1. DEFINITIONS
Cookies: Small files stored on your device when accessing tofly.pro, including:
First-party cookies: Managed directly by Tofly
Third-party cookies: Controlled by partners (Meta, Google, etc.)
Similar technologies: Pixels, SDKs, localStorage
2. TYPES OF COOKIES AND PURPOSES
Type Purpose Examples
Essential Basic operation Authentication, security
Analytics Traffic measurement Google Analytics, Hotjar
Marketing Personalized advertising Meta Pixel, Google Ads, Taboola
Preferences Experience customization Language, region
3. LEGAL BASIS BY REGION
Region Basis
European Union Explicit consent (ePrivacy Directive + GDPR Art. 6)
Brazil Legitimate interest (LGPD Art. 7º IX) + Consent
United States Opt-out (CCPA/CPRA) + State laws
4. MARKETING COOKIES (DETAILS)
4.1 Platforms used:
Meta (Facebook/Instagram):
Event conversion (pixel)
Creation of custom audiences
Google Marketing Platform:
Remarketing on Search and YouTube
Campaigns on Display Network
Taboola/Outbrain:
Sponsored content on publishers
4.2 Impact of iOS 14.5+ (ATT):
Apple users can block tracking via:
Settings > Privacy > Tracking
5. USER CONTROLS
5.1 Direct management:
Cookie banner:
Accept/reject categories
Preferences panel continuous
Regional tools:
EU: Integrated consent dashboard
USA: “Do not sell my information” link
Brazil: Opt-out option via WhatsApp
5.2 External controls:
Platform Opt-out link
Google adssettings.google.com
Meta facebook.com/adpreferences
Network Advertising Initiative optout.networkadvertising.org
6. DATA RETENTION
Type of Cookie Term
Essential Up to 12 months
Analytics 14 months
Marketing 180 days
7. REGION-SPECIFIC RIGHTS
7.1 European Union (GDPR):
Access to the full list of cookies
Portability of tracking data
Right to object to profiling
7.2 Brazil (LGPD):
Revocation of consent at any time
Request for active cookie report
7.3 States United States:
California (CPRA): Opt-out of “sale” of data via cookies
Virginia (VCDPA): Deletion of unique identifiers
Colorado (CPA): Portability of preferences
8. INTERNATIONAL TRANSFERS
Your cookie data may be processed in:
United States: Under SCCs clauses (EU) and LGPD Art. 33 (BR)
Third countries: With adequacy guarantees (Art. 45 GDPR)
9. UPDATES
Changes to this policy will be:
Notified by banner for 15 days
Recorded in version history
Identified by date in header
10. CONTACTS BY REGION
Region Responsible Contact
European Union Data Controller (DPO) dpo-eu@tofly.pro
Brazil Data Controller (LGPD) dpo-br@tofly.pro
United States Privacy Officer privacy-us@tofly.pro
To exercise your rights: Access the User Cookie Panel or contact our regional officer.