted here, not by Google. Bodoni Moda and Space Grotesk are served from this origin as .woff2 files under the SIL Open Font License 1.1. This page makes no request to Google's font servers at all, so your IP address does not reach Google at page load, before consent or after it. Embedding Google Fonts remotely without consent was held to infringe the right to informational self-determination by the Landgericht Muenchen I (judgment of 20 January 2022, case 3 O 17493/20), and self-hosting is the direct answer to that.
• Outbound links. Links to vikataylor.com and to youtube.com hand you over to those sites and their own privacy policies. The YouTube links in the video section tell YouTube which site sent you: this site's address only, never the page path or anything about you, so the channel can see visits that came from this demo. The other outbound links do not pass on the page you came from.

Apart from the YouTube player above, which loads only when you press play, there is no embedded media, no map, no chat widget, no advertising network, no A/B testing tool and no script CDN on this site. The content security policy served for this domain refuses scripts from any origin except this one and Google's analytics endpoints, so a third-party tracker could not run here even by accident.

Google (including YouTube) and Cloudflare are US companies and may process the data above outside the EEA and the UK. Both publish their own transfer safeguards, including Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework; the two policy links above are the current versions.

05 Your rights (GDPR / UK GDPR / similar)

If you are in the EU, the UK, or any region with comparable privacy law, you have the right to:

• Access the data held about you
• Correct it
• Delete it (the "right to be forgotten")
• Restrict or object to processing
• Withdraw consent at any time, with no effect on processing done before withdrawal
• Receive a copy in a portable format
• Lodge a complaint with your local data protection authority

To exercise any of these, email vika.taylor.one@gmail.com. You will get a reply within 30 days.

One honest caveat: there is very little here to hand over. No name, email or account exists on this site, so an analytics record cannot normally be tied back to you as a person, and I am not able to identify you from it (GDPR Art. 11). The fastest way to remove the analytics identifier attached to your browser is to use the Cookie settings control in section 3, decline, and clear cookies and site data for vikataylor.com. That erases it at the source, which no email to me can do faster.

06 CCPA / California residents

Personal information is not sold and not shared for cross-context behavioural advertising, and it has not been in the previous twelve months. There is no financial incentive programme attached to any of this. The categories collected in CCPA terms are identifiers (an IP address and, after you opt in, a random analytics ID) and internet activity information: through Cloudflare Zaraz and Google Analytics after you opt in, and as technical request data at the host. You have the right to know what is collected, to request its deletion, and not to be treated differently for asking. Same address as above: vika.taylor.one@gmail.com.

07 Children

This site is not directed at children under 16 and does not knowingly collect their data. Nothing on it is age-gated, because there is nothing to register for and nothing to buy.

08 Changes to this policy

The date at the top of this page is the date of the last change. If what is collected, or who processes it, ever changes materially, this page is updated before that change takes effect. Your stored consent choice expires after 180 days in any case, so the question is put to you at least twice a year rather than being inherited from an answer you have forgotten giving.