Cookies Policy

This Cookies Policy explains how Merula uses cookies and similar technologies (local storage, session storage, pixels, SDK identifiers) on merula.lu and its sub-domains. It complements our Privacy Policy.

1. What is a cookie?

A cookie is a small text file placed on your device by a website you visit. Similar technologies (local storage, session storage) work in the same way without necessarily being called "cookies" — this policy treats them all equivalently, in line with EU ePrivacy rules.

2. Categories of cookies we use

Strictly necessary. Required for the Platform to function: authentication session, CSRF protection, load-balancing, preferred language, consent state. These do not require your consent under EU ePrivacy rules.

Functional. Improve your experience: remembering filters, keeping you signed in, storing Merula+ dashboard preferences. Set only where necessary for the feature you use.

Analytics. If we ever enable analytics, they are only loaded after you give your explicit consent through the cookie banner, and are configured to minimise identifiers (short retention, IP truncation, EU-region processing).

Marketing. Merula does not currently use third-party marketing or advertising cookies. If this changes, we will update this policy and ask for your consent again.

3. Third-party services that may set cookies

• Supabase — authentication session and secure token storage (strictly necessary).
• Stripe — fraud prevention and secure checkout during Merula+ subscription (strictly necessary when a payment page is displayed).
• Sonner / UI libraries — local storage entries for UI preferences (functional).

4. Your choices

When you first arrive on Merula, a cookie banner lets you accept or refuse non-essential cookies. You can change your choice at any time by clearing your browser storage or by using the "Cookie preferences" link in the footer where available. Most browsers also let you block or delete cookies directly.

Refusing non-essential cookies has no impact on your access to the core marketplace. Some features (persistent sign-in, remembered filters) may be reduced.

5. Retention

Session cookies expire when you close your browser. Persistent cookies typically expire between 30 days and 12 months. Consent choices are stored for up to 12 months, after which we will ask again.

6. Data protection & supervisory authority

Personal data collected through cookies is processed in accordance with our Privacy Policy. You may complain to the Luxembourg supervisory authority (CNPD — cnpd.public.lu).

7. Changes

We may update this Cookies Policy when we add or change technologies. Material changes will be notified through the cookie banner or an in-app notice.

© 2026 Merula · Luxembourg.