Version: 0.2-tervezet · Dated: 2026-10-02
Cookie Policy
Cookies and browser storage of the [PRODUCT NAME] platform
DRAFT for legal review. Version 0.1, 2026-10-02. English translation of Sütiszabályzat; if the texts differ, the Hungarian text prevails. Not final, not legal advice.
[FOR THE LAWYER: ...]is the English form of the Hungarian[JOGÁSZNAK: ...]marker; the full list and the code evidence of the statements are in the README. The list describes the actual behaviour in the code state of 2026-10-02 (main a71f768): it contains only what the product really sets. If the product introduces a new cookie or storage item, this document must be amended too.
1. Whom it concerns, who is responsible
1.1. The visitor meets the product on three surfaces: (a) salons' public booking pages (/b/<salon-identifier>) used by salons' guests; (b) the salon's staff (admin) interface; (c) the Operator's platform console, reached only by the Operator's staff.
1.2. The Operator is responsible for the cookies and browser storage set by the platform. The measurement tags the salon enters for the booking page (Meta Pixel, Google Analytics 4, Google Ads, TikTok Pixel, Google Tag Manager) are the salon's own decision and responsibility: the salon is the controller for them, and the booking page asks for consent in the salon's name (section 5). [FOR THE LAWYER: whether the Operator's policy is a model for salons or each salon gives its own cookie notice; today the consent bar on the booking page speaks in the salon's name, and the web address of the salon's own privacy notice can be entered.]
2. Cookies
| Name | Set by | Purpose | Type | Lifetime | Attributes | Where |
|---|---|---|---|---|---|---|
salon_session | the server | signed-in session of the salon's staff member (and of support access) | strictly necessary | at most 12 hours from sign-in; the server invalidates it after 30 minutes of inactivity; for support access the stated limit (default 30, at most 120 minutes) | HttpOnly, Secure in production, SameSite=Lax, Path=/ | admin interface, sign-in |
salon_platform | the server | session of the Operator's platform console | strictly necessary | at most 8 hours; default 15 minutes of inactivity (adjustable between 5 and 60 minutes) | HttpOnly, Secure in production, SameSite=Lax, Path=/ | platform console only, for Operator staff |
salon_till_device | the server | identifying the desk computer that the salon enrolled for PIN quick sign-in | strictly necessary for quick sign-in | 180 days (the salon can revoke it at any time) | HttpOnly, Secure in production, SameSite=Lax | the enrolled desk computer |
salon_guest | the server | the guest's signed-in state on the booking page (viewing one's own bookings), after redeeming the sign-in link received by e-mail | necessary for the function the guest requested | 30 days (the sign-in link is valid for 15 minutes); deleted on sign-out | HttpOnly, Secure in production, SameSite=Lax, path /api/guest/b/<salon-identifier> (separate per salon) | the salon's booking page, only if the guest signs in |
salon.naptar.oldalsav.<staff-identifier> | the browser (JavaScript) | whether the calendar's side panel is open or closed, so it does not flash on the next load | functional, the user's setting | 1 year | SameSite=Lax, path /calendar | the admin calendar |
The content of the session cookies is a random identifier, not personal data; the server stores only a hash of it.
3. Browser storage (localStorage and sessionStorage)
Browser storage stays on the visitor's device, is not sent to the server and carries no tracking identifier.
| Key | Storage | Purpose | Surface | How long |
|---|---|---|---|---|
salon-booking-lang | localStorage | the booking page's language choice | booking page | until cleared |
sz-consent:v1:<salon-identifier> | localStorage | the visitor's measurement-tag consent decision (statistics, marketing, the time of the decision, the tags configured at the time) | booking page, only if the salon has a tag | until cleared; not sent to the server |
salon-saas:eloleg-token:<salon-identifier> | sessionStorage | finding the booking of a guest returning from paying the online deposit | booking page | until the tab is closed |
salon-saas:berlet-token:<salon-identifier> | sessionStorage | finding the purchase of a guest returning from buying a package | booking page | until the tab is closed |
sz-conv:v1:<salon-identifier>:<event-identifier> | sessionStorage | a flag that the purchase event has been sent, to avoid duplication (only with consent and a tag) | booking page | until the tab is closed |
sz-tema | localStorage | light or dark appearance | admin | until cleared |
sz-ujdonsagok-latott | localStorage | identifier of the last "What's new" entry seen | admin | until cleared |
salon.calendar.hourHeight | localStorage | the calendar's zoom level | admin | until cleared |
salon.naptar.oldalsav.<staff-identifier> | localStorage | the side panel's state (partner of the cookie in section 2) | admin | until cleared |
sz-ertesitesek-olvasott-v2:<staff-identifier> | localStorage | which notification the staff member has already read | admin | until cleared |
sz-ertesitesek-toast:<staff-identifier> | localStorage | reserving the pop-up new-booking notices across browser tabs so that the same notice does not pop up in two open tabs (stores the notification identifier and the time of the reservation) | admin | entries live for 24 hours (older ones are removed by the next write); the key itself stays until cleared |
salon.state-banner.<banner-identifier> | localStorage | remembers that an informational status banner at the top of the admin (for example the end of the trial) was dismissed for the current day (stores the browser's local date) | admin | the key stays until cleared; the banner returns the next day |
salon.kassza.utolsoMod | localStorage | the payment method last chosen in the cash register module | admin | until cleared |
salon:recovery-warning | sessionStorage | a warning shown after sign-in if the staff member signed in with a recovery code | admin, sign-in | until the tab is closed |
4. Third-party services the product loads itself
4.1. Cloudflare Turnstile. At booking completion and on the contact form the system may apply an abuse check. If the Operator has set the Turnstile keys, on the booking confirmation step the browser loads Cloudflare's script (challenges.cloudflare.com), and on submission the server sends the verification token and the visitor's IP address to Cloudflare for checking. The widget works regardless of consent to measurement tags because it serves abuse protection. [FOR THE LAWYER: Cloudflare Turnstile's own storage practice (whether it sets a cookie or browser storage on the visitor's device) is to be checked in the provider's current documentation and entered here; whether it can be treated as necessary under the rules on storing information on the device; the booking is not blocked if the widget does not load.]
4.2. No other external content loaded by the product itself. The product itself loads no external font, analytics script or social plug-in: fonts are bundled with the system. On the booking page the only external scripts are Turnstile (4.1) and the measurement tags set by the salon, which are gated by consent (section 5). On the admin interface the Content-Security-Policy by default allows only the product's own source; because of Next.js, inline scripts are allowed. Card payment of deposits and packages takes place on the payment provider's (SimplePay, Barion) own page; its cookies are described by the provider's notice.
5. Measurement tags on the booking page (the salon's own measurement)
5.1. When they load. On the booking page the salon's measurement tags (Meta Pixel, Google Analytics 4, Google Ads, TikTok Pixel, Google Tag Manager) load only if (a) the salon has entered their identifiers and (b) the visitor consented in the consent bar. Until the visitor decides, no measurement tag loads.
5.2. The consent bar. The bar speaks in the salon's name, allows a decision per category (statistics: Google Analytics; marketing: Meta, Google Ads, TikTok; Google Tag Manager in both categories) and asks only about what the salon actually has a tag for. Rejecting ("Only the necessary") is a button of the same size and font weight as accepting; the emphasis differs (accepting is a filled button, rejecting an outlined one). [FOR THE LAWYER: whether the visual difference in emphasis (filled versus outlined button) meets the requirement of equal standing.] The decision stays in the visitor's browser (sz-consent:v1:<salon-identifier>) and the server does not record it. It can be changed or withdrawn at any time through the "Cookie settings" link at the foot of the page. If the salon later adds a new tag, the earlier consent does not extend to it and the bar asks again.
5.3. Where nothing loads. In the embedded booking (a frame embedded in the salon's own website) the product loads no measurement tag; there the salon's own page is responsible for consent. Nor does any tag run on the guest's token-based management pages (cancel, reschedule) or on the waitlist-offer page, because the address carries the guest's secret identifier. Before the tags load, the payment providers' return parameters are removed from the browser's address bar.
5.4. The Google Tag Manager gate. Loading Google Tag Manager additionally depends on an Operator switch, which is off by default, because the container's custom scripts would run on the booking page's origin. [FOR THE LAWYER: the operator fills this in; the state of the gate in the production environment.]
5.5. The tags' cookies. After consent the tags set their own cookies under the providers' (Meta, Google, TikTok) rules. Their names, lifetimes and purposes are described by the providers' notices; the Google Analytics cookie is restricted to the path of the salon's booking page (/b/<salon-identifier>) so that a guest cannot be linked between two salons. [FOR THE LAWYER: if the policy must also list the tags' cookies by name, whether that is the salon's task or the Operator compiles them from the providers' current lists.]
6. How you can control them
6.1. On the booking page you can change your decision on measurement tags at any time through the "Cookie settings" link.
6.2. In your browser's settings you can delete or block cookies and local storage. If strictly necessary cookies are blocked, signing in, and therefore using the admin interface, is not possible; booking on the booking page works without cookies.
7. Legal basis
Strictly necessary and functional storage is tied to providing the service. Measurement tags work on the basis of consent. [FOR THE LAWYER: the legal basis and the exact reference to the Hungarian electronic commerce/communications rules; assessing whether "functional" storage (theme, zoom, side panel, language) is exempt from consent.]
8. Amendment
The Operator amends the policy when the product introduces or removes a cookie or storage item. Earlier versions are available on request.