Last Updated: September 30, 2026

This Cookie Policy explains how BODYWISE LLC, doing business as MySpaList (“MySpaList,” “we,” “us,” or “our”), uses cookies and similar technologies when you visit myspalist.com (the “Website”).

This Cookie Policy should be read together with our Privacy Policy, which explains more broadly how we collect, use, disclose, and protect personal information.

1. What Are Cookies?

Cookies are small text files that websites place on your computer, phone, tablet, or other device when you visit them.

Cookies can help a website work correctly, remember your choices, understand how visitors use the website, and measure advertising.

Some cookies are placed directly by MySpaList or by services operating on our behalf. Other cookies may be placed by third-party services used on the Website.

Some cookies remain only while your browser is open (“session cookies”). Others remain on your device for a set period or until you delete them (“persistent cookies”).

2. How We Use Cookies

We use cookies and similar technologies to:

• operate and secure the Website;
• maintain user sessions and shopping-cart functionality;
• remember your cookie preferences;
• understand how visitors reach and use the Website;
• measure Website traffic and performance;
• attribute orders and conversions; and
• measure the effectiveness of advertising.

Where applicable law requires consent before a cookie or similar technology is used, we will not activate that technology until you provide the required consent.

Strictly necessary cookies may be used without consent where permitted by applicable law because they are required to provide a service you request or to operate essential Website functions.

For EU/EEA users, this distinction follows the ePrivacy framework: storing or accessing information on a user’s device generally requires consent unless the technology is strictly necessary for the requested service.

3. Types of Cookies and Tracking Technologies We Use

The tables below describe the cookies and/or other tracking technologies currently identified on the Website.

3.1 Strictly Necessary Cookies

These cookies are required for core Website functions, including security, authentication, shopping-cart functionality, load balancing, API security, and remembering your cookie choices.

They cannot generally be switched off through our cookie preference tool because the Website or a service you request may not function correctly without them.

Cookie	Provider	Purpose	Duration
__cf_bm	Cloudflare, Inc.	Bot management and protection against automated traffic.	~30 minutes
cf_clearance	Cloudflare, Inc.	Stores the result of a security challenge so legitimate visitors are not repeatedly challenged.	~1 year
__cflb	Cloudflare, Inc.	Load balancing and routing requests to a consistent server.	~1 day
wp_woocommerce_session_*	WooCommerce	Connects a visitor with their shopping-cart and session information.	~2 days
woocommerce_cart_hash	WooCommerce	Detects changes to cart contents.	Session
woocommerce_items_in_cart	WooCommerce	Indicates whether the shopping cart contains items.	Session
wfwaf-authcookie-_*	Wordfence	Helps the Website firewall identify authenticated users and their permissions for security purposes.	12 hours
wordpress_logged_in__*	WordPress	Maintains a logged-in user’s authenticated session.	~15 days
wordpress_sec__*	WordPress	Supports secure authentication for logged-in WordPress users.	~15 days
cookieyes-consent	CookieYes	Remembers cookie-consent choices.	~1 year
wp_api	Automattic, Inc.	Supports communication with the WordPress.com Public API.	Session
wp_api_sec	Automattic, Inc.	Protects and authenticates requests to the WordPress.com Public API.	Session

3.2 Functional and Order Attribution Cookies

These cookies support Website features and help us understand how a visitor arrived at the Website in connection with an order.

Cookie	Provider	Purpose	Duration
sbjs_current, sbjs_current_add	WooCommerce / Sourcebuster.js	Records the current session’s traffic source, such as a referring website or UTM parameters, for order attribution.	Session
sbjs_first, sbjs_first_add	WooCommerce / Sourcebuster.js	Records the visitor’s first traffic source and may associate it with an order at checkout.	Session
sbjs_session, sbjs_udata, sbjs_migrations	WooCommerce / Sourcebuster.js	Supports session and device metadata used for order attribution.	Session / ~1 day

Functional and order attribution cookies will be used only after consent where applicable law requires prior consent.

3.3 Analytics Cookies

Analytics cookies help us understand how visitors use the Website and measure Website traffic.

Cookie	Provider	Purpose	Duration
tk_ai, tk_lr, tk_or, tk_r3d	Automattic, Inc. / Jetpack / WordPress.com Stats	Used for visitor identification and landing/referrer-page tracking to generate Website traffic statistics.	1 year
_ga	Google LLC / Google Analytics	Distinguishes unique visitors by assigning a randomly generated identifier, used to compile aggregated Website usage statistics.	~13 months
_ga_2J2DV0X974	Google LLC / Google Analytics (GA4)	Persists session state and measurement data for the site's GA4 property.	~13 months

Analytics cookies will be used only after consent where applicable law requires prior consent.

3.4 Advertising and Targeting Cookies

These cookies help measure advertising campaigns and attribute Website activity to advertising interactions.

Cookie	Provider	Purpose	Duration
_gcl_au	Google LLC / Google Ads	Helps attribute Website conversions, such as purchases or sign-ups, to Google Ads interactions.	~90 days

Advertising and targeting cookies will be used only after consent where applicable law requires prior consent.

3.5 Local Storage

In addition to cookies, the Website uses browser local storage for similar purposes. A current list is set out in the table above. Local storage items used for advertising or on-site targeting purposes will be used only after consent where applicable law requires prior consent.

Local Storage	Provider	Purpose	Duration
_gcl_ls	Google LLC / Google Ads	Companion to the _gcl_au cookie; stores click-ID data supporting Google Ads conversion attribution.	Until cleared
elementor	Elementor	Tracks page-view and session counts client-side to control the display timing of on-site pop-ups/promotions (Elementor's built-in popup display-conditions feature).	Until cleared

4. Your Cookie Choices

You can control cookies and similar technologies in several ways.

4.1 Device Settings

Your computer, phone, tablet, or other device may provide privacy settings that allow you to limit certain forms of tracking or reset identifiers associated with your device.

The available controls depend on your device and operating system. Please review the privacy settings provided by your device manufacturer or operating-system provider.

Changing device settings does not necessarily remove cookies already stored in your browser. You may need to use your browser settings or our cookie preference tool separately.

4.2 MySpaList Cookie Preference Tool

When you visit the Website, our cookie banner allows you to make choices about non-essential cookies where consent is required.

You can:

• accept non-essential cookies;
• reject non-essential cookies; and
• select which categories of non-essential cookies you allow.

You can change your choices and withdraw previously provided consent at any time through the Consent Preferences Button on the Website.

Withdrawing consent does not affect processing that occurred before you withdrew it.

4.3 Browser Settings

Most browsers allow you to view, delete, block, or otherwise control cookies through their settings.

You can find cookie controls in the settings or privacy sections of commonly used browsers, including:

• Google Chrome;
• Mozilla Firefox;
• Apple Safari;
• Microsoft Edge; and
• Opera.

Your browser may allow you to block all cookies, block third-party cookies, delete existing cookies, or receive a warning before cookies are stored.

Blocking all cookies may affect some Website functions. For example, authentication, shopping-cart, security, or preference functions may not work correctly if cookies required for those functions are disabled.

Browser controls operate separately from the MySpaList cookie preference tool. Changing your browser settings therefore may not change the consent choice stored by our cookie preference tool, and changing your cookie preferences on the Website may not delete cookies already stored on your device.

5. Consent and Withdrawal of Consent

Where applicable law requires consent for non-essential cookies or similar technologies, we request that consent through our cookie preference tool before activating those technologies.

You can refuse non-essential cookies without losing access to the basic Website.

You can also change your preferences or withdraw your consent at any time as described in Section 4.

Strictly necessary cookies are not subject to these consent controls where applicable law permits them to be used without consent.

For EU/EEA visitors, non-essential access to or storage of information on a user’s device generally requires consent, while technically necessary technologies are exempt.

6. United States Users

Based on the Company's current operations and information available to us, MySpaList does not currently meet the applicable statutory thresholds that would make it subject to comprehensive U.S. state consumer privacy laws that apply based on revenue or data-processing volume thresholds (including, for example, the California Consumer Privacy Act (CCPA/CPRA)).

Separately, applicability of the Texas Data Privacy and Security Act (TDPSA) and the Nebraska Data Privacy Act (NDPA) turns on whether the business qualifies as a "small business" under U.S. Small Business Administration (SBA) size standards. MySpaList currently qualifies as a "small business" under the SBA's size standards and is therefore not subject to the general obligations of the TDPSA or the NDPA at this time. Notwithstanding this exemption, MySpaList does not sell sensitive personal data, consistent with the one obligation that applies to small businesses under each of these laws.

Accordingly, this Cookie Policy does not represent that MySpaList currently provides rights or opt-out mechanisms solely because they are required by those state comprehensive privacy laws.

If MySpaList's operations, processing activities, revenue, employee count, or number of consumers meeting applicable statutory criteria change, including any change to its small-business status under the SBA's size standards, we may update our practices and this Cookie Policy as required by applicable law.

7. Users Outside the United States

MySpaList may be accessed by users in jurisdictions including the European Union/European Economic Area, Brazil, Singapore, China, India, and others.

Where local law imposes specific requirements on the use of cookies or similar technologies, we apply the relevant requirements to users to whom those laws apply.

More information about how MySpaList processes personal information, the legal bases for processing, international transfers, individual privacy rights, and how to exercise those rights is provided in our Privacy Policy.

8. Third-Party Services

Some cookies and similar technologies used on the Website are provided by third parties, including service providers identified in Section 3.

Those providers may process information according to their own privacy policies and contractual arrangements with MySpaList.

For more information about third parties that process personal information in connection with the Website, please see our Privacy Policy.

9. Changes to This Cookie Policy

We may update this Cookie Policy when our use of cookies or similar technologies changes or when necessary to reflect legal, regulatory, or operational changes.

When we update this Cookie Policy, we will change the “Last Updated” date at the top of the policy.

Where required by applicable law, we will request new consent if we introduce materially different uses of cookies that require consent.

10. Contact Us

If you have questions about this Cookie Policy or our use of cookies and similar technologies, contact us at:

BODYWISE LLC
Email: hello@myspalist.com
Phone number: +1 212 592-0128