Cookie Policy

1. Summary

This policy explains which cookies and similar technologies run on academy.oanalabes.com, its lead-magnet subdomains and the oanalabes.com pages that show our cookie banner, who sets them, why, and for how long. It supplements our Privacy Policy.

• Only strictly necessary technologies run until you choose. Analytics, marketing and embedded third-party content are off by default.
• Before you choose, your browser requests nothing from third-party servers: our images, icons and fonts are served from our own server. The only exceptions are our hosting provider, Netlify, which delivers every page, and the CEO Finance Circle™ points and leaderboard pages, which read published points data from Google Sheets (see the inventory).
• "Accept all", "Reject all" and "Customize" carry equal weight in our banner. Rejecting is as easy as accepting.
• You can change or withdraw your choice at any time.
• We honour Global Privacy Control (GPC).

2. What Cookies and Similar Technologies Are

A cookie is a small text file that a website stores in your browser. Similar technologies work the same way for our purposes and are covered by this policy: browser local storage and session storage, scripts that load from third-party servers, and content embedded from other services (for example video players and forms), which can read or store information on your device and receive your IP address.

First-party technologies are set by academy.oanalabes.com. Third-party technologies are set by another provider whose content or script runs on our pages. Third parties process data under their own privacy policies, linked in the inventory below.

3. Categories & Legal Basis

Strictly necessary — always on

Needed to deliver the site and to remember your cookie choice. They cannot be switched off. Legal basis: strictly necessary to provide the service you request, and our legitimate interest in running a secure, working site.

Preferences & embedded media — off by default

Newsletter forms, video players, testimonial widgets, webinar registration, embedded forms, add-to-calendar tools, our website assistant (Chatbase), and results the site saves in your browser at your request. Legal basis: your consent.

Analytics — off by default

Google Tag Manager and Google Analytics, used to measure visits and improve the site. Legal basis: your consent.

Marketing — off by default, and forced off while GPC is on

Newsletter sign-up attribution (Beehiiv), the StreamYard live-stream player (which loads StreamYard's own advertising and affiliate tracking, such as MNTN and FirstPromoter), and any advertising tags deployed through Google Tag Manager. Legal basis: your consent.

When a category is off, its scripts do not load and its embeds are replaced by a placeholder. You can load a single embed with its "Load content" button without changing your saved choice for the whole category.

4. How to Change or Withdraw Your Choice

Open your cookie settings at any time. The same controls are linked in the footer of every page.

When you withdraw consent, we reload the page so the scripts of the categories you withdrew stop running. When you withdraw Preferences & embedded media, we also delete the site's saved data in your browser (ceo_diag_scores, academyMasterclassPopupShown, the Wistia keys wistia and wistia-video-progress-<id>, and message_bubbles_have_been_shown) and the Chatbase cookie (chatbase_anon_id) set on our domain. When you withdraw Analytics, we also delete the Google Analytics cookies (_ga, _ga_<container-id>) set on our domain. Withdrawal does not affect processing that took place before it. Cookies already set by third parties stay in your browser until they expire or you delete them; you can delete them in your browser settings.

You can also block or delete cookies in your browser. If you block strictly necessary cookies, we cannot remember your choice and the banner will appear on each visit.

5. Full Inventory

Where a third party does not publish fixed cookie names, we name the provider and link its policy instead of listing names we cannot verify.

Third-party providers loaded by embeds

These providers are loaded by the embeds listed above, not by us directly; they apply only after you allow the category shown, except where marked strictly necessary.

6. Global Privacy Control & Do Not Sell or Share

We honour the Global Privacy Control (GPC) signal. When your browser sends GPC, we treat it as a valid request to opt out of the sale or sharing of your personal information. The Marketing category stays off and cannot be switched on while GPC is active, and our server records the marketing choice as off even if a request says otherwise.

We do not sell personal information for money. Some marketing technologies may count as "selling" or "sharing" under California and other US state laws. To opt out without GPC, use Do Not Sell or Share My Personal Information. It opens your cookie settings with Marketing selected so you can switch it off.

7. Proof of Consent & Renewal

We keep a record so we can demonstrate consent. A record is created each time you save a choice, each time you load a single embed with its "Load content" button (the record names the provider, for example YouTube), and automatically when your browser sends Global Privacy Control.

Each record contains: the random consent ID, the categories allowed, the type of action, the policy version and the version of the banner text you saw, the date and time, your GPC status, your language, the page path (without any query string), your browser family and operating system family (not the full browser identifier), your country, and a truncated IP address (the last part removed). We keep these records for 3 years, then delete them automatically.

We ask for your choice again every 12 months: a choice older than 12 months is treated as expired even if the cookie is still in your browser. We also ask sooner whenever this policy changes in a way that requires new consent. Some browsers, such as Safari, limit cookies set by a script to 7 days, so you may be asked again sooner.

8. Fonts, Images & Hosting

We self-host the fonts, images and icons used on our own pages, including client logos, testimonial photos and course images, and we do not request fonts from Google when you browse our site. However, some third-party services we embed (for example, video, webinar, form or testimonial embeds) may load their own resources, including fonts from Google Fonts, from their providers once you allow them. Those providers are listed in the third-party providers table in Section 5.

The site is hosted by Netlify. Netlify processes request data (including IP address) to deliver and secure the site; we do not set cookies through Netlify.

9. Regional Notes

European Union / EEA

We follow the GDPR and the ePrivacy Directive as implemented in your country: non-necessary technologies run only with your prior, specific, informed and freely given consent, which you can withdraw as easily as you gave it.

United Kingdom

We follow the UK GDPR and the Privacy and Electronic Communications Regulations (PECR) on the same basis as for the EU/EEA.

Canada

We follow PIPEDA. For Quebec residents under Law 25, privacy-invasive technologies are off by default (privacy by default), and this policy, our Privacy Policy and our cookie banner are available in French: Politique relative aux témoins.

United States

We follow the CCPA as amended by the CPRA and other US state privacy laws. You can opt out of the sale or sharing of personal information and of targeted advertising with GPC or the Do Not Sell or Share link. See Section 8 of our Privacy Policy for your other rights.

10. Changes to This Policy

We update this policy when the technologies we use change. Each update carries a new date and policy version at the top of this page. When a change affects what you consented to, we ask for your choice again.

11. Contact