Cookie Notice
Effective from 2 November 2026, until withdrawn.
Operator: Virágszekér Kft. (Envelopio), 2700 Cegléd, Külső-Jászberényi út 2., Hungary, company registration number 13-09-178324, [email protected]. This notice is part of the Privacy notice.
1. What are cookies, and when do we ask for consent?
A cookie is a small file stored by your browser. Similar techniques are included: the local storage of the browser (localStorage, sessionStorage) and measuring scripts. We do not ask for consent only for storage that is strictly necessary (Article 5(3) of Directive 2002/58/EC, as implemented in the law of your country), with one exception: if you arrive from an ad link, we keep the campaign signals of the link (bk-nyito) in the browser until the tab is closed, and pass them on only after your consent (see the table). Everything else is loaded only if you consented before.
2. Managing your consent
- On your first visit a bar appears at the bottom of the page. The “Accept” and “Reject” buttons have the same size and weight; next to them, “Settings” switches each category. No category is ticked in advance, and scrolling is not consent.
- Categories: Necessary (always active) · Statistics (Google Analytics and Microsoft Clarity) · Marketing (Meta Pixel). The categories can be switched independently; Marketing is active only if you accept it separately (“Accept” switches both on). If the list changes, we ask everybody again.
- Withdrawal and change: at any time, through the “Cookie settings” link in the footer, as easily as giving it. When you withdraw, we delete the cookies of the measuring code and the page reloads.
- Logging: to prove your consent we record a random identifier, the categories chosen, the version of the text and the time (without name, e-mail address and IP address), for 2 years.
- Asking again: after 12 months, or if the cookie list changes materially.
- Google Consent Mode v2, basic mode: the Google and Clarity measuring code is not loaded at all before consent; Clarity also receives the consent with its own signal (consent v2). When loaded, every signal defaults to
denied, and only the category you chose is allowed. - Consent manager: our own development. If we start Google Ads in future, we switch to the certified consent manager that Google expects.
- Language: the bar and this notice are shown in the language of the website version you use.
3. Cookie list
| Category | Provider | Cookie / storage | Purpose | Lifetime | Consent |
|---|---|---|---|---|---|
| Necessary | Envelopio | bk-suti (localStorage) | stores your cookie choice | 12 months | not needed |
| Necessary | Envelopio | bk_mm (cookie) | login to the account | until the browser is closed; 30 days with “Keep me logged in” | not needed |
| Necessary | Envelopio | access code cookie on the invitation (one per invitation) | so a guest need not type the code again | 180 days | not needed |
| Necessary | Envelopio | bk_aj_eszkoz (cookie, only when reserving from the gift list of an invitation) | random identifier of the reserving device, so the reservation can be cancelled from the same device | 400 days | not needed |
| Necessary | Envelopio | bk_album_eszkoz (cookie, only on the shared photo album page) | random identifier of the uploading device: for the upload limit and so a guest sees their own uploads | 400 days | not needed |
| Necessary | Envelopio | boritekom-vazlat-v5, bk-tervezo, bk-ulesrend (localStorage) | editing and the planner tools without logging in | until deleted | not needed |
| Necessary | Envelopio | bk-belepve, bk-kedvencek, bk-kosar-extrak, bk-ulesrend-nyomtat (localStorage) | remembers the header state, favourites, cart and print settings | until deleted | not needed |
| Necessary | Envelopio | bk-evszak, bk-gorget:*, bk-kod, bk-kep-* (sessionStorage) | the chosen season, the scroll position when going back, the typed discount code, photos uploaded without logging in | until the tab is closed | not needed |
| Necessary | Envelopio | language and country choice (browser storage) | remembers the language and country you chose | in your browser’s storage until you delete it | not needed |
| Statistics | Google (GA4) | _ga, _ga_<ID of the data stream> | measuring visits, without name and e-mail; IP anonymisation, Google Signals switched off | 13 months | needed |
| Statistics | Microsoft (Clarity) | _clck, _clsk; on the clarity.ms domain CLID, MUID and short-lived technical cookies | summarising and recording visits anonymously (clicks, scrolling, mouse movement), heat map; without typed text | _clck 1 year, _clsk 1 day, CLID/MUID 1 year | needed |
| Marketing | Meta (Pixel) | _fbp, _fbc | measuring our Facebook and Instagram ads: after which ad you looked at an invitation, put it in the cart or bought | 90 days | needed |
| Statistics | Envelopio | bk-mert-* (localStorage), bk-m-* (sessionStorage) | so that a purchase or an event is measured only once | until deleted / until the tab is closed | needed (created only after consent) |
| Statistics, marketing | Envelopio | bk-nyito (sessionStorage) | if you arrived from an ad link: the campaign signals (utm_*), the address of the referring site and Meta’s click identifier (fbclid), so that the source of the visit is not lost if you accept measuring on a later page. It does not identify you and leaves the browser only after consent: the campaign signals go to Google (Statistics), the click identifier to Meta as an _fbc cookie (Marketing) | until the tab is closed | created in the browser before the decision; passed on only with consent |
Server-side counting without cookies. If you open a page from an ad link (with UTM signals), our server increases the day’s count for those campaign signals. We use no cookie for it and do not store the IP address, browser identifier or click identifier: only the public campaign signals of the link and the daily count. On the invitation pages there is none of this either.
Payment takes place on Stripe’s own page (checkout.stripe.com); Stripe’s notice applies to the cookies used there.
4. Important limits
- On the invitation pages (for guests) there is no Google Analytics, Clarity, pixel or any measurement. There, the couple is the controller, the guests are not our customers, and health data (food allergy) may be present.
- Measured events (in Google Analytics with the Statistics consent, in the Meta Pixel with the Marketing consent; the same events for both): page view; view of the invitation lists and of one invitation; trying with your own names; start of editing; adding to and removing from the cart; view of the cart; use of a discount code; start of payment; a successful purchase (order identifier, amount, currency, items); use of a planner; sharing of the invitation link; sending a review; contact (e-mail, telephone). We send no personal data (name, e-mail address, the content of the invitation) to the measuring codes: Meta’s Advanced Matching and the Pixel’s automatic data collection are switched off, and there is no server-side event sending (Conversions API).
- Google Analytics keeps event data for 14 months (the GA4 retention setting) and then deletes it automatically.
- Microsoft Clarity: in the recordings, typed text and the text of pages are masked (“Strict” mode); on the pages of the account, cart, editor, payment, planners, login and registration the whole content stays hidden. Clarity keeps the recordings for 30 days and the aggregated heat map data for at most 13 months. Only we watch the recordings, to find errors and parts that are hard to use.
- Meta Pixel, joint controllership: for collecting Pixel data and passing it to Meta, Envelopio and Meta Platforms Ireland Ltd. are joint controllers (Article 26 GDPR; under Meta’s “Controller Addendum”). Meta may use the data under its own privacy policy, also for advertising: https://www.facebook.com/privacy/policy. If you withdraw the Marketing consent, the Pixel is not loaded any more and we delete the
_fbp/_fbccookies. - Transfer to third countries: Google LLC, Microsoft Corporation and Meta Platforms, Inc. are certified under the Data Privacy Framework (Article 45 GDPR).
5. How can you block them in the browser?
In your browser settings you can delete or block cookies and stored data. If you block the necessary cookies, login, cart, payment and the Editor do not work.
6. Contact, remedies
[email protected] · supervisory authorities: see point 14 of the Privacy notice.