Here is every piece of data this site touches when you visit: your IP address, your approximate city, the pages you view, the time you spend on each, and, if you click an affiliate link, one click ID cookie stored in your browser for 30 days. That is the whole list. Below is the long version, in plain English, with the retention windows, the legal basis for each stream, and the one-minute opt-out for each right you have.
This site is a WordPress publication reviewing custom curtains, funded by affiliate commission from a single brand. Data flows here are lean by design, because the commercial model does not depend on retargeting, list rental, or behavioural profiling. For context on who runs this site and why it exists, start there and come back for the data mechanics.
This is the button the policy describes
Liz Linen Drape Pleated
from $59.99/panel · 90% polyester / 10% linen · 350 gsm heavyweight · OEKO-TEX certified · pinch pleat header with 2x fullness · custom sizing to the 1/2 inch · 38 colors. Final price depends on size and lining.
Clicking sets one Impact Radius click ID cookie (30-day window) and passes the article slug as subid1. No name, no email, no address collected on this side. Code JULY for 20% off · Free shipping over $300.
The 30-Second Version
If you only read one section on this page, read this one. Every data stream this site touches, where it goes, how long it stays, and the legal basis for keeping it, in one table.
| Data stream | Where it goes | Retention | Legal basis |
|---|---|---|---|
| IP address (truncated) | WordPress host (server logs) | 14 days | Legitimate interest (fraud, abuse) |
| Approximate city | Google Analytics 4 | 26 months (aggregate) | Legitimate interest (audience insight) |
| Device and browser | Google Analytics 4 | 26 months (aggregate) | Legitimate interest |
| Pages viewed, time on page | Google Analytics 4 | 26 months (aggregate) | Legitimate interest |
| Affiliate click ID | Impact Radius (pxf.io redirect) | 30 days in browser | Consent (via cookie banner) |
| Order-completion pixel | Two Pages → Impact Radius | On event only | Contract (Two Pages side) |
| Newsletter email | MailerLite | Until unsubscribe + 12 months backup | Consent (double opt-in) |
| Contact form submission | WordPress database + email inbox | 24 months | Consent + legitimate interest |
What Information This Site Touches
The information a visit creates falls into four streams. Here they are in order of how much of your data they see, from least to most.
First-Party Analytics
The site runs Google Analytics 4 with IP anonymization enabled. What the dashboard sees: aggregate counts of page views, session length, referrer domain, approximate city (never street-level), device family, and browser. What it does not see: your name, your email, or any cross-site behaviour outside this domain.
IP addresses are anonymized before storage per Google Analytics IP anonymization. Retention is set to the shortest option Google allows: 26 months. No user IDs are stitched across sessions, no advertising identifiers are enabled, no cross-domain tracking is configured.
Affiliate Click IDs
When you click any product button on this site, you pass through a redirect at pxf.io (the Impact Radius affiliate network). Impact drops one cookie in your browser containing a click ID, plus four parameters it reads from the URL: subid1 (the article slug), subid2 (position within the article, like hero-cta), prodsku (the product SKU), and u (the destination URL on Two Pages).
Affiliate Disclosure
The commercial reason the click ID exists in the first place. Who pays whom, how much, and what your click never costs you.
The cookie window is 30 days. If you never buy, the cookie expires and no record of you is created on Two Pages’ side. If you buy, Two Pages sees your purchase details (which they need for order fulfillment) and pings Impact Radius with a commission event. This site sees only an anonymous commission ping, no purchase specifics, no name, no shipping address.
Data flow of one affiliate click
1. Page view
GA4 logs an anonymized page view. Aggregate only.
2. Click
pxf.io redirect logs subid1, subid2, prodsku, destination.
3. Cookie set
Impact Radius stores a click ID for 30 days.
4. Purchase
Two Pages payment provider handles all PII. Not us.
5. Commission
Anonymous commission ping to this site. No PII returned.
Cookies and Local Storage
The site sets a small number of cookies, some essential (session, consent state), some subject to consent (analytics, affiliate). The consent banner records your choice for 12 months and you can revisit it anytime through the footer link. Nothing is set before you interact with the banner if you land from a jurisdiction requiring prior consent.
Cookie inventory
_ga
Google Analytics 4 client ID.
24 months · third-party · consent
_ga_XXXX
GA4 session state.
2 years · third-party · consent
Impact click_id
Affiliate attribution on pxf.io.
30 days · third-party · consent
session_id
WordPress session token.
Browser session · first-party · essential
mc_cid, mc_eid
MailerLite newsletter click (if subscribed).
Session · third-party · consent
cookie_consent
Records your banner choice.
12 months · first-party · essential
Marketing Email Opt-Ins
The newsletter runs on MailerLite with double opt-in. When you submit an email on the sign-up form, MailerLite sends a confirmation link. Only clicking that link adds you to the list. No purchase history, no browsing behaviour, no other data is imported alongside the email address. Every email includes a one-click unsubscribe.
Where Data Goes and How Long It Stays
The processors that see any part of your visit are limited to five: the WordPress host (server logs), Google (Analytics), Impact Radius (affiliate attribution), MailerLite (newsletter), and Cloudflare (CDN and DDoS protection). Standard Contractual Clauses cover all EU-to-US transfers where applicable. No sub-processor operates outside a jurisdiction with an adequacy decision or valid transfer mechanism.
Retention ladder, shortest to longest
Server logs
14 days
IP truncated on write, fraud detection only.
Affiliate click ID
30 days
Then anonymized on our side.
Contact form
24 months
Editorial audit trail, correction history.
GA4 aggregate
26 months
Shortest option Google Analytics allows.
Newsletter email
Until opt-out
Plus 12 months backup for restoration.
Backup snapshots of the WordPress database are kept for 12 months on encrypted storage in the same jurisdiction as the primary host. A deletion request purges both the primary record and any backup on the next incremental rotation, within 30 days total.
The Legal Frame in Plain English
If you visit from the European Economic Area or the United Kingdom, this site processes personal data under GDPR articles 13 and 14. The legal bases are named per stream in the table below: consent for anything non-essential, contract on the Two Pages purchase side, legitimate interest for aggregate analytics and fraud prevention.
If you visit from California, this site processes personal data under California CPRA rights. The short answer to the California-specific right: this site has never sold or shared personal information for cross-context behavioural advertising, so Do Not Sell / Do Not Share resolves in your favour by default.
Legal basis by stream
Art. 6(1)(a) Consent
Analytics cookies, affiliate cookies, newsletter subscription.
Art. 6(1)(b) Contract
Purchase fulfillment on the Two Pages side, not on this site.
Art. 6(1)(f) Legitimate interest
Aggregate audience insight, server-side fraud prevention.
CPRA §1798.100
California right to know, delete, correct, opt out. Fully honoured.
Your Rights and How to Use Them in Under a Minute
You have six rights on this site. Access, correction, and deletion requests route to the named editor responsible for this site and receive a response within 5 business days. Every mechanism below is free of charge and requires no account.
Six reader rights, six mechanisms
Access
Email the editor. JSON export within 30 days.
Rectification
Contact form, correction applied within 5 business days.
Erasure
Confirmation loop within 48 hours, deletion within 30 days including backups.
Portability
Machine-readable JSON export on request.
Object / Withdraw consent
Cookie banner reject, unsubscribe link in every email.
Do Not Sell / Share
Already the default. Answer: we do not.
California residents get one additional guarantee: this site has never sold, rented, licensed, or shared personal information with any third party for their independent marketing use. That posture is not a promise for the future in vague language, it is a description of what has already happened over the entire lifetime of the site.
How This Data Shapes What You Read
Aggregate analytics inform the editorial calendar: which topics get written next, which existing articles get updated, which questions readers actually search for. That is the extent of it. Analytics never rewrite a verdict once a review is assigned to an editor. Commission size, click volume, and buyer intent are downstream signals, not upstream inputs into ranking.
How We Review Curtains
The public methodology behind every ranking. Aggregate analytics inform which articles to write; they never rewrite a verdict.
The editorial firewall works the same way for click data as it does for commission data. A collection cannot buy a higher ranking through higher affiliate revenue, and it cannot buy a higher ranking through higher click-through either. The dashboard is a map of what readers looked at, not a scoreboard for what to promote.
Questions, Corrections, Deletion Requests
Every request routes through the contact form and lands directly in the editor’s inbox. Response window is 5 business days for correction requests, 48 hours for the deletion confirmation loop, and 30 days for full erasure including backup rotation. Confirmed inaccuracies trigger a top-of-article correction with a visible date stamp, not a silent edit.
Contact & Data Requests
Access, correction, deletion, or opt-out. The contact form logs the request and routes it directly to the editor. Response window: 5 business days.
If the editorial response does not satisfy you, escalation paths stay open. EU and UK residents may lodge a complaint with their national data protection supervisory authority. California residents may complain to the California Attorney General’s office. The relevant contact routes are publicly documented on the respective regulator websites.
The $2.99 Click That Still Sets a Cookie
The Two Pages Lining Sample Booklet ships six actual fabric squares for $2.99. This link sets exactly the same Impact Radius click ID and 30-day cookie as a $299 panel order. The tracking mechanism does not care about ticket size. We disclose it anyway.
Now You Know What the Click Sets. Click Anyway (or Don’t).
Liz Linen Drape Pleated is the anchor product cited across most reviews on this site. If the policy above sounds acceptable, this is the affiliate link the policy describes. from $59.99/panel, 38 colors, 6 lining options, one click ID, 30-day cookie. Code JULY (20% off) · Free shipping over $300.
Frequently Asked Questions
Does clicking an affiliate link on this site cost me privacy?
It costs one click ID cookie stored for 30 days in your browser, tied to Impact Radius, the affiliate network. No name, no email, no address is passed on our side. If you never buy anything, the cookie expires and is deleted with no record of you on Two Pages’ side. If you buy, Two Pages sees your purchase details (which they need for order fulfillment); we only see an anonymous commission ping.
What does Impact Radius actually know about my visit?
The click ID, the article slug (subid1), the position within the article (subid2), the product SKU (prodsku), and the destination URL (u). That is the full payload. Impact Radius does not receive your name, email, or IP address from this site. If you complete a purchase on Two Pages, Impact matches your click ID to the order for commission accounting.
How long is my data kept?
Aggregate Google Analytics: 26 months. Affiliate click ID: 30 days in your browser, then anonymized on our side. Newsletter email: until you unsubscribe, plus 12 months in backup for restoration if requested. Contact form messages: 24 months. Server access logs: 14 days, with the last IP octet truncated on write.
Can I request deletion of my data?
Yes. Email the editor through the contact form with the subject line “GDPR / CPRA deletion request” and the email address or click ID you want purged. Confirmation loop within 48 hours. Full deletion within 30 days. Newsletter deletion is instant via the unsubscribe link at the bottom of every email.
Does the site sell my personal data?
No. This site has never sold, rented, or shared personal data with third parties for their independent marketing use. Aggregate analytics are used to decide which articles to write. That is the extent of commercial use of visitor data.
Is a VPN enough to make my visit invisible?
Almost. A VPN hides your IP address from our analytics (which then log the VPN exit node). It does not stop the click ID cookie if you then click an affiliate link (that cookie is set in your browser regardless of IP). If you want zero data exchange with any party on your journey, type twopagescurtains.com directly into your address bar and use a browser that blocks third-party cookies.
Is the newsletter double opt-in?
Yes. When you submit an email on the sign-up form, MailerLite sends a confirmation email. Only clicking the confirmation link adds you to the list. No purchase, no browsing history, no other data is imported alongside the email address.
Do you use browser fingerprinting or session replay?
No. This site uses standard cookie-based analytics only. No canvas fingerprinting, no font enumeration, no session replay (nothing like Hotjar, FullStory, or LogRocket is deployed). What you see in the Cookie Inventory Card above is the complete tracking surface of the site.
