This policy describes the cookies and related records that Aioness uses in the browser, their purposes, duration and management methods. Refers to the public page and interface of the platform; additional technologies that the firm lawfully incorporates on its own page must be explained specifically.
Privacy and legal contact: privacy@aioness.com
1. What are cookies and related technologies
An HTTP cookie is a small record that a browser sends to the relevant server with requests. Browser local storage, or localStorage, keeps data on the device without automatically sending it with each request. Session storage, or sessionStorage, is normally associated with a particular browser tab and its session.
The rules on storing and reading data on the device are not limited to the name of the cookie. They can include local memory, pixels, identifiers, and similar techniques. Where a record or a related request contains personal data, the data protection regulations shall additionally apply.
A cookie or local record does not get the right to use just because it is its own, short or labeled as analytics. Necessity and eventual consent are judged by the actual purpose and behavior of the technology.
2. When consent is required
The storage or access strictly necessary for the transmission of the communication or the service explicitly requested by the user may be subject to a legal exemption from the consent. Examples are the protection of logins, sessions, and the required basket contents during purchases. The exception does not extend automatically to the measurement of visits or advertising.
For option technologies for which the law requires consent the rule is a pre-emptive, free, concrete and informed choice. Options must not be turned on in advance. Continued browsing, scrolling, or acceptance of the terms of use is not such consent, and a legitimate interest does not replace the mandatory consent to access to the device.
Storing an explicitly requested language or display may require a different assessment than automatic long-term writing. The duration and scope shall remain proportionate to that function. The classification in the table describes the function; it does not in itself constitute proof that the exception applies in every state.
3. Categories shown in settings
- Necessary: session, protection of requests and remembering privacy choices, and functional records needed for the action the user is looking for. Turning them off in the browser may prevent you from logging in or completing your order.
- Settings: language, theme and display mode. For each record, an explicit user request should be distinguished from the optional personalization and apply the appropriate mode.
- Analytics: measures visits and behaviours that are not strictly necessary for the service requested. The provider, purpose and actual records must be stated before activation.
- Marketing: advertising, campaign tracking and linking visits for marketing purposes. The required choices and information must precede activation.
The existence of a category in the window does not mean that a particular external service is included. Category names are not separate cookies. The choice of analytics and marketing providers is still ongoing and this draft does not invent them.
4. Inventory of first-party records
The table shows the records established by reviewing the current application. They appear depending on the site, login, and function used; not all are present at each visit. The company or user designation in the name means that the record is bound to that context, within the domain and browser rules.
For permanent local records without built-in expiration, we do not specify a fictitious deadline. They may remain until removal through the function or deletion of the site data. The browser can delete the data earlier. The period of record use and the physical removal of records are not always the same.
| Name or Name Form | Type and function | Purpose | Duration / removal |
|---|---|---|---|
| aionesscom-session | HTTP cookie; session required | Session and connect secure requirements, login and application operation. | By server setting: currently 120 minutes, with a refresh when active; if session close is enabled, until browser closes. |
| XSRF-TOKEN | HTTP cookie; security | Protect the requirement from CSRF attack when the appropriate stream is used. | Related to session configuration; currently 120 minutes. |
| aioness_cookie_consent_* | localStorage; privacy choice | Consent ID, time, version and selected categories for the platform or a specific company. | No automatic timeout; until a selection is replaced, an invalid version or page data is deleted. |
| aioness_cart_* | LocalStorage; Cart | A company basket identifier, when you use a purchase. Order contents are kept separately on the server. | Until the removal after completion or determination of the invalid basket, or deletion of the page data; there is no independent timeout of the local pointer. |
| aioness_language | HTTP cookie; language | Interface language for subsequent requests to the server. | Up to 365 days since the last recording. |
| aioness-prototype-language | localStorage; language | Preserved interface language selection. | No built-in expiration; until page data is changed or deleted. |
| aioness-automatic-language | sessionStorage; language recommendation | Temporary automatic language recommendation. | The recommendation is used for a maximum of 6 hours; the record itself can remain until the end of the card session or replacement. |
| aioness-theme-preference / aioness-site-theme / aioness-auth-theme / aioness-panel-theme | localStorage; display | The selected light, dark, or system theme and compatible records of different parts of the interface. | No built-in expiration; until page data is changed or deleted. |
| aioness.booking.serviceView | localStorage; display | Select to display services as a network or list. | No built-in expiration; until page data is changed or deleted. |
| aioness.booking.scrollToCalendar | sessionStorage; navigation | One-time return of the display to the calendar after the requested navigation. | Until read and remove, or end of card session. |
| aioness.guide-registration.v1 | sessionStorage; draft registration | Entered business and contact data and registration steps. Password is not part of this policy. | The draft is renewed only if it is not older than 2 hours; it is removed after a successful registration or at the end of the card session. |
| aioness_homepage_prototype_saved_businesses | localStorage; preserved companies | A list of businesses that the user has marked for storage. | No built-in expiration; until list changes or page data is deleted. |
| aioness:panel-counter-seen:* | localStorage; business panel | A memorised display of the counter by order and role. | No built-in expiration; until the state is replaced or page data is deleted. |
The choice of the country and currency of the package and the purchase currency of the individual company can be stored on the server within the existing session. The browser uses an existing session cookie; no separate advertising or analytics identifier is introduced. The choice of currency with the basket and the completion of the order serves the execution of the explicitly requested function. By deletion or expiration of the session the selection can be returned to the base currency, while the confirmed orders and their currency remain stored under the transaction retention rules.
5. External services and content
Before activating external analytics, ads or other add-ons, an inventory must be supplemented: the legal name of the provider, the purpose, name or group of records, duration, category, country and appropriate transmission protection. Service selection is ongoing; no unknown hosting or payment service is listed in this document.
Maps, form protection, video, payment and social integrations may send data to an external server even without cookies. Map features in the application may load OpenStreetMap and Nominatim. The need for a prior choice and additional information must be assessed for the actual feature and data flow.
A business adding its own technology is responsible for its lawfulness and clear information, while Aioness remains responsible for its own part of the service. Business content is not automatically covered by the inventory of Aioness’s first-party records.
6. How to give, refuse or withdraw consent
In the cookie window, you can accept everything, reject optional categories, or save a custom selection. A button to change the selection is also available on this page. Rejection of optional technologies must not disable a basic service that does not really depend on them.
The choice applies to the browser, device and the appropriate context of the page in which it is saved. It may need to be repeated in another browser, private window, on another device, or after deleting local data. The settings of one firm should not be assumed as universal consent for all other firms.
Withdrawal of consent stops future processing that depends on that consent. It does not invalidate the lawfulness of the previous processing and does not in itself erase any previously stored data with the provider. The necessary deletion actions or privacy request are arranged separately.
In this development version, further checks are needed to ensure that every optional integration respects the choice before loading and after consent is withdrawn. Some language and display preferences are currently stored independently of the preferences category. This draft does not confirm that technical control of every optional record is complete.
7. Recording choices and renewing consent
The local choice record contains a consent ID, the selection method, the mechanism version, the decision date and time, and the permitted categories. When certain forms are submitted, the application may also store a snapshot of the choice, acceptance of terms, timestamp, IP address and browser information as evidence of that specific action.
This does not mean that every change in the window is automatically recorded on the server. The version of the cookie mechanism and the version of this document are not the same. The new text of the document itself does not mean that the user has given new consent.
The current local record does not have an automatic expiration date; version compatibility is checked. An appropriate re-selection period according to local rules and risk should be established and implemented prior to production application. In the case of a material change of purpose or provider, a new choice is required when the prior consent is no longer concrete enough.
8. Controlling through the browser
In your browser settings, you can view and remove cookies and site data and limit their future storage. For complete removal, local memory should usually be selected, not just HTTP cookies. Deleting a session can log you out, remove a saved selection, or terminate your cart and draft form.
Private browsing does not itself prevent all network requests or server-side processing. Removing records from your device is not the same as requesting deletion of an account, booking or statutory record.
9. Personal data, rights and contact
More about purposes, legal bases, recipients, transfers, deadlines and rights can be found in the privacy policy. For questions about this policy or a request related to data please contact privacy@aioness.com .
The inventory and rules need to be updated before the technology changes, and the actual behavior checked on the public page, login, registration, billing and business pages. The date and version of the document allow you to monitor the current policy and its amendments.