Cookie policy

This document is a placeholder template prepared by Savunda for the demo build. Final language must be reviewed by qualified legal counsel before public launch. Last reviewed by counsel: pending.

A cookie is a small text file that a website stores in your browser so it can remember things about you between page loads. Some cookies are essential for the site to work — they keep you signed in, remember the contents of your shortlist, and prevent cross-site request forgery on our forms. Others are optional and exist only to help us understand how the site is used or to measure advertising performance.

Local storage and session storage work similarly to cookies and are governed by this policy where used.

The following cookies and localStorage entries are set by https://savunda.com directly and are strictly necessary to operate the site:

Cookies

• authjs.session-token (or __Secure-authjs.session-token on HTTPS) — signed JWT that keeps you signed in to your account, the agents portal, the partners portal, or the admin app. HTTP-only, secure, ~30 days (sliding).
• authjs.csrf-token (or __Host-authjs.csrf-token on HTTPS) — CSRF token attached to authentication requests. HTTP-only, secure, session.
• authjs.callback-url (or __Secure-authjs.callback-url on HTTPS) — remembers where to send you after you sign in. Session.
• cookie_consent_v2 — JSON-encoded record of your per-category consent (analytics, marketing, functional) so we don't re-prompt on every visit. 12 months. The older cookie_consent cookie is still written as a compatibility mirror for components that may read the v1 shape.
• referral_ref — captures a ?ref= parameter so the right agent or partner gets credit for your booking. 90 days. Set only when you arrive on a referral link.
• impersonate_agent — written only when a super-admin uses the "view as agent" tool. Not set for normal traffic.

localStorage entries (governed by this policy where used)

• cookieConsentV2 — fast client-side mirror of the v2 consent state.
• cookieConsent and savunda-cookies-v1 — legacy mirrors of the same consent choice; preserved so older components keep working.
• AyaChat conversation buffer — the last 20 messages you exchange with our on-page assistant, so the conversation survives a page reload. Cleared automatically after 30 days of inactivity; you can clear it sooner from the chat menu.
• UI-dismissal stamps for the locale-suggest banner and the exit-intent dialog — single-integer timestamps that stop us re-prompting for 30 days after you close them.

You can delete any of these through your browser settings, but the site will not work correctly without the strictly necessary ones.

The following third-party cookies are loaded only after you opt in through the consent banner. They fall into two categories:

• Analytics
• - _ga, _ga_* — Google Analytics 4 visitor and session identifiers.
• - _gid — Google Analytics 24-hour visitor identifier.
• - Google Tag Manager loads the above on consent.
• - Plausible runs server-side and does not set cookies, even with consent.
• Advertising / attribution
• - _fbp, fr — Meta pixel for conversion attribution on paid social.

If you decline these categories, we will not load the underlying scripts and no cookies are set.

You can change your consent choices at any time through the Cookie settings link in the site footer. This reopens the consent banner and lets you toggle analytics and advertising on or off independently of the strictly-necessary category.

You can also delete cookies through your browser:

• Chrome — Settings → Privacy and security → Cookies and other site data.
• Safari — Settings → Privacy → Manage Website Data.
• Firefox — Settings → Privacy & Security → Cookies and Site Data.
• Edge — Settings → Cookies and site permissions → Manage cookies and site data.

Modern browsers can send a "Do Not Track" or Global Privacy Control (GPC) signal with every request. Where we detect a GPC signal, we treat it as a decline of analytics and advertising cookies for that session, regardless of any earlier choice in our banner. We do not treat the legacy "DNT" header alone as a binding signal because industry consensus around it is unclear.

If we add a new cookie or change how an existing one works, we will update this page and, where required, prompt you to reconfirm your consent through the banner. The "Last updated" date at the top of the page always shows the most recent change.

Questions about cookies? Email privacy@savunda.com.