Cookie Policy

INTRODUCTION

This Cookie Policy explains how Vinea Ventures Ltd. ("Vinea", "we", "us" or "our") uses cookies, browser storage and similar technologies in connection with https://www.fabianweinberger.com and https://www.independencenation.com (including corresponding apex domains and public subpages). Both Websites are operated by Vinea Ventures Ltd., Malta company C 117259. Although they share a controller and legal documents, their current technical features and externally linked services differ.

Some technologies involve personal information; others involve access to a browser or device without necessarily setting a conventional cookie. Our Privacy Policy describes the underlying personal-data processing, recipients, lawful bases and rights more broadly.

1. WHAT ARE COOKIES?

Cookies are small files stored by a browser at the request of a website or service. Some are session cookies, which normally disappear when the session ends; others are persistent and remain until expiration or deletion. A cookie set by the domain being visited is commonly called first-party, while a cookie associated with another provider's domain is third-party relative to the visited page.

Similar technologies include local storage, session storage, IndexedDB, tracking links, embedded scripts, pixels, locally derived identifiers and browser or device APIs. A web service may process IP addresses or other request information without using browser cookies. Calling a method “cookieless” does not necessarily mean it involves no personal data or no device information.

2. WHY DO WE USE THESE TECHNOLOGIES?

We use website delivery and security facilities to transmit requested pages, process enquiries and protect against misuse. A narrow category of storage or access strictly necessary for a service expressly requested can qualify for a consent exemption under the applicable electronic-communications rules. The exemption is not available simply because a feature is commercially useful.

We use Vercel Web Analytics on both Websites to measure aggregate page visits and understand which content visitors use, only after affirmative optional-analytics consent. It does not set analytics cookies. It uses information derived from requests to create a visitor hash that resets daily. Browser API access and client-side measurement can nevertheless fall within electronic-communications rules; we conservatively withhold the service until consent rather than assuming an exemption.

Vercel Speed Insights has been removed from both Websites. It is not part of the current performance-measurement or storage inventory.

The Websites do not use Meta Pixel, Google Analytics, behavioral advertising cookies, or a native newsletter tracker. We do not treat installed but inactive code or a possible future integration as an active tracking service.

Independence Nation provides an ordinary external Calendly booking link. Calendly has its own privacy and cookie technology when its site is visited; its booking service is not loaded on the Independence Nation page.

3. HOW CAN I CONTROL COOKIES AND TRACKING?

A locally bundled, open-source CookieConsent control offers Accept analytics, Reject analytics and Consent Preferences. Optional analytics is off by default and remains unloaded until affirmative consent. Accept and reject have equal prominence. Scrolling, inactivity, a pre-ticked box or submitting an enquiry is not consent. Rejecting does not affect browsing, legal pages, enquiries or booking. A necessary first-party preference cookie remembers your choice.

You can reopen Consent Preferences from the footer on every page and disable optional analytics. Withdrawal stops consent-dependent analytics. On Independence Nation, the page reloads to remove its listeners; on Fabian Weinberger, each analytics event checks the active consent state, including after withdrawal. Your choice persists for approximately six months on that domain and browser; the two Websites do not share consent cookies. Deleting or expiring the preference cookie causes the choice to be requested again. Not all cookieless analytics is exempt: browser APIs, device-information access, identifiers and tracking URLs can still engage electronic-communications and privacy rules.

Cookieless analytics is not automatically exempt from applicable electronic-communications or data-protection rules. We therefore require opt-in for the selected browser measurement. Both Websites use allowlisted public page paths and exclude queries/fragments and unsafe external-referrer events. No custom conversions, identity events, Google Analytics or targeted-advertising measurement is part of this configuration.

When you follow our external Calendly link, any Calendly cookie choices are presented by that provider on its own site and are not a shared Vinea website preference. You can use the provider's settings and your browser controls there. We cannot erase another provider's domain cookies merely by changing a setting on one of our Websites.

4. WHAT IS USED ON EACH WEBSITE?

A. FABIAN WEINBERGER — FIRST-PARTY SITE

Website delivery: Vercel hosts the website and its enquiry-processing endpoint. Ordinary network requests contain an IP address, requested URL, time and browser/network data. Hosting does not, merely by itself, require an advertising cookie.

Vercel Web Analytics on Fabian Weinberger, after consent: permitted information can include a known public page path or route, safe referring context, event time, browser and operating-system characteristics, device category and approximate location inferred from the request. All URL query strings and fragments are removed. An event with an unsafe external referrer is withheld where the current SDK's beforeSend hook cannot safely rewrite its complete referrer. No custom conversion, identify/group call, booking identifier or submitted form content is sent. The service does not set an analytics cookie and uses a request-derived visitor hash that normally resets after approximately 24 hours; aggregate reports have a different retention period. Fabian Weinberger does not intentionally create or clear the legacy __va_attribution local-storage key. If that historical key is present, beforeSend suppresses the affected analytics event instead of transmitting it. Independence Nation's distinct legacy-key cleanup is described in its own inventory below.

Preference storage — Fabian Weinberger: necessary first-party cookie vinea_consent, current host, path /, SameSite=Lax, Secure over HTTPS, 182 days, configuration revision 1. It stores chosen categories, a consent identifier and creation/update times to remember the choice. It is not an advertising or analytics cookie. No centralized consent-record database is created by this website's locally bundled CookieConsent interface. Speed Insights is not loaded. Consent Preferences remains accessible through the footer.

Form security: The Fabian enquiry endpoint uses a short-lived, per-process in-memory counter based on a keyed HMAC of the request IP. Its key is derived with a per-process random secret; no raw IP is intentionally logged in the application counter. Up to five requests may be counted per ten-minute window, with expired-key cleanup via timer and request-triggered sweeps plus a bounded store capacity. This is server-side pseudonymous security processing, not browser cookie storage. Provider hosting/security logs remain separate.

The first-party website no longer loads Termly scripts or transmits Termly consent/statistics events. It does not create the old Termly csrf_token cookie or TERMLY_API_CACHE local-storage record. Legacy items in an existing browser may remain until expiration or deliberate cleanup and are not active features of the replacement website.

B. INDEPENDENCE NATION — FIRST-PARTY SITE

Website delivery — Independence Nation: Vercel serves the public landing page and native legal pages. Independence Nation uses a necessary first-party preference cookie named in_privacy_choice, current host, path /, SameSite=Lax, Secure over HTTPS, 180 days, configuration revision 1. It stores chosen categories, a consent identifier and creation/update times to remember your privacy choice. It is not an analytics or advertising cookie. No centralized consent-record database is created by the local website control. Independence Nation does not intentionally create application local-storage, session-storage or IndexedDB records; after analytics consent it clears the legacy __va_attribution local-storage key before loading the SDK, which checks that key.

Vercel Web Analytics — Independence Nation: optional analytics remains unloaded before consent and after rejection or withdrawal. Accepted analytics reports aggregate traffic and the technical categories described above. Only known public page paths are allowed; all queries and fragments are removed, and unsafe external-referrer events are withheld. The daily request-derived visitor hash is not a conventional analytics cookie. No custom events, visitor identity calls, advertising integrations or Speed Insights are enabled.

External Calendly booking: An ordinary booking hyperlink opens https://calendly.com/fabian-fabianweinberger/30min. The booking page has a different domain and provider. Loading and interacting with that external service can create provider cookies, tracking records, scheduling logs and browser storage. Vinea's Privacy Policy explains the appointment purposes, while Calendly's own notice and cookie controls govern its independent functions: https://calendly.com/legal/privacy-notice.

Independence Nation does not load inline or popup Calendly JavaScript, CSS or iframes when you open or scroll the page, follow an anchor, or approach the booking section. Only deliberately following the ordinary external booking link takes you to Calendly's service. The link does not forward URL parameters or personal data and suppresses the referrer.

Consent operation on Fabian Weinberger: analytics is unloaded before consent and after rejection. Acceptance enables measurement only for the chosen analytics category; the SDK checks the current vinea_consent preference for every event. Withdrawal suppresses further analytics requests without reloading the page. Rejection persists on revisit and a renewed acceptance does not cause a duplicate SDK load. The preference control remains available from the footer.

Consent operation on Independence Nation: optional analytics remains unloaded until consent. Acceptance enables the Vercel SDK; withdrawal immediately denies further analytics and reloads the page to remove active listeners. The necessary in_privacy_choice cookie remembers the choice for up to 180 days on that domain/browser. Neither Website adopts a consent choice from the other domain. Deleting an existing choice cookie can cause a fresh preference prompt.

5. COOKIES AND STORAGE YOU MAY ENCOUNTER ON THE EXTERNAL CALENDLY SERVICE

The following examples were directly observed in the 10 October 2026 Calendly audit when the scheduler was embedded or opened on Calendly's own domain. They describe that provider's tested behavior, NOT cookies set by the Independence Nation origin. Expiration periods describe browser observations and can change; they do not establish provider-side record retention or an exemption from consent.

__cf_bm — Cloudflare for Calendly; .calendly.com; about 30 minutes; bot/abuse controls; observed before choices. The necessity of this function for a requested booking was inferred, not independently adjudicated.

_cfuvid — Cloudflare for Calendly; .calendly.com; session; rate-limiting/visitor distinction; observed before choices.

OptanonConsent — OneTrust for Calendly; .calendly.com; about 365 days; remembers category decisions and consent metadata.

OptanonAlertBoxClosed — OneTrust for Calendly; .calendly.com; about 365 days; remembers banner dismissal after a choice.

m — Stripe risk service; m.stripe.com; approximately 400 days in the tested Chromium browser, despite a longer expiry requested by the server; fraud/device risk identification; observed before choices even for a free booking. A strict-necessity exemption for this exact flow was NOT established.

_calendly_session — Calendly; calendly.com; approximately 21 days on the direct booking page; scheduler/session functionality. The observed browser lifetime differs from an ordinary end-of-browser session.

__stripe_mid — Stripe via Calendly; .calendly.com; about 365 days; fraud/device identifier. It appeared on the direct booking page before a choice although the provider's served cookie inventory classified it as Functional.

__stripe_sid — Stripe via Calendly; .calendly.com; about 30 minutes; related risk/session identifier, also labelled Functional in the provider inventory.

_dd_s — Datadog via Calendly; calendly.com; about 15 minutes observed, with possible session renewal; monitoring/session correlation. Its provider label does not by itself establish strict necessity.

cal_anonymous_id — Calendly; calendly.com; about 365 days after optional acceptance; pseudonymous analytics identifier, observed to remain after withdrawal/revisit.

ajs_anonymous_id — Segment via Calendly; .calendly.com; about 365 days after acceptance; pseudonymous analytics identity, also observed as a local-storage key.

Additional provider-side storage observed included Calendly _cache; Google reCAPTCHA rc::a and rc::c; Stripe _ab, _mf, 1 and id; Segment ajs_anonymous_id; Sprig userleap.ids and sprig.anon.env.vid.map; Statsig evaluation/session/stable ID records and page_analytics_page_type. Provider-defined expiry and purposes for those records were not fully verified.

Calendly's direct booking site was previously observed retaining some optional browser identifiers after withdrawal, with one Statsig logging request observed after a withdrawal on the provider's own page. These are separate provider-side observations, not technologies placed on the Independence Nation origin by an ordinary outbound booking link. Vinea does not control third-party cookies on Calendly's domain; see Calendly's current notices and preference tools.

6. WHAT ABOUT WEB BEACONS, TRACKING PIXELS AND OTHER METHODS?

Small resources, scripts, image pixels, unique links, hashed identifiers or access to browser APIs can transmit request/device information even when no standard cookie is placed. Such processing needs an independent legal assessment. We do not use advertising web beacons on the first-party Websites, and the Fabian enquiry email generated by the application does not include remote tracking images.

Analytics is limited to allowlisted public page paths with every query string and fragment removed. Events carrying an unsafe external referrer are withheld. We do not send visitor emails, tokens, confidential notes, form content, booking identifiers or campaign query parameters in analytics. No custom conversion events or visitor identity calls are enabled.

7. DO WE SERVE TARGETED ADVERTISING?

The two Websites do not run targeted advertising pixels, cookie-based remarketing, cross-site advertising IDs or a native personalized-advertising platform. We do not use website contact forms to enroll visitors automatically in an advertising audience.

Some independent external services, such as Calendly's own website, may use optional marketing technologies in accordance with their policies and choices. That does not mean Vinea runs its own Meta pixel or pays to serve advertisements to you. Any future active advertising technology would require revised disclosures and the applicable consent or opt-out facilities before use.

8. HOW CAN I CONTROL COOKIES THROUGH MY BROWSER?

Browser settings can generally block or remove cookies and website storage. Current instructions are available from:

Google Chrome: https://support.google.com/chrome/answer/95647

Mozilla Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

Apple Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Microsoft Edge: https://support.microsoft.com/microsoft-edge

Opera: https://help.opera.com/en/latest/web-preferences/

Browser-level controls affect the device and browser you use. They do not necessarily erase a provider's existing server-side record or substitute for a privacy-rights request. Disabling all cookies could limit an external booking provider's interactive functions.

9. DO-NOT-TRACK, PRIVACY SIGNALS AND REGIONAL RIGHTS

Browsers may transmit legacy Do Not Track, Global Privacy Control or another preference signal. The requirements for recognizing such signals depend on the applicable law and the processing involved. Our own Websites do not employ cross-context behavioural advertising pixels or sell visitor information as a website business model; any legally mandatory opt-out signal is handled for processing to which it applies.

The EU GDPR and Malta's electronic-communications rules require evaluating the concrete technology, purpose and lawful basis, not merely the absence of cookies. Detailed privacy rights are described in our Privacy Policy.

10. HOW LONG DO WE KEEP INFORMATION?

Cookie and preference lifetimes differ from server-record retention. On Fabian Weinberger, necessary vinea_consent is configured for up to 182 days; on Independence Nation, necessary in_privacy_choice is configured for up to 180 days. Both may be deleted sooner through browser settings. Neither cookie changes the duration of Vercel's daily request-derived visitor hash (about 24 hours) or establishes how long its aggregate analytics reports remain stored. Hosting/security logs, booking records and business correspondence have different retention rules addressed in the Privacy Policy.

11. UPDATES AND CONTACT

We update this policy when active technology, purposes, providers or applicable law materially changes. A new tracking purpose can require fresh consent or another lawful basis; changing this text alone is insufficient. The publication date is shown above.

Contact: privacy@fabianweinberger.com or Vinea Ventures Ltd., 230, 230 Works Business Centre, Second Floor, Triq il-Kungress Ewkaristiku, Mosta MST 9039, Malta. The Privacy Policy at /privacy-policy explains your rights and how to submit requests without using a third-party policy-service account.