# Cookie Policy # Cookie Policy _Last updated: 27/10/2026_ ## 1. Introduction This Cookie Policy describes the types of cookies and similar technologies used by **Placeful**, operated by **Andrea Faccioli** (the "Controller"), and how user consent is managed. "Cookies" refers both to traditional HTTP cookies and to equivalent tracking technologies (localStorage, sessionStorage, fingerprinting) where applicable. ## 2. Data controller The data controller is **Andrea Faccioli**, based in **Via Madonnina 2505A, 40024 Castel S. Pietro Terme (BO), Italy**, Fiscal Code **FCCNDR89E12A944E**, e-mail **info@placeful-app.com**. ## 3. Cookie categories The application classifies cookies and browser storage into four categories: ### Essential (technical) cookies Required for the application to function correctly: authentication, session, CSRF security. These do not require consent under Article 122 of the Italian Privacy Code (D.Lgs. 196/2003) and the GDPR. ### Functional storage Preference and personalisation storage (theme, layout, UI state). These items hold no identifiers, are never read by third parties, and are treated as strictly necessary for the requested functionality. Where an item is genuinely optional the banner's "functional" toggle governs it. ### Analytics cookies Collect aggregated information about how the application is used to improve performance and usability. Activated only with consent. **None are currently installed.** ### Marketing cookies Used to track users across websites to display relevant advertisements. Activated only with consent. **None are currently installed.** ### 3.1 First-party cookies actually set | Cookie | Category | Purpose | Duration | |---|---|---|---| | `placeful-session` | essential | authenticated session (name derives from the app name) | 30 minutes, persistent | | `XSRF-TOKEN` | essential | CSRF protection for forms and AJAX requests | tied to the session | | `app_cookie_consent` | essential | stores the cookie-preference choices expressed in the banner | 180 days | | `remember_web_*` | essential | "remember me" persistent login (only when the user opts in) | 5 years | | `remember_device` | essential | trusted-device flag that lets a known browser skip two-factor verification | 30 days | | `widget_auth_cc_{id}` | essential | one-shot handoff completing social login inside the booking widget | 10 minutes, limited to `/auth` | All first-party cookies are `HttpOnly` except `XSRF-TOKEN` (JavaScript must read it for CSRF headers). Inside cross-site widget embeds, cookies that support it are sent with `Partitioned` (CHIPS) so they stay confined to that embed. ### 3.2 Browser storage in use The application also writes the following `localStorage` / `sessionStorage` keys. None of them are accessible to third parties or used for tracking. | Key | Store | Purpose | |---|---|---| | `theme` | localStorage | light/dark appearance preference | | `booking-widget:view-mode` | localStorage | calendar vs list view in the booking widget (also inside embeds) | | `planner.layers` | localStorage | layer selection on the staff seating planner | | `nav.rail`, `nav.closed`, `nav.scroll.{context}` | localStorage / sessionStorage | navigation sidebar state and scroll restore | | `dashboardChartMetrics`, `dashboardChartTypes`, `dashboardTableColumns` | localStorage | staff dashboard customisation | | `app.install.dismissed` | localStorage | "install app" banner dismissal | | `pwa.fromApp`, `pwa.lastShell` | sessionStorage | installed-PWA shell detection | | `pwa.mediaPerm.v2.dismissed.{kind}`, `pwa.mediaPerm.v2.prompts.{kind}` | localStorage | camera/microphone permission-prompt bookkeeping | | `placeful-push-synced-{user}` | sessionStorage | push-notification subscription sync marker | | `passkey_signin_hint` | localStorage | remembers that a passkey sign-in was used | | `radio-sound`, `radio-room:{company}`, `radio-ptt-tap:{company}` | localStorage | staff radio mute flag, last room, push-to-talk mode | ## 4. Legal basis - Essential cookies: performance of a contract or compliance with legal obligations (Art. 6(1)(b) and (c) GDPR) and Art. 122 of the Italian Privacy Code. - Functional, analytics and marketing cookies: freely given, specific, informed and revocable consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). ## 5. How consent is given On first access a banner is shown allowing the user to: - accept all cookies - reject all optional cookies - customise preferences per category Preferences are stored in the `app_cookie_consent` cookie for 180 days. The user can change preferences at any time via the "Cookie preferences" link in the footer. Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent given before its withdrawal. ## 6. Third-party cookies and browser contacts The application may integrate third-party services (e.g. social login via Google or Facebook, payment provider, transactional email provider) that may set their own cookies. These services act as autonomous controllers for the processing carried out through their respective platforms. The user's browser also contacts the following third parties directly while using the application: | Service | When contacted | What the browser sends | |---|---|---| | `js.stripe.com` | payment and billing pages | Stripe script/iframe handling card input (Stripe's own cookies may apply) | | `stun.l.google.com` | staff radio (WebRTC push-to-talk) | IP address for NAT traversal | | `ui-avatars.com` | documents/receipts when a venue has no logo | venue or table initials (image request) | | `cdn.enablebanking.com`, `cdn.nordigen.com` | bank-reconciliation views | bank logo image requests | | `*.googleusercontent.com` | profiles signed in via Google | Google avatar image request | Users are invited to consult the individual providers' policies: - [Google Privacy Policy](https://policies.google.com/privacy) - [Facebook Privacy Policy](https://www.facebook.com/privacy/policy) - [Stripe Privacy Policy](https://stripe.com/privacy) ### 6.1 Embedded widget context The booking widget can be embedded on third-party websites via an iframe. Inside that embed, the platform sets only technically necessary cookies (session, consent record) in browser-partitioned (CHIPS) form — they function within the embed and cannot track the visitor across sites. Websites embedding the widget should disclose it in their own cookie notice. ## 7. Managing cookies via browser Users can manage or disable cookies directly through their browser settings. Disabling essential cookies may impair the application's functionality. Information on managing cookies in major browsers: - [Google Chrome](https://support.google.com/chrome/answer/95647) - [Mozilla Firefox](https://support.mozilla.org/kb/cookies-information-websites-store-on-your-computer) - [Apple Safari](https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac) - [Microsoft Edge](https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947706-40ac-c3b8-57b9-76a258fd7aca) ## 8. Retention period - the session cookie (`placeful-session`) lasts 30 minutes of activity per the configured session lifetime — it is not deleted when the browser closes - `localStorage` keys persist until the user clears site data; `sessionStorage` keys expire with the tab - the consent cookie (`app_cookie_consent`) lasts 180 days - the trusted-device cookie (`remember_device`) lasts 30 days; "remember me" cookies last up to 5 years - optional cookies, when introduced, follow each provider's specific durations and activate only with consent ## 9. User rights Under the GDPR and the Italian Privacy Code, the user has the right to: - access their personal data - request rectification or erasure - object to processing or request its restriction - withdraw consent given - lodge a complaint with the Data Protection Authority To exercise these rights, write to: **info@placeful-app.com**. ## 10. Changes The Controller reserves the right to update this Cookie Policy. Changes will be published on this page with a revised update date. --- > Source: https://placeful-app.com/en/cookie-policy