Cookie Notice

1. Scope
This Cookie Notice explains how Dear Future uses cookies and similar technologies
through:

• The Dear Future website;
• Checkout and payment pages;
• Order-management pages;
• Secure listening and rescheduling pages;
• Recipient information pages;
• Customer-support forms;
• Physical-event ordering interfaces; and
• Other online services that link to this Notice.

This Notice supplements the Global Privacy Policy.

Where a regional supplement provides additional protection, that supplement also applies.

2. About Dear Future
The intended operator is:

Dear Future BV/SRL, a Belgian private limited company
Country of establishment: Belgium
Email: info@dearfuture.ink

The final registered office, Belgian enterprise number and VAT number must be published
before Dear Future begins accepting paid Orders.

3. What cookies are
Cookies are small data files stored on or accessed from a computer, telephone, tablet or
other device.

Cookies may allow a website to:

• Recognise a browser;

• Maintain a secure session;

• Remember preferences;

• Preserve a shopping cart;

• Process a payment;

• Detect fraud;

• Measure website use;

• Remember a consent decision; or

• Support other website functions.

The term “cookies” in this Notice also includes similar technologies where appropriate.

4. Similar technologies
Dear Future or its Service Providers may use technologies such as:

• Local storage;
• Session storage;
• Software development kit identifiers;
• Pixels;
• Web beacons;
• Tracking links;
• Device or browser identifiers;
• Server-side event records;
• IP-based security signals;
• URL parameters;
• Hashed visitor identifiers; and
• Other technologies that store information or access information associated with a
  device.

A technology does not need to be called a “cookie” for this Notice or applicable privacy rules
to apply.

5. Legal framework
In the European Economic Area, storing information on or accessing information from a
user’s device generally requires:

1. Clear and comprehensive information; and
2. Prior consent,

unless the technology is used solely to transmit a communication or is strictly necessary to
provide a service expressly requested by the user.

The processing of personal information obtained through cookies is also subject to the
GDPR or other applicable privacy law.

Dear Future may apply these protections globally where operationally practical, even where
local law permits a less restrictive approach.

6. Cookie categories

Dear Future divides cookies and similar technologies into the following categories:

1. Strictly necessary;
2. Functional and preference;
3. Analytics and performance;
4. Advertising and personalised marketing;
5. Embedded third-party content; and
6. Email interaction tracking.

Not every category is currently active.

7. Strictly necessary technologies
Strictly necessary technologies support functions that are essential to provide a service
expressly requested by the visitor.

They may be used for:

• Website security;
• Fraud prevention;
• Load balancing;
• Session management;
• Shopping-cart operation;
• Checkout;
• Payment processing;
• Order-management access;
• Secure listening access;
• Rescheduling;
• Authentication;
• Maintaining a logged-in state;
• Remembering cookie choices;
• Preventing repeated consent banners;
• Protecting forms against misuse;
• Preserving an Order during navigation;
• Detecting unauthorised access; and
• Complying with a privacy or opt-out request.

These technologies cannot normally be disabled through the Dear Future consent panel
because the relevant website function may not work without them.

Visitors can still block them through browser settings, but doing so may prevent Dear Future
from providing the requested function.

8. Necessary does not mean merely useful
Dear Future will not classify a cookie as strictly necessary merely because it:

• Improves business performance;

• Measures visitor numbers;

• Improves marketing;

• Makes analytics easier;

• Increases conversion rates;

• Personalises advertising;

• Measures campaigns; or

• Provides information that Dear Future would prefer to have.

The Belgian Data Protection Authority states that only technologies genuinely necessary to
provide the user-requested service qualify for the exemption. Cookies used merely to count
visitors are generally not automatically included.

9. Functional and preference technologies
Functional technologies may remember choices such as:

• Language;
• Country;
• Display preferences;
• Accessibility settings;
• Previously selected product;
• Delivery-method preference;
• Time-zone preference; or
• Form progress.

A functional technology may be treated as strictly necessary where it is intrinsic to a service
expressly requested by the visitor.

Other functional technologies will be activated only with consent where required.

Refusing optional functional technologies should not prevent access to the core website.

10. Analytics and performance technologies
Analytics technologies may help Dear Future understand:

• Which pages are visited;
• How visitors reach the website;
• Which devices and browsers are used;
• Whether pages load correctly;
• Where technical errors occur;
• Whether visitors complete checkout;
• Which countries visitors access the website from;
• How navigation can be improved; and
• Whether design and accessibility changes work.

Analytics will not be used to analyse the private contents of Letters or Calls.

Dear Future will not send the following to website analytics:

• Letter text;
• Letter PDFs;
• Audio content;
• Recipient names;
• Full postal addresses;
• Telephone numbers;
• Email addresses;
• Secure listening tokens;
• Private access links;
• Encryption keys; or
• Unredacted support complaints.

11. Consent for analytics
Dear Future will treat analytics as non-essential.

Where analytics is enabled:

• It will be disabled before consent;
• No analytics cookie will be intentionally placed before consent;
• No analytics tag will be intentionally loaded before consent where the basic blocking
  model is used;
• The visitor may refuse analytics without losing access to the website;
• Consent can be withdrawn at any time; and
• Withdrawal will prevent future analytics collection through Dear Future’s
  configuration.

Dear Future will use a basic consent implementation for Google Analytics in
consent-required regions. This means that the Google Analytics tag should remain blocked
until analytics consent is granted, rather than sending cookieless analytics pings following
refusal.

Google’s advanced consent mode may transmit cookieless pings when
analytics_storage is denied. Dear Future will not intentionally use that advanced
collection model in consent-required regions without separately reviewing and disclosing it.

12. Google Analytics
Dear Future may use Google Analytics 4 to measure website use after valid consent.

Google Analytics may process information such as:

• Page viewed;

• Approximate location;

• Browser and device information;

• Referral source;

• Session events;

• Time spent;

• Interaction events;

• Consent status; and

• Technical identifiers.

Google Analytics uses first-party cookies including:

Cookie Purpose Google
default

_ga Distinguishes visitors 2 years

ga<container-i Maintains session 2 years
d> state

Google allows the website operator to override those defaults.

Before launch, Dear Future will configure the Google Analytics cookie duration to no more
than thirteen months, unless a shorter period is selected.

The live Cookie Settings panel must display the actual configured duration.

13. Google Analytics configuration
Dear Future will configure Google Analytics so that:

• Analytics storage is denied by default;
• The tag is blocked until consent where required;
• Advertising storage is denied;
• Advertising personalisation is denied;
• Advertising user-data sharing is denied;
• Google Signals is disabled unless separately reviewed;
• User-ID functionality is not used unless separately disclosed;
• Private Message content is never included in events;
• Full Recipient information is never included in URLs;
• Order numbers are not sent where they could identify a Customer;
• Custom event properties are reviewed before deployment;
• Internal traffic can be excluded where appropriate; and
• Event-level retention is kept no longer than reasonably necessary.

Google Consent Mode communicates a visitor’s consent choices to Google tags, but it does
not itself provide the cookie banner or obtain consent.

14. Google advertising features

Dear Future does not currently use:

• Google Ads remarketing;
• Google Ads conversion cookies;
• Google advertising audiences;
• Google Signals;
• Enhanced conversions;
• Cross-device advertising profiles; or
• Personalised advertising through Google.

Google states that linking Google Analytics to Google Ads can result in additional advertising
and measurement cookies.

Dear Future will not link or activate those features without:

• Updating this Cookie Notice;
• Updating the Global Privacy Policy;
• Updating the consent banner;
• Adding an advertising category;
• Completing a legal review;
• Obtaining consent where required; and
• Providing required opt-out rights.

Consent given only for analytics will not be treated as consent for advertising.

15. Vercel Web Analytics
Dear Future may use Vercel Web Analytics for limited website-performance measurement.

Vercel states that its Web Analytics product does not rely on third-party cookies. It identifies
visits through a hash created from the incoming request and discards the visitor session
after twenty-four hours.

Even though Vercel Web Analytics may operate without conventional cookies, Dear Future
will classify it under Analytics and Performance and, for the strongest launch position, will
activate it only after analytics consent in regions where consent or equivalent choice is
appropriate.

Dear Future will use Vercel’s available redaction controls to prevent sensitive information
from being included in analytics events. Vercel specifically provides a beforeSend function
that can modify or discard information before an event is sent.

16. Vercel operational logs
Vercel infrastructure may necessarily process technical request information for:

• Hosting;

• Cybersecurity;

• Error handling;

• Reliability;

• Fraud prevention;

• Network operation; and

• Delivery of the website.

These server-side operations are separate from optional Vercel Web Analytics.

Dear Future will seek to prevent sensitive information from appearing in:

• Page URLs;
• Query strings;
• Error messages;
• Referrer fields;
• Analytics events; and
• Routine infrastructure logs.

Visitor consent is not used as the legal basis for every security or infrastructure operation.
Necessary security and service-delivery processing may continue after analytics refusal.

17. Stripe payment technologies
Dear Future uses Stripe to process payments.

Stripe may use cookies and similar technologies through:

• Stripe Checkout;
• Embedded Stripe payment components;
• Fraud-prevention functions;
• Payment authentication;
• Payment-method selection;
• Secure transaction processing; and
• Payment-dispute prevention.

Stripe states that its strictly necessary technologies support authentication, fraud detection,
security, operation and payment processing.

Stripe may also have its own optional analytics or advertising technologies on
Stripe-controlled pages. Stripe manages those technologies under its own cookie controls
and policies.

18. Stripe and consent
Cookies that Stripe reasonably requires to:

• Secure the payment form;

• Authenticate the payment;

• Detect fraud;

• Prevent misuse; or

• Complete the transaction

may be treated as strictly necessary for the payment service requested by the Customer.

Dear Future will not use Stripe advertising functions for Dear Future marketing without
separately disclosing and obtaining any required consent.

Where Stripe controls a hosted payment page, Stripe may independently present its own
cookie choices. Stripe states that it requests prior consent for non-essential cookies where
required or otherwise provides an opt-out.

19. Shopping-cart and checkout technologies
Dear Future may use first-party cookies, local storage or session storage to:

• Remember the product selected;
• Preserve an unfinished shopping cart;
• Move between checkout steps;
• Prevent duplicate submissions;
• Associate payment status with an Order;
• Remember whether the Message is for the Customer or someone else;
• Preserve temporary form information;
• Prevent accidental loss during navigation; and
• Secure the checkout.

These technologies may be strictly necessary where they are required to provide the cart or
checkout expressly requested by the visitor.

They must not store the substantive contents of a private Letter or Call in ordinary browser
storage unless:

• It is technically necessary;
• The visitor is clearly informed;
• The information is appropriately protected;
• The storage is short-lived; and
• A safer server-side approach is not reasonably available.

The preferred design is for private Message content to be stored securely on Dear Future’s
servers rather than persistently in the browser.

20. Abandoned-checkout information
Dear Future may identify that a visitor began but did not complete an Order.

This may involve:

• An email address voluntarily entered during checkout;

• Product type;

• Checkout stage;

• Cart identifier;

• Order draft identifier;

• Date and time;

• Payment status; and

• Limited technical information.

Dear Future may send a limited abandoned-checkout reminder where legally permitted.

The reminder will not contain:

• Private Letter content;
• Private Call audio;
• Full Recipient Delivery Details;
• Sensitive Message information; or
• A publicly accessible Message link.

Abandoned-checkout communications are principally governed by the Global Privacy Policy
and applicable electronic-marketing rules, not merely by this Cookie Notice.

21. Abandoned-checkout retention
An abandoned shopping cart or draft Order may be retained for up to thirty days after the
visitor’s last relevant activity, unless:

• A shorter period is shown;
• The visitor deletes it;
• A legal or fraud reason requires limited retention; or
• The visitor completes the Order.

A necessary cart identifier may remain active for that period.

An analytics identifier is not required merely because an abandoned cart exists.

22. Resend and email technologies
Dear Future uses Resend to send transactional and service emails.

Resend offers optional:

• Email-open tracking; and
• Link-click tracking.

Resend states that these features are disabled by default. Open tracking works by inserting
a one-pixel image, while click tracking records access through redirected links.

At launch, Dear Future will keep Resend open and click tracking disabled for:

• Order confirmations;
• Recipient notices;
• Call rescheduling;
• Secure-listening emails;
• Cancellation confirmations;
• Privacy communications; and
• Other transactional emails.

23. Future email tracking
Dear Future will not activate email-open or click tracking merely because Resend makes the
feature available.

Before activating it, Dear Future must:

• Define a legitimate and specific purpose;
• Determine the applicable legal basis;
• Update the Global Privacy Policy;
• Update this Notice where relevant;
• Distinguish transactional and marketing emails;
• Provide required consent or opt-out rights;
• Limit retention;
• Avoid using it for sensitive Recipient communications; and
• Ensure tracking is not included in secure-listening or privacy-request messages
  without a compelling lawful reason.

Dear Future may record ordinary operational information such as:

• Email submitted;
• Email delivered;
• Email bounced;
• Email rejected; or
• Technical delivery failure.

This is distinct from tracking whether a person opened an email or clicked a link.

24. Advertising and personalised marketing
Dear Future does not currently use:

• Meta Pixel;

• TikTok Pixel;

• Google Ads remarketing;

• Personalised advertising cookies;

• Cross-site advertising identifiers;

• Affiliate tracking;

• Retargeting audiences;

• Data-broker integrations; or

• Advertising based on private Message content.

The advertising category in the consent panel must therefore be either:

• Omitted; or
• Clearly shown as inactive.

It must not invite visitors to consent prospectively to unidentified advertising providers.

25. Future advertising
Dear Future may introduce advertising in the future.

Advertising will not be activated until Dear Future has:

• Identified every relevant provider;
• Completed provider due diligence;
• Updated this Cookie Notice;
• Updated the Global Privacy Policy;
• Added providers and purposes to the consent panel;
• Obtained valid consent where required;
• Implemented applicable sale, sharing and targeted-advertising opt-outs;
• Implemented retention limits;
• Honoured applicable browser-based opt-out signals;
• Prevented the use of private Message content; and
• Prevented Recipient Delivery Details from being used for advertising.

A previous choice to accept analytics will not automatically authorise advertising.

26. No advertising based on private Messages
Dear Future will not use the content of a Letter or Call for:

• Selecting advertisements;
• Creating advertising audiences;
• Inferring interests;
• Inferring health, religion, sexuality or political views;
• Retargeting;
• Lookalike audiences;
• Marketing profiles; or
• Advertising measurement.

Dear Future will not send private Message content to:

• Google Analytics;

• Google Ads;

• Meta;

• TikTok;

• Affiliate networks;

• Data brokers; or

• Other advertising providers.

27. Embedded third-party content
Dear Future does not currently intend to embed third-party social-media feeds, advertising
videos or social plugins that automatically track visitors.

Where external content is introduced, Dear Future may use a click-to-load method so that
the third-party service does not load until:

• The visitor consents; or
• The visitor expressly requests that particular content.

Embedded content may include:

• Videos;
• Maps;
• Audio players;
• Social posts;
• Customer-support widgets; or
• Other external tools.

The relevant provider and purpose must be added to the live cookie inventory before
activation.

28. Address-validation services
Google address validation or another address provider may be used when a visitor asks
Dear Future to validate or complete an address.

The service may receive:

• Address text entered by the visitor;
• Country;
• Technical request information; and
• Selection activity.

Any strictly necessary processing required to return address suggestions may occur when
the visitor actively uses that feature.

Dear Future will not use the address-validation tool to send private Letter text or Call audio
to Google.

29. Consent banner

When consent is required, the first layer of the banner should offer:

• Accept all
• Reject non-essential
• Manage choices

“Reject non-essential” must be clearly visible on the first layer and must not be hidden inside
a paragraph or less accessible than the acceptance option.

The EDPB cookie-banner taskforce found that a large majority of authorities considered the
absence of an effective rejection option alongside acceptance incompatible with valid
consent.

30. Banner design
The banner must not:

• Use pre-ticked analytics or advertising categories;
• Treat continued browsing as consent;
• Treat scrolling as consent;
• Use silence or inactivity as consent;
• Make the reject control difficult to see;
• Use misleading colours or contrast;
• Suggest that non-essential consent is mandatory;
• Block the core website solely because analytics was refused;
• Repeatedly pressure the visitor after refusal; or
• Combine cookie consent with acceptance of the Terms.

Consent requires a clear affirmative act. Silence, inactivity and pre-selected boxes do not
constitute valid consent.

31. Category controls
The preference panel should show separate controls for:

• Strictly necessary;
• Functional;
• Analytics;
• Advertising;
• Embedded content; and
• Email interaction tracking, where relevant.

Strictly necessary should be visibly marked as always active.

Every optional category must be switched off by default before a choice is made.

Where one category contains materially different purposes, the visitor must be given
sufficiently specific choices rather than being asked to accept an excessively broad category.

32. No cookie wall
Visitors must ordinarily be able to:

• Refuse non-essential technologies;
• Continue using the website;
• Create an Order;
• Use support;
• Access privacy information; and
• Manage an existing Order

without accepting analytics or advertising.

The Belgian Data Protection Authority states that access should not be withheld merely
because a visitor refuses non-essential cookies.

A separately requested third-party feature may remain unavailable where it cannot
technically operate without the relevant technology, provided that this is clearly explained
and the rest of the service remains accessible.

33. Recording consent
Dear Future may use a necessary first-party record to remember and demonstrate the
visitor’s choices.

The record may contain:

• Random consent identifier;
• Categories accepted or refused;
• Consent date and time;
• Notice version;
• Banner version;
• Language;
• Country or region used to display the banner;
• Date of withdrawal;
• Updated preference; and
• Limited technical evidence needed to demonstrate the choice.

Dear Future should avoid retaining a full IP address solely as cookie-consent evidence
where a less intrusive record is sufficient.

34. Duration of the consent preference
Dear Future’s cookie-choice record may remain for up to six months.

After that period, Dear Future may ask the visitor to make a new choice.

Dear Future may ask sooner where:

• New providers are introduced;
• A new purpose is introduced;
• Advertising is introduced;
• The consent categories materially change;
• The previous record cannot be verified;
• Applicable law changes; or
• The visitor deletes the preference record.

A visitor who refused non-essential cookies must not be shown the banner on every page
merely to pressure them into reconsidering.

35. Withdrawing or changing consent
A visitor may change or withdraw consent at any time through a permanent:

Cookie Settings

link in the website footer.

Withdrawal must be as easy as giving consent.

After withdrawal, Dear Future will:

• Stop future use of the relevant optional category;
• Update the consent record;
• Prevent relevant tags from firing;
• Delete Dear Future-controlled optional cookies where technically possible; and
• Communicate the updated consent state to relevant providers where supported.

Withdrawal does not make prior lawful processing unlawful.

36. Cookies already stored
Changing a consent choice may not automatically remove every cookie already present in
the browser.

Dear Future’s consent tool should delete Dear Future-controlled optional cookies where
technically possible.

Visitors may also remove cookies through browser settings.

Third-party cookies may need to be deleted through:

• Browser controls;
• Device controls; or
• The third party’s own settings.

37. Browser settings

Most browsers allow a person to:

• View cookies;
• Delete cookies;
• Block cookies;
• Block third-party cookies;
• Clear local storage;
• Use private browsing; or
• Limit tracking.

Blocking all cookies may interfere with:

• Checkout;
• Payments;
• Secure listening;
• Order management;
• Session security;
• Consent preferences; and
• Other essential functions.

Browser settings do not necessarily replace the Dear Future consent panel.

38. Global Privacy Control and similar signals
Where legally required and technically feasible, Dear Future will recognise browser-based
privacy signals such as Global Privacy Control for purposes including:

• Opting out of sale;
• Opting out of sharing;
• Opting out of targeted advertising; and
• Preventing advertising-related processing.

Because Dear Future does not currently sell personal information or use targeted
advertising, such a signal should not materially change the current advertising configuration.

If advertising is introduced, Dear Future must implement applicable signal-recognition
requirements before activation.

A browser signal may not by itself constitute positive consent for analytics.

39. Do Not Track
Browser “Do Not Track” signals are not interpreted consistently across the internet.

Dear Future may treat such signals as an indication of a privacy preference where
technically feasible but does not rely on them as a substitute for:

• The consent banner;

• A Global Privacy Control signal where legally recognised;

• A direct opt-out; or

• A withdrawal submitted through Cookie Settings.

40. Children
Dear Future’s paid services are intended for Customers aged eighteen or older.

Dear Future will not intentionally use optional advertising or profiling technologies to target
children.

An adult may create a Message for a child under the conditions stated in the Global Terms
and Privacy Policy, but this does not authorise advertising profiling of the child.

41. International processing
Cookie and analytics information may be processed in countries including:

• Belgium;
• Germany;
• Other European Economic Area countries;
• The United States; and
• Other countries in which a relevant Service Provider operates.

Where legally required, Dear Future will use an appropriate transfer mechanism, such as:

• An adequacy decision;
• Standard contractual clauses;
• A recognised certification framework;
• Supplementary technical safeguards; or
• Another lawful mechanism.

Additional details appear in the Global Privacy Policy.

42. Retention
Cookie-related information is retained according to its function.

Typical maximum periods are:

• Session security information: until the session ends or shortly afterward;

• Cart information: up to thirty days;

• Consent-choice record: up to six months;

• Google Analytics cookies: no more than thirteen months after Dear Future’s required
  configuration;

• Vercel visitor session hash: Vercel states that it is discarded after twenty-four hours;

• Security and fraud records: as reasonably required for security, fraud prevention or
  legal claims;

• Payment records: for legally required financial periods; and

• Analytics event information: according to the configured analytics-retention period.

The live cookie inventory must display the actual cookie-level expiration periods.

43. Cookie inventory
The live Cookie Settings panel forms part of this Notice.

It must display for each active cookie or similar technology:

• Name;
• Provider;
• Domain;
• Category;
• Purpose;
• Whether it is first-party or third-party;
• Expiration period;
• Whether it is currently active;
• Whether consent is required; and
• A link to relevant provider information where appropriate.

The website must not publish a static cookie inventory that is materially different from the
technologies actually deployed.

44. Cookie scanning
Before launch and after material website changes, Dear Future should perform a technical
scan covering:

• Public pages;
• Checkout;
• Payment pages;
• Order-management pages;
• Recipient notice pages;
• Secure listening;
• Call rescheduling;
• Cancellation pages;
• Support forms; and
• Multiple consent choices.

The scan should verify:

• Which cookies are created before consent;

• Which network requests occur;

• Which local-storage entries are created;

• Whether rejected tags remain blocked;

• Whether withdrawal removes optional technologies;

• Whether private information appears in URLs;

• Whether third-party scripts introduce undeclared technologies; and

• Whether consent persists correctly.

45. Changes to providers
Dear Future may replace or add a provider.

Before activating a new provider that uses non-essential technologies, Dear Future must:

• Review the provider;
• Determine the purpose;
• Determine the legal basis;
• Update the cookie inventory;
• Update the consent categories;
• Obtain new consent where required;
• Review international transfers; and
• Test that refusal remains effective.

A provider must not be introduced silently through a tag-management or deployment update.

46. Changes to this Notice
Dear Future may update this Notice to reflect:

• New technologies;
• New providers;
• New website functions;
• Legal changes;
• Changes to retention;
• Analytics changes;
• Advertising changes; or
• Security improvements.

The updated Notice will show a new date and version.

Where a change introduces a materially new optional purpose, previous consent will not
automatically extend to that purpose.

47. Privacy rights
Depending on applicable law, visitors may have rights to:

• Access personal information;

• Correct inaccurate information;

• Request deletion;

• Restrict processing;

• Object to processing;

• Withdraw consent;

• Opt out of sale or sharing;

• Opt out of targeted advertising;

• Appeal a refused request; and

• Complain to a privacy authority.

Requests may be sent to:

info@dearfuture.ink

48. Contact
Questions about cookies, analytics or consent may be sent to:

Dear Future BV/SRL
Belgium
Email: info@dearfuture.ink