Cookies
Översättning av juridiska texter: REVIEW_REQUIRED. Ingen godkänd SV-version. Samtyckeslogiken oförändrad (integritet obligatorisk, auditbekräftelse obligatorisk, marknadsföring valfri, inte förkryssad). This legal document is provided in English (approved language). A local translation is not yet approved; consent logic is unchanged.
1. Cookies and similar technologies
HTTP cookies, sessionStorage/localStorage, and server-side events may store or process data on your device or in our backend. This page lists what TravelOS actually uses.
2. Active inventory
Inventory version 3.0.0-TASK137B (reviewed 2026-09-09). • up101_session (http_cookie) — Authenticated admin session Data: Session token (HttpOnly); hash in DB Duration: SESSION_TTL_HOURS or logout Recipients: UP101 application only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: STRICTLY_NECESSARY • up101_csrf (http_cookie) — CSRF protection for admin mutations Data: CSRF token Duration: Aligned with session Recipients: UP101 application only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: STRICTLY_NECESSARY • up101_client_session (http_cookie) — Authenticated client portal session Data: Client session token (HttpOnly) Duration: Portal session TTL or logout Recipients: UP101 application only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: STRICTLY_NECESSARY • up101_client_csrf (http_cookie) — CSRF protection for portal mutations Data: CSRF token Duration: Aligned with portal session Recipients: UP101 application only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: STRICTLY_NECESSARY • up101_client_impersonation (http_cookie) — Read-only admin preview of client portal Data: Impersonation marker Duration: Preview session Recipients: UP101 application only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: STRICTLY_NECESSARY • up101_mfa_pending (http_cookie) — MFA challenge state for Super Admin Data: Pending MFA challenge id Duration: Short-lived challenge window Recipients: UP101 application only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: STRICTLY_NECESSARY • up101_admin_market (http_cookie) — Admin UI market filter preference Data: Market code Duration: Browser session / preference TTL Recipients: UP101 application only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: FUNCTIONAL_PREFERENCE • up101_admin_territory (http_cookie) — Admin UI territory filter preference Data: Territory code Duration: Browser session / preference TTL Recipients: UP101 application only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: FUNCTIONAL_PREFERENCE • up101_audit_form_draft (session_storage) — Restore unfinished public audit form fields after accidental refresh Data: companyName, website, email only — never consent checkboxes Duration: Max 2 hours from last edit; cleared on successful submit Recipients: Local browser only (not sent to analytics) Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: STORAGE_DRAFT • up101_first_landing_path (session_storage) — First public path in the visit for inbound attribution Data: Path string (no email/message) Duration: Browser tab session Recipients: Sent with audit/contact submit as firstLandingPath Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: STORAGE_DRAFT • up101-admin-sidebar-collapsed (local_storage) — Admin sidebar collapsed preference Data: boolean UI flag Duration: Until cleared by user Recipients: Local browser only Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: FUNCTIONAL_PREFERENCE • up101_stats_consent (http_cookie) — Stores optional first-party statistics preference (version + choice). Not a visitor analytics id. Data: JSON: version, stats boolean, choice, timestamp Duration: 180 days or until cleared Recipients: UP101 application only (first-party) Consent: not required (strictly necessary / local draft / owner decision for first-party stats) Category: FIRST_PARTY_STATS • InboundEvent (first-party optional) (server_event) — Optional navigation/funnel measurement (page/CTA/audit start) — gated by prior stats consent; no third-party pixels Data: kind, path, src/campaign, truncated user-agent, visitClass, statsConsent=true; no IP on events; no form bodies Duration: Operational retention per ROPA / inbound events policy Recipients: UP101 hosting (Hostinger VPS Frankfurt) as controller infrastructure Consent: required before activation Category: FIRST_PARTY_STATS
3. What we do not use
No Google Analytics, GTM, Meta Pixel, Hotjar, Matomo, Plausible, or remarketing. No Google Fonts CDN. No IndexedDB/service worker storing public-visitor personal data.
4. First-party statistics
Optional navigation/funnel events stay off until you accept statistics in the preferences banner. After consent we record only subsequent events, without IP on the event and without third-party pixels. Closing the banner keeps necessary only. Statistics consent does not subscribe you to marketing email. Audit requests, login, support and payments work without statistics consent.
5. Legal basis and banner
Strictly necessary cookies/storage: Art. 6(1)(b) / 6(1)(f) GDPR (always on). Optional first-party statistics: prior consent (ePrivacy / Art. 6(1)(a)). Banner Accept / Necessary only / Customise; Cookie preferences in the footer. No event buffer before consent.
6. Management
You may delete cookies and storage in your browser. Blocking essential cookies may prevent admin/portal login. The audit draft (sessionStorage) expires after a few hours and is cleared after successful submit; consent checkboxes are never restored from storage.
7. Controller
Controller: UP 101 DI PIZZO MATTEO MARIO Trade name: UP101 Product: UP101 TravelOS VAT: 02815530064 (IT02815530064) Fiscal address: Corso Crimea 35 15121 Alessandria (AL) Italia Privacy contact: info@up101.dev PEC: matteomariopizzo@pec.it UP101 TravelOS is a product of UP 101 DI PIZZO MATTEO MARIO (trade name UP101). UP101 Tenerife is a historical operating name linked to Tenerife and does not denote a separate Spanish company.
Inte juridisk rådgivning. Sakgranskning återstår.