Cookie Policy

1. What This Policy Covers

This Cookie Policy explains what cookies and similar tracking technologies are, how Corestack Digital Ltd uses them on the TDolls platform (including TDolls.net, TDolls.eu, TDolls.uk, and Proxima by TDolls — together the "Platform"), and how you can manage your preferences.

This policy should be read alongside our Privacy Policy, which explains how we handle your personal data more broadly. Where cookies collect or process personal data, the Privacy Policy also applies.

References to "we", "us", or "our" mean Corestack Digital Ltd, a company registered in Gibraltar and trading under the name TDolls at TDolls.net, TDolls.eu, and TDolls.uk, acting as data controller. Our supervisory authority for data protection is the Gibraltar Regulatory Authority (GRA).

2. What Cookies Are

Cookies are small text files placed on your device — computer, phone, or tablet — when you visit a website. They are widely used to make websites work, to work more efficiently, and to provide information to site operators.

Cookies are not programs and cannot carry viruses or malware. They cannot access other files on your device.

Similar technologies we may use alongside cookies include:

• Local storage and session storage — browser-based storage that functions similarly to cookies but is not transmitted with every request
• Device fingerprinting — a method of identifying a device based on its technical characteristics, used for fraud prevention at registration (described in our Privacy Policy)
• Pixel tags / web beacons — tiny invisible images embedded in pages or emails that register when content has been accessed

Where we refer to "cookies" in this policy, the same principles apply to these similar technologies unless stated otherwise.

3. How We Obtain Your Consent

Because the Platform hosts adult content, we operate a two-stage access model:

Before registration and age verification (SFW / unverified visitors): Only strictly necessary cookies are set. No consent is required for these. A cookie banner is displayed explaining this and offering you the option to manage preferences before you proceed.

At registration: You are presented with our cookie preference centre as part of the signup flow. Your choices are recorded alongside your consent record. Analytics and functional cookies are only activated if you consent.

After login (verified users): Your saved cookie preferences are applied automatically. You can change them at any time via the cookie preference centre in the Platform footer.

We do not use a "consent by continued browsing" model. Consent for non-essential cookies requires a positive action — ticking a checkbox or clicking an accept button. Refusing non-essential cookies has no effect on your ability to use the core Platform.

4. Categories of Cookies We Use

4.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They cannot be switched off. They are set in response to actions you take — such as logging in, filling in forms, or setting your privacy preferences.

No consent is required for strictly necessary cookies under applicable law. They do not store any personally identifiable information beyond what is operationally necessary.

4.2 Functional Cookies

These cookies enable enhanced functionality and personalisation. They may be set by us or by third-party providers whose services we have integrated. Refusing them may affect your experience but will not prevent access to the Platform.

Functional cookies are only set with your consent.

4.3 Analytics Cookies

These cookies help us understand how the Platform is used — which pages are visited, how long users spend on them, where they come from, and where they leave. This helps us improve the Platform.

Analytics cookies are only set with your consent. The data collected is aggregated and used for statistical analysis; it is not used to identify you individually.

Google Tag Manager

We use Google Tag Manager (GTM), provided by Google Ireland Limited, to load and manage the tags and analytics scripts used on the Platform (including Google Analytics, described below). GTM itself is a tag-loading container — it does not collect analytics data on its own — but it does set a small number of first-party cookies to operate the loader and de-duplicate page-view requests.

Tags loaded through GTM honour the Google Consent Mode v2 signals we set on every page (see Google Analytics below): when you decline a category, tags in that category stop setting identifier cookies and stop sending personal data. Some tags continue to send anonymised, cookieless signals to support aggregated reporting — this is the documented Consent Mode v2 behaviour and is consistent with UK PECR and EU ePrivacy. Withdrawing consent in the cookie preference centre takes effect immediately.

Google Analytics

We use Google Analytics 4 (GA4), provided by Google Ireland Limited, to analyse Platform usage. GA4 is loaded via the canonical gtag.js snippet on every page. We implement Google Consent Mode v2 (Advanced): the snippet starts in a denied state for visitors in the United Kingdom, Switzerland, and the European Economic Area, and only sets the _ga / _gid identifier cookies after you accept analytics cookies in our preference centre. Until then, no identifier cookies are set and no personal data is collected.

While consent is declined, Google may still receive anonymised, cookieless signals from the Platform (containing no identifiers, no cookies, and no information that could be used to recognise you) to support aggregated reporting and conversion modelling. This is part of Google's Consent Mode v2 framework, complies with UK PECR and EU ePrivacy transparency requirements, and is the same mechanism used by major Consent Management Platforms across the EEA.

Visitors outside the United Kingdom, Switzerland, and the EEA receive full GA4 measurement from their first page-view, because their jurisdiction does not require an opt-in for analytics cookies. Those visitors can still review and change their preferences via the cookie settings link in the site footer at any time.

GA4 is also available through the Google Tag Manager container described above for any operator-configured tag-level conditions.

Google Analytics data is processed by Google in accordance with Google's privacy policy, available at policies.google.com/privacy. We have enabled IP anonymisation in our GA4 configuration, meaning your full IP address is not stored by Google.

We have entered into a Data Processing Agreement with Google for our use of Google Analytics. Data may be transferred to Google servers outside Gibraltar and the EEA. Google relies on Standard Contractual Clauses for such transfers.

We do not use Google Analytics advertising features, including remarketing, demographic and interest reporting, or Google signals.

Contentsquare

We use Contentsquare, provided by Contentsquare SAS (France), to understand user behaviour through heatmaps, session recordings, and experience analytics. Contentsquare records interactions such as mouse movements, clicks, scrolling, and form-field engagement to help us identify usability issues and improve the Platform.

Important note on Contentsquare and sensitive content:Contentsquare session recordings are configured to automatically suppress all form field content (passwords, personal information entered during registration, and any content within age-verified areas of the Platform). We have enabled Contentsquare's default masking rules across all pages containing sensitive or adult content. Session recordings capture interaction patterns — not the content of what is typed or viewed.

Contentsquare data is processed in accordance with Contentsquare's privacy policy, available at contentsquare.com/privacy-center. We have entered into a Data Processing Agreement with Contentsquare SAS.

Hotjar

We use Hotjar, provided by Hotjar Ltd (Malta), to understand user behaviour through heatmaps and session recordings. Hotjar records interactions such as mouse movements, clicks, and scrolling to help us identify usability issues and improve the Platform.

Important note on Hotjar and sensitive content:Hotjar session recordings are configured to automatically suppress all form field content, including passwords, personal information entered during registration, and any content within age-verified areas of the Platform. We have implemented Hotjar's suppress text and suppress recording features across all pages containing sensitive or adult content. Session recordings only capture interaction patterns — not the content of what is typed or viewed.

Hotjar data is processed in accordance with Hotjar's privacy policy, available at hotjar.com/legal/policies/privacy. We have entered into a Data Processing Agreement with Hotjar Ltd.

4.4 Marketing and Personalisation Cookies

We do not currently use marketing or advertising cookies on the Platform. We do not operate retargeting campaigns and do not share data with advertising networks.

If this changes, we will update this policy, add the relevant cookies to this section, and request fresh consent from existing users before any marketing cookies are set.

5. Third-Party Cookies

Some cookies on the Platform are set by third parties whose services we use. We do not control the cookies set by third parties, and their use is governed by those third parties' own privacy and cookie policies.

The third parties whose cookies may be present on the Platform are:

We will update this table as we add or remove third-party services.

6. Cookies and the Age Gate

The Platform uses an age gate to prevent access to age-restricted content by unverified visitors. The age_gate cookie is a strictly necessary cookie that records that you have completed age verification for the current browser session.

This cookie does not replace our formal age verification process — it is a session-level record only. If you clear your cookies, close your browser, or access the Platform from a different device, you will be required to log in again. The underlying age verification record is held in your account, not in the cookie.

We do not use cookies as the sole mechanism for age verification. Cookies are a convenience layer on top of our account-based verification system.

7. Managing Your Cookie Preferences

7.1 Cookie Preference Centre

You can view and change your cookie preferences at any time by clicking "Cookie preferences" in the footer of any page on the Platform. The preference centre allows you to:

• Accept or refuse functional cookies
• Accept or refuse analytics cookies (Google Tag Manager, Google Analytics, Contentsquare, and Hotjar — GTM tags are gated by the same consent toggle as Google Analytics)
• Review which cookies are currently active on the Platform

Changes take effect immediately. If you withdraw consent for a category of cookies, those cookies will be removed from your browser within the current session.

Your preferences are saved for 12 months. After this period, we will ask you to confirm your preferences again.

7.2 Browser Settings

Most browsers allow you to control cookies through their settings. You can typically:

• View cookies currently stored on your device
• Delete some or all stored cookies
• Block cookies from specific websites
• Block all third-party cookies
• Set your browser to notify you when a cookie is being set

The process for doing this varies by browser. Guidance is available from your browser provider:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Please note that blocking all cookies through browser settings will affect the functionality of the Platform, including your ability to stay logged in.

7.3 Opting Out of Google Analytics

You can opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.

7.4 Opting Out of Hotjar

You can opt out of Hotjar tracking across all websites by visiting hotjar.com/legal/compliance/opt-out and following the instructions there.

7.5 Opting Out of Contentsquare

You can opt out of Contentsquare tracking across all websites by visiting contentsquare.com/optout/ and following the instructions there. The opt-out sets a_cs_optout cookie in your browser. You can also refuse Contentsquare cookies through our cookie preference centre at any time, which will block further data collection on the Platform.

7.6 Do Not Track

Some browsers transmit a Do Not Track (DNT) signal to websites. We capture the DNT signal at registration as part of our technical environment record (described in our Privacy Policy). We honour DNT signals for analytics and non-essential cookies where technically feasible. Strictly necessary cookies are unaffected by DNT signals.

8. Cookie Consent and Gibraltar Law

Our use of cookies is governed by the Gibraltar GDPR and the Gibraltar ePrivacy framework, administered by the Gibraltar Regulatory Authority (GRA). The legal framework for cookie consent in Gibraltar is materially equivalent to the EU ePrivacy Directive and GDPR requirements.

Under this framework:

• Strictly necessary cookies do not require consent
• All other cookies require freely given, specific, informed, and unambiguous consent before being set
• Consent must be as easy to withdraw as it is to give
• Refusing consent must not result in denial of service or degraded access to core functionality
• Cookie consent records must be retained for audit purposes

Our cookie consent mechanism has been designed to comply with these requirements. Consent records, including the timestamp, cookie categories accepted, and the version of this policy shown, are retained as part of your registration consent record.

9. Retention of Cookies and Cookie Records

Individual cookies expire on the timescales listed in Section 4. When a cookie expires, it is automatically deleted from your browser.

Cookie consent records (the record of what you agreed to and when) are retained in our systems for the duration of your account plus 6 years after account closure, in line with our general data retention policy. This is a compliance record and is not subject to deletion on request.

10. Changes to This Policy

We review this Cookie Policy regularly and update it when we add, change, or remove cookies or tracking technologies. When we make changes we will:

• Update the "Last updated" date and version number at the top of this document
• Display a notification on the Platform where changes are material
• Where new consent-based cookies are introduced, present the updated preference centre to existing users before those cookies are set

The current version of this policy is always available at tdolls.net/cookies, tdolls.eu/cookies, and tdolls.uk/cookies.

11. Contact Us

If you have any questions about our use of cookies or this policy, please contact us:

If you are unhappy with how we handle cookies and wish to make a complaint, you can contact the Gibraltar Regulatory Authority:

This document is version TDOLLS-CP-v1.3. The current version is always available at tdolls.net/cookies, tdolls.eu/cookies, and tdolls.uk/cookies.