Privacy policy

Last updated: 12 August 2026

01 Who runs this site

This site (https://opal.vikataylor.com) is published by Vika Taylor, an independent designer and creator, acting as an individual and not through a company. OPAL itself is invented: the studio name, the Austin address, the hours and the founding year are content written for a landing page design demo that accompanies a YouTube video. There is no salon, no chair and no client list behind this domain.

For anything on this page, including any request under section 5, write to vika.taylor.one@gmail.com. No data protection officer is appointed, because the scale and nature of the processing described below does not require one under GDPR Art. 37.

02 What data is collected and why

The site itself collects nothing

There is no form on this origin. The buttons that read "Book a set", "Start a design" and "Call the studio" are part of the demo: they move you down the page and submit nothing, because there is nothing behind them to submit to. No account can be created, no newsletter can be joined, no payment can be made, no appointment can be booked. If you never accept analytics, this site learns nothing about you beyond what your browser must reveal to receive the page at all.

Analytics, and only after you accept

Google Analytics 4 (measurement ID G-VFPV5MZNL2) is the single analytics tool on this site. It runs under Google Consent Mode v2 with every consent signal set to denied by default, and anonymize_ip switched on. The Google script is not in the page: it is fetched by /consent.js only after you click Accept, so if you decline or ignore the banner, no request ever reaches googletagmanager.com from this page.

Once accepted, it records the pages viewed, the referring source, the approximate location derived from a truncated IP address (country or region, not an address), device and browser type, and how long the visit lasts. The purpose is narrow: to see whether the demo is being looked at and where the traffic comes from. Legal basis: your consent, GDPR Art. 6(1)(a).

Request logs at the host

The site is served by Cloudflare. As with any host, the request itself is processed before a consent question can be asked, because that processing is how the page reaches your browser: IP address, user agent, the URL requested and a timestamp. It is used for delivery, caching and abuse protection. Legal basis: legitimate interest, GDPR Art. 6(1)(f). This is not analytics, it is not connected to the Google Analytics data, and no report is built from it here.

Nothing else is collected. There is no profiling, no advertising, no cross-site tracking and no browser fingerprinting on this origin.

03 Cookies

This site sets no cookies of its own. Everything listed here is either written by Google Analytics after you accept, or written by the consent script inside your own browser and never sent anywhere.

• _ga and _ga_VFPV5MZNL2: Google Analytics first-party cookies, written only after you press Accept. They distinguish one visit from another. Lifetime: up to 24 months.
• vt_consent: your consent choice. This is a localStorage entry on this origin, not a cookie, so it is never attached to a request and never leaves your browser. It holds one word ("granted" or "denied") and the date you chose. It expires after 180 days, after which you are asked again rather than carried forward on an old answer.

You can change or withdraw your choice at any moment with the Cookie settings control, which is also in the footer of the home page. Withdrawing consent is exactly as easy as giving it, as GDPR Art. 7(3) requires: same control, same number of clicks.

If you declined, there is nothing to delete, because the Google script was never fetched and no analytics cookie was ever written. If you accepted earlier and have changed your mind, press Cookie settings, choose Decline, and reload: from that point the Google script is not loaded again. Cookies Google already wrote stay in your browser until they expire or until you clear site data for this domain, which you can do from your browser settings without asking anyone.

04 Third-party services

• Google Analytics 4 (Google LLC and Google Ireland Limited): analytics, loaded only after you accept, Consent Mode v2, default denied, IP anonymisation on. Google's policy: policies.google.com/privacy.
• Cloudflare (Cloudflare, Inc., USA): hosting and CDN for this origin, processing the request data described in section 2. Cloudflare's policy: cloudflare.com/privacypolicy.
• Fonts are hosted here, not by Google. Bodoni Moda and Space Grotesk are served from this origin as .woff2 files under the SIL Open Font License 1.1. This page makes no request to Google's font servers at all, so your IP address does not reach Google at page load, before consent or after it. Embedding Google Fonts remotely without consent was held to infringe the right to informational self-determination by the Landgericht Muenchen I (judgment of 20 January 2022, case 3 O 17493/20), and self-hosting is the direct answer to that.
• Outbound links. Links to vikataylor.com and to youtube.com hand you over to those sites and their own privacy policies. Nothing about you is passed along beyond the referrer your browser sends by default.

There is no embedded video player, no map, no chat widget, no advertising network, no A/B testing tool and no script CDN on this site. The content security policy served for this domain refuses scripts from any origin except this one and Google's analytics endpoints, so a third-party tracker could not run here even by accident.

Google and Cloudflare are US companies and may process the data above outside the EEA and the UK. Both publish their own transfer safeguards, including Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework; the two policy links above are the current versions.

05 Your rights (GDPR / UK GDPR / similar)

If you are in the EU, the UK, or any region with comparable privacy law, you have the right to:

• Access the data held about you
• Correct it
• Delete it (the "right to be forgotten")
• Restrict or object to processing
• Withdraw consent at any time, with no effect on processing done before withdrawal
• Receive a copy in a portable format
• Lodge a complaint with your local data protection authority

To exercise any of these, email vika.taylor.one@gmail.com. You will get a reply within 30 days.

One honest caveat: there is very little here to hand over. No name, email or account exists on this site, so an analytics record cannot normally be tied back to you as a person, and I am not able to identify you from it (GDPR Art. 11). The fastest way to remove the analytics identifier attached to your browser is to use the Cookie settings control in section 3, decline, and clear site data for this domain. That erases it at the source, which no email to me can do faster.

06 CCPA / California residents

Personal information is not sold and not shared for cross-context behavioural advertising, and it has not been in the previous twelve months. There is no financial incentive programme attached to any of this. The only category collected in CCPA terms is internet activity information: through Google Analytics after you opt in, and as technical request data at the host. You have the right to know what is collected, to request its deletion, and not to be treated differently for asking. Same address as above: vika.taylor.one@gmail.com.

07 Children

This site is not directed at children under 16 and does not knowingly collect their data. Nothing on it is age-gated, because there is nothing to register for and nothing to buy.

08 Changes to this policy

The date at the top of this page is the date of the last change. If what is collected, or who processes it, ever changes materially, this page is updated before that change takes effect. Your stored consent choice expires after 180 days in any case, so the question is put to you at least twice a year rather than being inherited from an answer you have forgotten giving.