Cookie Notice
Last updated: July 23, 2026 · Effective: July 23, 2026
Introduction and Scope
This Cookie Notice (the "Notice") explains how and why LULULAB, Inc. ("LULULAB", "we", "us" or "our") uses cookies and other similar technologies ("Tracking Technologies") on:
- our corporate website at www.lulu-lab.com;
- our operator admin portal at luskinx-admin.lululab-platform.com;
- the lulu-at website and mobile applications; and
- any other webpage or application linking to this Notice
(collectively, the "Website").
We use Tracking Technologies to allow the Website to operate, to increase its functionality and efficiency, to analyse how you use it so we can improve it, to tailor the content we display to you, and to fulfil other purposes described below.
To the extent that information collected by the Tracking Technologies, either on its own or in combination with other information, constitutes Personal Data as defined in our Privacy Notice, both our Privacy Notice and this Notice apply to the processing of that Personal Data.
This Notice does not cover the Luskin X clinic device, the Luskin Kiosk self-service kiosk, or the Luskin SDK. These are device-based or third-party-app-based products that do not use browser-based Tracking Technologies. The handling of personal data within those products is covered by our Privacy Notice (Parts A, B and C).
Cookies and Other Tracking Technologies
Cookies. A cookie is a small text file stored on your device (computer, phone, tablet) that contains information about your browser and online activity. This information often consists of a string of numbers and letters that uniquely identifies your device.
We may also use:
Local Storage. Local storage enables our Website to store information locally on your device. We use it to improve your experience, remember your preferences and speed up Website functionality.
Pixels. A tracking pixel is a 1×1 pixel graphic used to track user behaviour and Website traffic. It allows us to collect data relating to your use of our Website.
Mobile-app identifiers and SDKs. In our mobile applications (e.g. lulu-at), we may use similar tracking technologies including device identifiers (such as IDFA on iOS, AAID on Android), local app storage, and analytics or crash-reporting SDKs.
Other similar tracking technologies. We may also use other technologies for similar purposes as described in this Notice.
All of the above are referred to as "Tracking Technologies" in this Notice.
How We Respond to Do Not Track Signals and Global Privacy Control
"Do Not Track" (DNT) and "Global Privacy Control" (GPC) are optional browser settings you can use to express your preferences regarding tracking. Our Website does not currently respond to DNT signals. Where GPC is recognised by applicable law in your jurisdiction, we respect GPC signals and treat them as a withdrawal of consent for non-essential Tracking Technologies.
Your Consent
When you first visit the EU/EEA-facing parts of our Website, we present a cookie consent banner that asks which categories of Tracking Technologies you wish to allow. Strictly necessary Tracking Technologies are always active because the Website cannot function without them. All other categories — performance, functional, and (if used) targeting — are loaded only after you give consent.
You can change your consent at any time by clicking the cookie settings link in the footer of any page of our Website. Changing your settings only affects future processing; it does not affect Tracking Technologies that operated before you changed your settings.
Opting Out
You can alter your browser configuration to reject certain types of Tracking Technologies, including cookies. If you reject certain cookies, you may not be able to access or use all features of our Website. For more information on managing cookies, please visit https://www.aboutcookies.org/.
You can also control online behavioural advertising preferences and opt out from having your data processed by certain marketing companies by visiting http://www.youronlinechoices.com/ (operated by the European Interactive Digital Advertising Alliance). Managing these preferences will not turn off internet advertisements entirely; it means the advertisements you see will be less tailored to your browsing activity. Opt-out preferences set through these tools may also be cleared if you delete your cookies.
Types of Cookies
We use session cookies and persistent cookies on our Website. Session cookies are deleted when you close your browser. Persistent cookies may remain on your device after you close your browser but have an expiration date.
Some cookies are first-party cookies, placed directly by LULULAB. Others are third-party cookies, placed by other parties (such as our service providers) through our Website. In the tables below we identify each cookie's provider and link to the applicable third-party privacy notice where possible.
How We Use Tracking Technologies on Our Website
Strictly Necessary Tracking Technologies
These Tracking Technologies are necessary for our Website to function. You may set your browser to block or alert you about these, but if you do, some parts of our Website will not work. These do not require your consent.
| Name | Provider and Privacy Notice | Purpose | Duration | Opt-out |
|---|---|---|---|---|
| cookie_consent | LULULAB (first-party cookie) | Stores your cookie consent preferences so the consent banner is not shown again on each visit. | 1 year | None |
| PHPSESSID | LULULAB (first-party — lulu-lab.com) | Maintains your session on the corporate website so pages and boards function correctly. | Session | None |
| Randomised-name session cookies (x2) | LULULAB (first-party — lulu-lab.com) | Session cookies set by the website's content-management platform to support page and board functionality. | Session | None |
| __client_uat (and instance-suffixed variants) | Clerk, Inc. (first-party — lulu-at.com) — Privacy Notice | Records whether you are signed in so the lulu-at platform can manage your authentication state. | Up to 1 year | None |
| __clerk_db_jwt (and variants), __client | Clerk, Inc. (set via clerk.lulu-at.com) — Privacy Notice | Authentication tokens that keep your lulu-at sign-in session secure. | Session / up to 1 year | None |
| __cf_bm | Cloudflare, Inc. (set by clerk.lulu-at.com, img.clerk.com and supabase.co) — Privacy Notice | Distinguishes people from automated traffic so the sign-in and content services stay protected and available. | Session | None |
| _cfuvid | Cloudflare, Inc. (set via clerk.lulu-at.com) — Privacy Notice | Supports rate-limiting so the authentication service remains available. | Session | None |
Performance Tracking Technologies
These help us understand how visitors use our Website so we can measure and improve its performance. Loaded only after you give consent.
| Name | Provider and Privacy Notice | Purpose | Duration | Opt-out |
|---|---|---|---|---|
| _ga | Google LLC (third-party cookie) — Privacy Notice | Registers a unique ID used to generate statistical data on how the visitor uses the Website. | 1 year | tools.google.com/dlpage/gaoptout |
| _ga_XXXXXXXXXX | Google LLC (third-party cookie) — Privacy Notice | Google Analytics 4 cookie that stores and counts session information. Set on lulu-lab.com and lulu-at.com. | 1 year | tools.google.com/dlpage/gaoptout |
| ph_phc_* | PostHog, Inc. (first-party — lulu-at.com) — Privacy Notice | Product-analytics identifier used to measure how visitors use the lulu-at platform; related session-replay configuration is stored in local storage. | 1 year | |
| dmn_chk_* | PostHog, Inc. — Privacy Notice | Checks domain configuration for PostHog analytics. | Session |
Functional Tracking Technologies
These enable enhanced functionality and personalisation. Loaded only after you give consent.
| Name | Provider and Privacy Notice | Purpose | Duration | Opt-out |
|---|---|---|---|---|
| NEXT_LOCALE | LULULAB (first-party — lulu-at.com) | Stores your preferred language so lulu-at displays in your chosen language. | 1 year | |
| muxData | Mux, Inc. (first-party — lulu-at.com) — Privacy Notice | Remembers video-player preferences and measures playback performance for embedded videos. | 1 year |
Targeting Tracking Technologies
Embedded YouTube videos on the lulu-at platform set the following targeting Tracking Technologies from youtube.com. These load only after you give consent to targeting Tracking Technologies; if you decline, embedded videos may not play until loaded manually. We do not otherwise use advertising technologies, and we do not share your personal data with advertisers or data brokers, or use it to build advertising profiles.
| Name | Provider and Privacy Notice | Purpose | Duration | Opt-out |
|---|---|---|---|---|
| VISITOR_INFO1_LIVE | Google LLC (YouTube, third-party) — Privacy Notice | Estimates bandwidth and recognises the user across embedded YouTube videos. | 5 months | adssettings.google.com |
| YSC | Google LLC (YouTube, third-party) — Privacy Notice | Registers a unique ID to keep statistics of which YouTube videos the user has seen. | Session | adssettings.google.com |
| SOCS | Google LLC (YouTube, third-party) — Privacy Notice | Stores the user's cookie-consent state for Google services. | 1 year | adssettings.google.com |
| __Secure-YNID, __Secure-YENID, __Secure-YEC, __Secure-ROLLOUT_TOKEN, VISITOR_PRIVACY_METADATA | Google LLC (YouTube, third-party) — Privacy Notice | Additional YouTube identifier and configuration cookies set by embedded videos. | Session to 1 year | adssettings.google.com |
Changes to this Notice
If we make any material change to this Notice, we will post the revised Notice on our Website and update the "Effective date" above. Where the change materially affects the categories of Tracking Technologies used, we will re-prompt the cookie consent banner.
Contact Us
If you have any questions about this Notice, please contact us:
- Email: privacy@lulu-lab.com
- Postal mail: LULULAB, Inc., 13F (T Floor), 318 Dosan-daero, Gangnam-gu, Seoul, South Korea (Attention: Data Protection Officer)
You can also contact our Data Protection Officer (VeraSafe) and our EU representative — see Privacy Notice Section 14.
Please allow up to four (4) weeks for us to reply.